Operation of NAT
NAT is described in RFC 1631.1 The original intention of NAT was, like classless interdomain routing (CIDR), to slow the depletion of available IP address space by allowing many private IP addresses to be represented by some smaller number of public IP addresses. Since that time, users have found NAT to be a useful tool for network migrations and mergers, server load sharing, and creating "virtual servers." This section examines all these applications, but first describes the basics of NAT functionality and terminology.
Basic NAT Concepts
Figure 4-1 depicts a simple NAT function. Device A has an IP address that belongs to the private range specified by RFC 1918, whereas device B has a public IP address. When device A sends a packet to device B, the packet passes through a router that is running NAT. The NAT replaces device A's private address (192.168.2.23) in the source address field with a public address (203.10.5.23) that can be routed across the Internet, and forwards the packet. When device B sends a reply to device A, the destination address of the packet is 203.10.5.23. This packet again passes through the NAT router, and the destination address is replaced with device A's private address.
Figure 4-1 The NAT Router Replaces the Private Address of Device A (192.168.2.23) with a Publicly Routablc Address (203.10.5.23)
Inside
192.168.2.23
Packet 1
Source = 192.168.2.23 Destination = 192.31.7.130
Packet 2
Source = 192.31.7.130 Destination = 192.168.2.23
Packet 1
Source = 192.168.2.23 Destination = 192.31.7.130
Packet 2
Source = 192.31.7.130 Destination = 192.168.2.23
Packet 1
Source = 203.10.5.23 Destination = 192.31.7.130
Packet 2
Source = 192.31.7.130 Destination = 203.10.5.23
Outside
Packet 1
Source = 203.10.5.23 Destination = 192.31.7.130
Packet 2
Source = 192.31.7.130 Destination = 203.10.5.23
192.31.7.130
192.31.7.130
NAT is transparent to the end systems involved in the translation. In Figure 4-1, device A knows only that its IP address is 192.168.2.23; it is unaware of the 203.10.5.23 address. Device B, on the other hand, thinks the address of device A is 203.10.5.23; it knows nothing about the 192.168.2.23 address. That address is "hidden" from device B.
NAT can hide addresses in both directions. In Figure 4-2, NAT is performed on the addresses of both device A and device B. Device A thinks device B's address is 172.16.80.91, when in fact device B's real address is 192.31.7.130. You can see that the NAT router is translating both the source and destination addresses in both directions to support this address scheme.
Cisco NAT devices divide their world into the inside and the outside. Typically the inside is a private enterprise or ISP, and the outside is the public Internet or an Internet-facing service provider. Additionally, a Cisco NAT device classifies addresses as either local or global. A local address is an address that is seen by devices on the inside, and a global address is an address that is seen by devices on the outside. Given these four terms, an address may be one of four types:
• Inside local (IL)—Addresses assigned to inside devices. These addresses are not advertised to the outside.
• Inside global (IG)—Addresses by which inside devices are known to the outside.
• Outside global (OG)—Addresses assigned to outside devices. These addresses are not advertised to the inside.
• Outside local (OL)—Addresses by which outside devices are known to the inside.
Figure 4-2 The NAT Router Is Translating Both the Source and Destination Addresses in Both Directions
Inside
Packet 1
Source = 192.168.2.23 Destination = 172.16.80.91
192.168.2.23
Packet 2
Source = 172.16.80.91 Destination = 192.168.2.23
Outside
Packet 1
Source = 203.10.5.23 Destination = 192.31.7.130
Packet 2
Source = 192.31.7.130 Destination = 203.10.5.23
192.31.7.130
192.31.7.130
In Figure 4-2, device A is on the inside and device B is on the outside. 192.168.2.23 is an inside local address, and 203.10.5.23 is an inside global address. 172.16.80.91 is an outside local address, and 192.31.7.130 is an outside global address.
IG addresses are mapped to IL addresses, and OL addresses are mapped to OG addresses. The NAT device tracks these mappings in an address translation table. Example 4-1 shows the address translation table for the NAT router in Figure 4-2. This table contains three entries. Reading the entries from the bottom up, the first entry maps OL address 172.16.80.91 to the OG address 192.31.7.130. The next entry maps the IG address 203.10.5.23 to the IL address 192.168.2.23. These two entries are static, created when the router was configured to translate the specified addresses. The last (top) entry maps the inside addresses to the outside addresses. This entry is dynamic and was created when device A first sent a packet to device B.
Example 4-1 The Address Translation Table of the NAT Router in Figure 4-2
|
NATrouter#show ip nat translations |
|||
|
Pro Inside global |
Inside local |
Outside local |
Outside global |
|
--- 203.10.5.23 |
192.168.2.23 |
172.16.80.91 |
192.31.7.130 |
|
--- 203.10.5.23 |
192.168.2.23 |
172.16.80.91 |
192.31.7.130 |
|
NATrouter# |
|||
As the preceding paragraph demonstrates, a NAT entry may be static or dynamic. Static entries are one-to-one mappings of local addresses and global addresses. That is, a unique local address is mapped to a unique global address. Dynamic entries may be many-to-one or one-to-many. A many-to-one mapping means that many addresses can be mapped to a single address. In a one-to-many mapping, a single address can be mapped to one of several available addresses.
The following sections describe several common applications of NAT and demonstrate more clearly how static NAT and the various implementations of dynamic NAT operate.
Continue reading here: NAT and IP Address Conservation
Was this article helpful?