Network Address Translation and Port Address Translation

NAT is a router function, which allows it to translate the addresses of hosts behind a firewall. This also helps to overcome IP address shortage, and provides security by hiding the entire network and its real IP addresses.

NAT is typically used for internal IP networks that have unregistered (not globally unique) IP addresses. NAT translates these unregistered addresses into legal addresses on the outside (public) network.

PAT provides additional address expansion but is less flexible than NAT. With PAT, one IP address can be used for up to 64,000 hosts by mapping several IP port numbers to one IP address. PAT is secure because the inside hosts' source IP addresses are hidden from the outside world. The perimeter router typically provides the NAT or PAT function.

NOTE PAT uses unique source port numbers on the inside global IP address to distinguish between translations. Because the port number is encoded in 16 bits, the total number of ports could theoretically be as high as 65,536 per IP address. PAT will attempt to preserve the original source port. If this source port is already allocated, PAT will attempt to find the first available port number starting from the beginning of the appropriate port group, 0-511, 512-1023, or 1024-65535. If there is still no port available from the appropriate group and more than one IP address is configured, PAT will move to the next IP address and try to allocate the original source port again. This continues until it runs out of available ports and IP addresses. (From http:// www.cisco.com/warp/public/cc/pd/iosw/ioft/ionetn/prodlit/1195_pp.htm.)

NAT is defined in RFC 1631, the text of which can be read at http://www.ietf.org/rfc/rfc1631.txt. Cisco devices started supporting NAT in Cisco IOS versions 11.2 and higher. NAT basically provides the capability to retain your network's original IP addressing scheme while translating that scheme into a valid Internet IP address to ensure that intruders never view your private address.

NOTE Cisco IOS 12.0 and higher support full NAT functionality in all images. Version 11.2 and higher need "Plus" image for a NAT feature set.

NAT changes the Layer 3 address when the packet is sent out to the Internet. This is a function no other protocol will do (that is, alter the Layer 3 source address).

For your review and to fully prepare you for the exam, Table 6-2 explains some of the terminology used in a NAT environment.

Table 6-2 NAT Terminology

Readers' Questions

  • Rowan
    Why is network address translation (nat) possible?
    1 month ago
  • Network Address Translation (NAT) is possible because it allows a single device, such as a router, to act as an agent between the Internet (or “public” network) and a local network (or “private” network). By using NAT, the router can hide the details of the private network from the public network, thus protecting the local network from malicious outside traffic. NAT also allows for better utilization of IP addresses on the public network, as it allows private networks to “borrow” public IP addresses for their own devices.
    • sandra
      Why is network address translation (nat) possible?
      2 months ago
    • Network address translation (NAT) is possible because of the ability of network hardware to rewrite the source address of a packet at the point of transfer. NAT allows a single device (such as a router) to act as an agent between the internet and a local network, allowing multiple computers on the local network to access the internet through a single public IP address. NAT also helps to conserve IP addresses, by allowing multiple devices to share a single address. This is especially useful in cases where the number of IP addresses available in a private network is limited.
      • bertoldo
        Why is network address translation (nat) possible?
        3 months ago
      • Network Address Translation (NAT) is possible because of the way it is able to map multiple internal IP addresses to one external IP address. NAT allows a single device, such as a router, to act as an agent between the Internet and a local network. This means that only one device is exposed to the Internet instead of allowing all devices on the network to be seen. NAT acts as a proxy and essentially allows many devices to share the same public IP address. Additionally, it allows for the organization to be private and secure, as NAT makes it difficult for malicious attackers to gain access to the local network.
        • helen
          Why is network address translation (nat) possible?
          4 months ago
        • ? Network Address Translation (NAT) is possible because it allows a single device, such as a router, to act as an agent between the internet and a local network. It can hide the details of the local network, such as IP addresses, from the outside world. It allows organizations to use their own local IP space, instead of having to get a public IP address from an ISP. NAT also helps conserve IP addresses, since a single public IP address can be used for multiple private IP addresses. It can also increase security by making it harder for malicious Internet traffic to access local devices.
          • brhane isaias
            Why is network address translation (nat) possible?
            5 months ago
          • Network Address Translation (NAT) is possible because of the way IP (Internet Protocol) addresses are structured and allocated. NAT requires the use of a proxy server, which sits between the internal and external networks and acts as an intermediary for all communication. By masking the IP addresses of internal machines from external machines, NAT provides a layer of security to the internal network, as well as allowing multiple machines to access the internet from a single IP address. NAT also helps to conserve IP address space, as fewer IP addresses are required on the internal network.
            • Aaron
              What hides internal ip structure from the external world?
              5 months ago
            • A firewall can be used to hide the internal IP structure from the external world. Firewalls are network security systems that use packet filtering to block and allow traffic entering and exiting a network. Firewalls can be configured to allow or deny traffic based on IP address, port, or protocol. This makes it possible to protect the internal network from external threats. Additionally, a firewall can be configured to act as a gateway, providing users with access to the internal network, while still keeping the internal IP structure hidden from the external world.
              • delma
                Why is network address translation (nat) possible?
                6 months ago
              • Network Address Translation (NAT) is possible because it allows a single device, such as a router, to act as an agent between the internet and a local network. The device can then translate the internal (private) IP addresses of the local network into public IP addresses that can be routed on the internet. This is done by assigning a unique public IP address to the router and then having the router route any traffic to the correct device on the local network. This allows multiple devices on a local network to share a single public IP address, which can be very cost effective.
                • everard
                  Why is network address translation (nat) possible?
                  7 months ago
                • Network Address Translation (NAT) is possible because it allows a single device, such as a router, to act as an intermediary between the internal network and external network. NAT helps conserve addresses by allowing multiple machines to share a single address in the external network. It also helps to hide internal network information and helps to securely connect to external networks by hiding the internal IP address.
                  • Katharina
                    Why is network address translation (nat) possible?
                    7 months ago
                  • Network Address Translation (NAT) is possible because it enables multiple devices, that are connected to the same network, to be assigned a single public IP address. This allows users to keep their private IP addresses hidden from the public, providing an extra layer of network security. In addition, NAT also helps reduce the strain on public IP address spaces by allowing a single public address to serve multiple devices and helps conserve the finite IPv4 address pool.
                    • PANDORA
                      Why is network address translation (nat) possible?
                      7 months ago
                    • Network Address Translation (NAT) is possible because it allows a single device, such as a router, to act as an agent between the Internet and a local network. NAT uses a set of rules to rewrite the source and/or destination addresses of IP packets as they pass through the router. This allows the router to map multiple internal IP addresses to a single public IP address, conserves public IP addresses, and hides internal network details from external users.
                      • filmon
                        What secure protocol is recommended for network address translation?
                        7 months ago
                      • Secure Shell (SSH) is the most secure protocol recommended for network address translation. SSH is a secure protocol that encrypts data traveling over the network and provides a secure connection between two systems.
                        • lalli
                          Why is network address translation (nat) possible?
                          8 months ago
                        • Network Address Translation (NAT) is possible because it allows multiple devices on a private network to use a single public IP address to connect to the internet. NAT saves IP addresses by allowing multiple devices to share a single IP address, and also provides security benefits because it hides the private IP address of a device from the public server.

