NAT Operation on Cisco Routers

When a packet leaves the inside network, NAT translates the inside address to a unique InterNIC address for use on the outside network, as previously shown in Figure 6-2.

The R1 Router in Figure 6-2 will be configured for an address translation and will maintain a NAT table. When an IP packet returns from the outside network, the NAT router will then perform an address translation from the valid InterNIC address to the original local inside address.

Several internal addresses can be translated to only one or a few external addresses by using PAT, which is also referred to as overload in Cisco IOS configuration syntax.

With Cisco IOS, the overload commands allow up to 64,000 connections to be translated per IP address. The overload command does not work well with certain applications such as multimedia streams, because some video applications, for example, have an inbound data stream that is different from the outgoing stream. For example, if the application contains the source and destination IP addresses in the data portion of the IP packet (Layer 7, for example), NAT will change the Layer 3 header, which may cause the application to fail.

Cisco IOS NAT functionality prevents the inside of your network from becoming a potential easy target. Because the internal addresses (for example, IP subnets in the range 10.0.0.0/8) are not routable through to the Internet, Cisco IOS NAT can also prevent an inside address from launching an attack or becoming active in attacking other hosts. Most importantly, Cisco IOS NAT prevents inside hosts behind a NAT interface from being sourced from the outside world.

Most secure organizations also prevent the 10.0.0.0/8 nonroutable network from being spoofed with an access list on the outside interface, such as the following (one of the ranges defined in RFC 1918, noting we deny 10.0.0.0/8 first followed by permit statements):

access-list 100 ip deny 10.0.0.0 0.0.0.255 any log access-list 100 permit statements

Notice that the keyword log is applied so that a security administrator can monitor spoofed addresses as well. The log statement does have an impact on the CPU of the router because it causes all packets to be process switched, so use the command with caution.

Dynamic NAT Configuration Task List

This section looks at the steps required to configure dynamic NAT on a Cisco router. Dynamic NAT maps any unregistered IP addresses to a registered IP address from a group of registered IP addresses. Dynamic NAT creates active translation entries in a NAT table when a packet crosses from an IP NAT inside interface to an IP NAT outside interface, or vice versa.

The basic configuration tasks are as follows:

Step 1 Determine the network addresses to be translated. Step 2 Configure the inside network with the following IOS command: ip nat inside

Step 3 Configure the outside network with the following IOS command: ip nat outside

Step 4 Define a pool of addresses to be translated with the following IOS command:

ip nat pool pool-name start-ip-address end-ip-address mask

Step 5 Define the addresses that are allowed to access the Internet with the following IOS command:

ip nat inside source list access-list-number pool pool-name

For a more specific illustration, configure NAT on Router R1. In Figure 6-2, the NAT pool name is going to be CCIE. (You can use any name you want.) Assume that the InterNIC has assigned to you the Class C address of 210.1.1.0/24.

Your Internet service provider (ISP) has also supplied you with the unique address 131.108.1.0/30 (this address will be the NAT address 131.108.1.1 or 131.108.1.2) to use on your serial connection.

Example 6-3 provides a sample NAT configuration for this setup.

Example 6-3 Sample NAT Configuration on R1

hostname R1
ip nat pool CCIE 210.	1.1.1 210.1.1.254 netmask 255.255.255.0
ip nat inside source	1 pool CCIE
interface ethernet0
ip address 10.99.34.1	255.255.255.0
ip nat inside
interface serial 0
ip address 131.108.1	1 255.255.255.252
ip address 210.1.1.1	255.255.255.0 secondary
ip nat outside
access-list 1 permit	10.99.34.0 0.0.0.255

It is assumed that you have an IP routing protocol to advertise the IP networks shown in the sample, which are 131.108.1.0/30 and 210.1.1.0/24, to the remote ISP router through R1's serial 0 interface.

The configuration shown in Example 6-3 translates the inside addresses 10.99.34.0/24 into globally unique addresses ranging from 210.1.1.1/24 to 210.1.1.254.

Monitoring NAT Operations with show Commands

To monitor the operation of NAT, you can use the following commands:

show ip nat translation [verbose] show ip nat statistics

The show ip nat translation command displays the current active transactions. The show ip nat statistics command displays NAT statistics, such as how many translations are currently taking place.

There are four different versions of NAT translations:

■ Static NAT—Maps an unregistered IP address to a registered IP address on a one-to-one basis. This is particularly useful when a device needs to be accessible from outside the network to an internal unregistered address.

■ Dynamic NAT—Maps an unregistered IP address to a registered IP address from a group of registered IP addresses.

■ Overloading—A form of dynamic NAT that maps multiple, unregistered IP addresses to a single registered IP address by using different ports.

■ Overlapping—When the IP addresses used on your internal network are registered IP addresses in use on another network, the router must maintain a lookup table of these addresses so that it can intercept them and replace them with registered unique IP addresses.

For more quality examples on NAT, visit http://www.cisco.com/cgi-bin/Support/browse/ psp_view.pl?p=Internetworking:NAT.

For demonstrations of when you can use NAT over an IPSec tunnel, visit www.cisco.com/warp/ customer/707/overload_private.shtml.

NOTE TCP load distribution is typically used in large IP networks that have server farms. You might want to distribute the network load across many servers but advise users to use only one IP address to target. TCP load distribution ensures that all servers are equally loaded. For details on NAT order of operation, which describes how NAT operates in full detail, visit http://www. cisco.com/en/US/partner/tech/tk648/tk361/technologies_tech_note09186a0080133ddd.shtml.

Continue reading here: Configuring a PIX Firewall

Was this article helpful?

0 0