Summary
Highlights
This lecture covers Module 6: NAT for IPv4, discussing NAT characteristics, types, advantages, disadvantages, static NAT, dynamic NAT, PAT, and NAT64. NAT provides translation of private to public IPv4 addresses to conserve the limited IPv4 address space, as private addresses (defined by RFC 1918) cannot be routed over the internet.
A NAT router, typically at the network border, translates internal private IPv4 addresses to public ones when devices in a private network communicate with external resources. This involves a six-step process where the router adds a local-to-global address mapping to a NAT table for outgoing packets and uses this table to translate public addresses back to private ones for incoming responses.
NAT involves four types of addresses: Inside Local (source address as seen from the inside), Inside Global (source address as seen from the outside), Outside Local (destination address as seen from the inside), and Outside Global (destination address as seen from the outside). Terminology is always applied from the perspective of the device with the translated address.
Static NAT uses a one-to-one, constant mapping between a private and a public IPv4 address, configured manually by an administrator. It's ideal for devices needing consistent public access, like web or email servers, ensuring their IP addresses and configurations remain unchanged for remote access. This requires sufficient public IP addresses.
Dynamic NAT dynamically assigns public IPv4 addresses from a pool on a first-come, first-served basis. When an internal device requests access to the outside network, an available public IP from the pool is assigned. If the pool is exhausted, devices must wait for an address to become available. This also requires enough public addresses to satisfy simultaneous sessions.
PAT, also known as NAT Overload, maps multiple private IPv4 addresses to a single public IPv4 address (or a few) by using source port numbers to uniquely identify translations. This allows many internal devices to share one public IP. PAT modifies both Layer 3 (IP address) and Layer 4 (port number) headers, unlike NAT which only modifies Layer 3. This is commonly used in home networks.
PAT tries to preserve the original source port. If it's in use, PAT assigns the next available port from specific ranges. If all ports for an address are busy and there are more external addresses in the pool, PAT moves to the next address. Packets without Layer 4 port numbers, like ICMPv4, are handled differently, but this is beyond the current scope.
Advantages of NAT include conserving public IPv4 addresses, increasing connection flexibility by multiplexing application ports, consistency for internal addressing schemes, and hiding internal IP addresses (though it's not a security feature). Disadvantages include increased forwarding delays due to translation, loss of end-to-end addressing, difficulty in tracing, complications with tunneling protocols like IPsec, and disruption to services requiring external TCP connections or stateless protocols like UDP.
To configure static NAT on Cisco routers, define a one-to-one mapping between an inside local address and an inside global address using the 'ip nat inside source static' command. Then, configure interfaces as 'ip nat inside' or 'ip nat outside' relative to the NAT device. Verification is done using 'show ip nat translations' or 'show ip nat statistics'.
Dynamic NAT configuration involves five steps: define an address pool with 'ip nat pool', create a standard access control list (ACL) to identify internal addresses, bind the ACL to the pool using 'ip nat inside source list', and configure interfaces as 'ip nat inside' or 'ip nat outside'. If the NAT pool is exhausted, new requests must wait for an address. Verification uses 'show ip nat translations' and 'show ip nat statistics'.
To configure PAT to use a single IP, add the 'overload' keyword to the 'ip nat inside source list' command. This allows multiple internal hosts to share one public IP address, with traffic identified by unique port numbers. PAT can also be configured to use a pool of public IPv4 addresses, by binding a NAT pool to an ACL and adding the 'overload' keyword.
In PAT, multiple internal devices can share the same inside global IP address, but their traffic is differentiated by unique source port numbers automatically assigned by the router. Upon receiving a response, the router translates the destination public IP and modifies the port number back to its original value. Verification uses 'show ip nat translations' (showing different port numbers for the same global IP) and 'show ip nat statistics'.
IPv6 was designed to eliminate the need for NAT found in IPv4 due to abundant address space. However, IPv6 has Unique Local Addresses (ULAs) similar to RFC 1918 private addresses, but for site-local communication, not address conservation or security. NAT64 is an IPv6 protocol translation mechanism enabling communication between IPv6-only and IPv4-only networks, serving as a temporary tool during IPv6 migration rather than a long-term NAT solution.
This module covered the necessity of NAT due to IPv4 address exhaustion, defining its terminology (inside/outside, local/global addresses from the translated device's perspective), and exploring static, dynamic, and PAT types. It highlighted NAT's advantages (conservation, flexibility) and disadvantages (delays, traceability issues). Key commands like 'show ip nat translations' and 'clear ip nat statistics' were introduced. Lastly, NAT64 was briefly explained as an IPv6-to-IPv4 translation mechanism, not an IPv6 equivalent of IPv4 NAT.