Method used to test whether the USG5000 is accessible after NAT Server is configured

No matter whether intranet users access the FTP server on the public network or the IP address of the FTP server on the private network is mapped to a public IP address by a NAT server, the NAT ALG function for FTP needs to be enabled.
For example, enable the NAT ALG function for FTP as follows:
<Huawei> system-view  
[Huawei] nat alg ftp enable
Reason:
NAT and NAPT can translate only IP addresses in the IP packet header and the port numbers in the TCP/UDP header. For some special protocols such as FTP, IP addresses or port numbers may be contained in the Data field of the protocol packets. Therefore, NAT cannot translate the IP addresses or port numbers. A good way to solve the NAT issue for these special protocols is to use the application level gateway (ALG) function.
As a special translation agent for application protocols, the ALG interacts with the NAT-enabled device to establish states. It uses NAT state information to change the specific data in the Data field of IP datagram and complete other necessary work, so that application protocols can run across private and public networks.
For example, when an FTP server with a private IP address sets up a session with a host on the public network, the server may need to send its IP address to the host. NAT cannot translate this IP address because the IP address is carried in the Data field. The host on the external network then uses the private address carried in the IP packet and finds that the FTP server is unreachable.
After the NAT ALG function is enabled for an application protocol, packets of the application protocol can traverse the NAT device. Otherwise, the application protocol cannot work normally.

Can the intranet servers use the same port number to access the external network after experiencing the NAT on the USG2000, USG5000, and USG6000? No.

You can configure the UDP port mapping when configuring NAT Server for the USG2000 and USG5000 series. The configuration method is the same as that for TCP port mapping. [USG]nat server protocol udp global 1.1.1.1 10000 inside 2.2.2.2 10000 [USG]disp nat server id : 3 zone : --- interface : --- global-start-addr : 1.1.1.1 global-end-addr : --- inside-start-addr : 2.2.2.2 inside-end-addr : --- global-start-port : 10000(hwcc) global-end-port : --- insideport : 10000(hwcc) globalvpn : public insidevpn : public protocol : udp vrrp : --- no-reverse : no

Check whether the interzone policy is enabled on the firewall.