                          Term

                          Meaning

                          Inside local address

                          An IP address that is assigned to a host on the internal network; that is, the logical address that is not being advertised to the Internet. A local administrator generally assigns this address. This address is not a legitimate Internet address.

                          Inside global address

                          A legitimate registered IP address that represents one or more inside local IP addresses as assigned by the InterNIC.

                          Outside local address

                          The IP address of an Internet's outside host that is being translated as it appears to the inside network.

                          Outside global address

                          The IP address assigned to a host on the outside of the network before it is translated by the router's owner.

                          Figure 6-2 displays a typical scenario where a private address space is deployed that requires Internet access. The Class A 10.0.0.0/8 address is not routable in the Internet.

                          Figure 6-2 Typical NAT Scenario

                          Inside or Private Network Outside Network

                          Inside or Private Network Outside Network

                          Inside Address Outside Address 210.1.1.0/24

                          10.99.34.1 131.108.1.1

                          10.99.34.2 131.108.1.2 ... so on ... and so on

                          Inside Address Outside Address 210.1.1.0/24

                          10.99.34.1 131.108.1.1

                          10.99.34.2 131.108.1.2 ... so on ... and so on

                          The users in Figure 6-2 are configured with the inside local addresses ranging from 10.99.34.1/24 to 10.99.34.254/24. To allow Internet access, NAT (PAT could also be configured if only one IP address was allocated by InterNIC) is configured on Router R1 to permit the inside local addresses access to the Internet. Advantages of using NAT include the following:

                          ■ You can hide the Class A address space 10.99.34.0/24.

                          To view the NAT translation table on the Cisco router, apply the EXEC command show ip nat translations on the CLI.

                          ■ You can connect a nonroutable network to the Internet.

                          ■ You can use unregistered address space and NAT to the Internet.

                          ■ You can use both NAT and PAT on the same router.

                          ■ You can have 64,000 inside hosts per allocated IP address.

                          The InterNIC is an Internet authority that is assigned the task of allocating IP address space to the public. For example, Figure 6-2 assumes that the InterNIC assigned the address space 210.1.1.0/ 24 for use.

                          NOTE Disadvantages of NAT/PAT include the following:

                          ■ Drain on CPU processing power.

                          Layer 3 header and source address changes.

                          ■ Some multimedia-intensive applications do not support NAT, especially when the data stream inbound is different from the outbound path (for example, in multicast environments).

                          Continue reading here: NAT Operation on Cisco Routers

                          Was this article helpful?

                          0 0