How to Configure Moxa NAT-102

How to Configure Moxa NAT-102

Overview

This article will review how to program the NAT-102 device out of the box and setup some basic NAT rules. 

Requirements

  1. Ethernet Cable 
  2. Ethernet Port on PC
  3. Permissions to change Ethernet IP Address on PC

Initial Configuration

Connect and Log In to NAT-102

  1. Connect an Ethernet cable directly between your PC Ethernet port and port 1 (INTERNAL PORT) on NAT-102
  2. Change your Ethernet adapter to be on the same subnet as NAT-102
    1. IP Address: 192.168.127.100
    2. Subnet Mask: 255.255.255.0
  3. Navigate to https://192.168.127.254
  4. When prompted to log in, Username is "admin" and Password is "moxa", press LOG IN when done

Check/Update Firmware

Check Firmware

  1. On the Device Summary page, look for Firmware Version, we need this to be v3.28 or newer, if an update is needed, proceed to Update Firmware. 

Update Firmware

  1. Download firmware
  2. Go to System > System Management > Firmware Upgrade
  3. For Method, choose "Local"
  4. For Select File, click the folder and navigate to the .rom file
  5. Click UPGRADE
    6. WarningDo not power down or disconnect from NAT-102 until firmware update is complete, approximately 90 seconds, at which point you can simply refresh the browser page
  6. Log back in and confirm firmware was updated by checking Firmware Version

Update Password

  1. Go to System > Account Management > User Accounts
  2. Click the pencil next to the admin account
  3. Click CHANGE PASSWORD
  4. If still default, use "moxa" as the old password and use a new password of your choosing
  5. Click APPLY when done
    6. AlertKeep the password on your records, a factory reset is the only way to recover a lost password

Network Configuration

The NAT-102 uses VLANs to route traffic and handle NAT. Both ports are technically configurable to suite your needs. 
Alert
It is important to do the following in order when performing initial configuration.

Create VLANs

  1. Go to Network Configuration > Layer 2 Switching > VLAN
  2. Click + to add a VLAN
  3. Name this VLAN ID (VID) "1001"
  4. Click CREATE
  5. Click + to add another VLAN
  6. Name this VID "1002"
  7. Click CREATE
    8. InfoThere will be additional VLAN configuration in later steps, do not go further at this time as you may lose access to GUI

Configure LAN IP address

Info
This creates the private LAN network which is essentially the NAT-102 IP address and ultimately the private LAN gateway.
  1. Go to Network Configuration > Network Interfaces
  2. Stay in the LAN tab
  3. Click + to add a LAN Interface
  4. Name is "INTERNAL"
  5. VLAN ID, choose "1001"
  6. Enter an IP Address, SFA uses .254 as the last octet when possible
  7. If needed, change Netmask, default is the common 24 (255.255.255.0)
  8. Click CREATE

Configure WAN IP address

Info
This will be the company IP address which is the way your software will access the devices on the LAN network of this device.
  1. Go to Network Configuration > Network Interfaces
  2. Go to WAN tab
  3. Click + to add a WAN Interface
  4. VLAN ID, choose "1002"
  5. WAN ID, choose "1"
  6. Connection Type, choose "Static IP"
  7. In the Address Information section, fill out IP Address, Netmask, and Gateway
  8. Click CREATE

Assign VLANs

  1. Go to Network Configuration > Layer 2 Switching > VLAN
  2. In the lower section, click the pencil on Port 2
  3. PVID, choose "1002"
  4. Click APPLY
  5. Click the pencil on Port 1
  6. PVID, choose "1001"
  7. Click APPLY
    8. InfoAfter clicking APPLY, you will be disconnected. You will need to update your PCs Ethernet IP to be on the LAN subnet. You can access the Web GUI using the LAN IP address, i.e. Gateway, when connected to port 1. 

Allow Ping Responses on WAN

  1. Go to System > Management Interface > Ping Response
  2. Click the dropdown for Interfaces Allowing Default Ping Response, check "WAN"
  3. Click APPLY

All Web GUI Access on WAN

  1. Go to Security > Device Security > Trusted Access
  2. Click + to add an Allowlist policy
  3. Rule Name, enter "WAN"
  4. IP Address, enter PCs IP address that is allowed to access Web GUI
    5. InfoTo allow an entire subnet, use the subnet IP, e.g. 192.168.4.0
  5. Choose a Netmask
  6. Interface, choose "WAN"
  7. Service Control, set to "Enabled"
  8. Allowed Services, choose "Web (HTTP/HTTPS)"
  9. Click APPLY

Network Address Translate (NAT)

1-1 NAT

1-to-1 NAT maps one private LAN IP address to one external WAN IP address. This allows a device to communicate with an external network without changing its existing IP configuration. The NAT device translates the IP addresses in traffic passing between the two networks. This is ideal in situations where multiple devices are to be translated using NAT such as CNC machining cells. 

Requirements

  1. WAN IP for each device to be translated
  2. Private LAN IP of each device to be translated

Creating NAT Rule

  1. Go NAT > NAT Setting
  2. Click + to add a NAT rule
  3. Description, add an optional description
  4. Mode, choose "1-to-1"
  5. Double NAT, choose "Enabled"
  6. Incoming Interface, choose "WAN"
  7. Original Packet: Destination IP, enter WAN IP address of device on private network
  8. Translated Packet: Destination IP, enter LAN IP address of device on private network
  9. Click APPLY
  10. Repeat for additional device