Module 6 Notes

Network Address Translation Notes

• Run out of Ipv4 addresses -> use private addresses instead -> Not routable on the internet
• NAT
  • NAT remaps one IP address space into another
  • We modify network address information in IP packet header while they are in transit across a router.
    
    
  • Clients make outbound connections, so they can share public IPs.
  • A NAT router will track the translations to send reply packets back to the sender.
• What does a NAT router do?
  • Source IP rewrite for outbound packets
  • Destination IP rewrite for inbound packets
  • Track the assignments in a table
    • May also require rewriting layer 4 headers
    • Source Port TCP/UDP often used to track translations
  • Security -> Private IPs cannot typically be directly accessed from outside the network
• IP Masquerading
  • The private source IP address that is changed into a public address as the "new" source address of the outgoing IP packet
    • This allows communication through the router only when the conversation originates inside the masqueraded network.
    • Masquerading routers keep stateful translation tables of each conversation to remember the original source to send packets back to.
    • Translation tables are flushed after a defined period unless new traffic refreshes their state to prevent port exhaustion and free state table resources.
      
      
• Types of NAT
  • Static NAT: one-to-one IP mapping, port forwarding
    • Admin can configure translation table entries for permanent use
    • port forwarding -> allows traffic out of the network to reach designated hosts in the masqueraded network
    • Simple -> useful for small networks
  • Dynamic NAT: many-to-many IP mapping
    • Maps unregistered private IP address to registered public IP address by selecting public IP from a pool
    • many-to-many
    • Used when PAT isn't supported
    • Limited by the public pool
  • Port Address Translation (PAT): many-to-one IP mapping, IP Masquerading
    • Allow multiple devices to be mapped to a single public IP address
    • PAR uses the source TCP port number as a way to track everyone connecting
    • table tracks the mapping between original IP/port and new IP/port

Configuring NAT in Cisco

1. Define the “inside” and “outside” interfaces

   • Typically inside is the interface connected to the Private Addresses
   • Outside is the interface connected to the Public address
   • E.g.:
     • #interface serial 0/0/0
     • (config-if)#ip nat outside

2. Set NAT Rules

   • Static mappings
   • PAT/Dynamic pool assignments