NAT, Easy IP, and NAT Server

NAT, Easy IP, and NAT Server

Quick Answer: NAT rewrites IP addresses at the edge so private hosts can use public connectivity. Easy IP is Huawei source NAT that uses the outbound interface address as the public source—ideal for many users sharing one WAN IP. NAT Server creates a static mapping so the Internet can initiate sessions to an internal server. Direction matters: Easy IP is for outbound; NAT Server is for inbound publish.

IPv4 public addresses are scarce. Campus and branch networks almost always use private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) on the inside and a small set of public addresses on the WAN. Network Address Translation (NAT) on the Huawei edge router or firewall-capable device rewrites packets so return traffic finds the correct session. HCIA-Datacom tests whether you choose the right NAT style for a requirement and whether you understand which address field changes in each direction.

Why NAT exists

NAT is not a full security system by itself, but it does block unsolicited inbound connections to unmapped private hosts—one reason NAT Server (or port mapping) must be added explicitly when you host a service for the Internet.

Private versus public addressing in exam language

Private addresses are not globally routable on the public Internet. When a PC at 192.168.1.10 sends to 8.8.8.8, the packet must leave the site with a public source the ISP will route and that the remote host can reply to. NAT performs that rewrite and maintains a translation table so replies can be de-translated back to 192.168.1.10.

Without NAT (or without public addressing on every host), inside systems cannot complete Internet sessions. With NAT but no inbound mapping, an outside client cannot open a new session to a random inside PC—by design.

Source NAT concepts

Source NAT changes the source IP (and often source port) of packets leaving the inside network:

1. Inside host sends packet: src = private IP, dst = Internet IP.
2. Edge device matches a NAT policy / ACL of interest traffic.
3. Device replaces src with a public address (pool or interface IP) and records the mapping.
4. Reply returns to the public address; device restores the original private source as destination for the inside hop.

Port rewriting (sometimes called PAT or NAPT in multi-vendor texts) lets thousands of inside sessions share one public IP by differentiating source ports. HCIA language on Huawei gear emphasizes Easy IP and NAT address groups rather than Cisco PAT branding, but the idea is the same: many-to-one source translation.

Easy IP on Huawei

Easy IP is the associate-level workhorse for branch Internet access:

Conceptual configuration pattern (understand the pieces; exact CLI varies by VRP version):

1. Define an ACL that permits inside subnets that should access the Internet (interest traffic).
2. On the NAT device, associate that ACL with Easy IP outbound on the WAN interface.
3. Ensure routing sends Internet-bound traffic out that interface.
4. Optionally combine with security zones or firewall policies on platforms that separate trust domains.

Exam trap: Configuring Easy IP but forgetting the ACL match—or writing a deny-heavy ACL—so no traffic is translated. Another trap: applying Easy IP on the wrong interface (inside LAN instead of outside WAN), so translation never sees outbound Internet flows correctly.

NAT address groups (pool-based source NAT)

When one interface address is not enough—or policy requires a dedicated public range—Huawei uses a NAT address group (pool) of public IPs for source translation. Compare:

Both are still source NAT for outbound sessions. The difference is where the public source addresses come from, not the inside/outside direction model.

NAT Server (static mapping for inbound services)

NAT Server publishes an internal server to the outside world. You map a public IP + protocol/port (or a public IP alone for full host mapping) to an inside IP + port. Unsolicited traffic that arrives on the outside matching that mapping is translated destination-wise toward the private server; return traffic is source-translated back.

Example story: Public 203.0.113.5 TCP 443 maps to inside 10.1.1.20 TCP 443. Outside clients connect to 203.0.113.5:443; the router rewrites destination to 10.1.1.20:443. Inside server replies; the router ensures the outside client still sees 203.0.113.5 as the peer.

Exam trap: Using Easy IP alone and expecting inbound server access—Easy IP does not create a stable public destination mapping for unsolicited inbound sessions. Conversely, NAT Server alone does not give every PC shared outbound Internet access unless source NAT is also present.

Inside and outside interfaces (HCIA-level model)

Associate-level questions use a simple edge model:

Translation direction follows session flow:

• Outbound user traffic: source private → source public (Easy IP / source NAT) on the path toward outside.
• Inbound published service: destination public → destination private (NAT Server) when traffic arrives from outside.

Some platforms also speak of “inside local / inside global / outside local / outside global” address roles. For HCIA, keep the mental model tighter: local private host address, global public address seen on the Internet, and which feature maps them for each direction.

ACL interest traffic and order of operations

NAT often consults an ACL to decide which packets are eligible:

• Permit lines define inside sources (and optionally destinations) that receive source NAT.
• Packets not matched may be routed without translation—usually failing on the Internet if sources are private.
• Overly broad permits can translate traffic you meant to keep private on a partner link; overly narrow permits break browsing for some subnets.

Think of ACL + NAT as a pair: routing decides where the packet goes; NAT decides how addresses look when they leave. Both must be correct.

Common failure modes

Worked mini-scenarios

Scenario A — Branch office: 50 PCs on 192.168.10.0/24; single PPPoE WAN IP. Solution: ACL permit 192.168.10.0/24, Easy IP on dialer/WAN. No NAT Server.

Scenario B — Publish intranet HTTPS: Same branch plus server 192.168.10.50 needing public 203.0.113.10:443. Solution: keep Easy IP for users; add NAT Server mapping 203.0.113.10:443 → 192.168.10.50:443; open security policy if the platform filters.

Scenario C — Wrong tool: Stem says “allow Internet users to open the internal FTP server” and options include only Easy IP—Easy IP is insufficient; choose NAT Server (or equivalent static destination NAT).

Practice goals before the next section

1. Label private vs public addresses on an edge diagram and mark inside/outside.
2. Choose Easy IP vs NAT Server for five one-sentence requirements.
3. Explain why many-to-one source NAT needs port differentiation in the translation table.
4. Predict the failure if NAT Server maps the wrong inside IP or TCP port.

With addressing and translation in place, day-2 operations still need file transfer, name resolution, time sync, and web access—covered next as core network services.