Public Versus Private IP Addresses
The question of whether to use private addressing is becoming a part of network design for many corporate TCP/IP application users. The Internet has grown beyond anyone's expectations. With this growth came concerns about Internet address depletion and, more importantly, address allocation procedures and their impact on the Internet routing system. There are a few reasons why private address space could and should be used (such as for environments where external connectivity may not be required or is extremely limited). Some examples are listed here:
• A large organization where only a small number of specific hosts are allowed access to the Internet.
• A large organization where outside Internet access is allowed only to a few specified hosts, such as Web servers.
• An organization that may have had to switch Internet service providers and received a new block of address space. It may be too cost prohibitive or disruptive to change to the new address space at the time.
The cost of using private Internet address space is the potentially costly effort to renumber hosts and networks between public and private. If the company has any thought about opening up to global Internet access, it is recommended that the corporation start a transition plan for renumbering to a globally unique address if it is currently using private address space. The widespread use of DHCP is making this process much easier and will avoid possible future issues with non-NATable and non-proxyable protocols.
However, if you decide to use private address space, you don't have to coordinate with IANA or an Internet registry. Addresses within this private address space are unique only within your network.
Note Remember, if you need globally unique address space, you must obtain addresses from an Internet registry. This is necessary if any part of your network is connected to the Internet.
To use private address space, determine which hosts do not need to have network layer connectivity to the outside. These hosts are private hosts and will use private address space. Private hosts can communicate with all other hosts within the corporate network, both public and private, assuming that all addressing within the corporate network is unique. However, the private hosts cannot have IP connectivity to any host external to the corporate network without the use of NAT or proxies.
All public hosts use the globally unique address space assigned by an Internet registry. Public hosts can communicate with other hosts within the network and can have IP connectivity to external public hosts. Figure 9-7 shows the differences between public and private address spaces (assuming that NAT is not being used).
|
Figure 9-7: Private and Public Address Spaces |
||
Because private addresses have no global meaning, routing information about private networks is not propagated on outside links, and packets with private source or destination addresses should not be forwarded across such links. Routers in networks that don't use private address space---especially those of Internet service providers—should be configured to reject (filter out) routing information about private networks.
With this scheme, many large networks need only a relatively small block of addresses from the globally unique IP address space. The Internet at large benefits through conservation of globally unique address space, and the corporate networks benefit from the increased flexibility provided by a relatively large private address space.
Continue reading here: PIX Firewall with Screening IOS Router
Was this article helpful?