Powered by Blogger.
Home » Posts filed under Network Address translation
Showing posts with label Network Address translation. Show all posts
Showing posts with label Network Address translation. Show all posts

Network Address Translation III

Posted by Unknown Thursday, February 21, 2013 0 comments

In this part we are going to configure Dynamic NAT on our gateway router ( R2). We will following the previously mentioned three steps to achieve this task like: 
  • Labeling the interfaces
  • Configuring the ACL for hosts
  • Implementing the NAT from global config mode


So here we go, and you will see it’s not that difficult to implement it practically:

Dynamic NAT Configurations:

Suppose we want to configure Dynamic NAT on R2. For this purpose, we need a pool of global IP addresses that would be dynamically mapped with our local hosts. So we need to buy these addresses from our ISP J just assume, we bought the following IP pool form our ISP:

171.16.10.52 - 171.16.10.56

We will follow above mentioned three steps to implement dynamic NAT on our current network topology:
Step 1:

Labeling the interfaces:

interface FastEthernet0/0
 ip address 192.168.1.2 255.255.255.0
 ip nat inside

interface Serial1/0
 ip address 171.16.10.1 255.255.255.0
 ip nat outside

Step 2:
An ACL needed to be created for local hosts IPs that we want to translate:

ip access-list standard NAT_IPs
 permit 192.168.3.0 0.0.0.255
 permit 192.168.2.0 0.0.0.255
 permit 192.168.4.0 0.0.0.255

Step 3:
Once ACL is created, we need to configure our IP pool and dynamic NAT from global configuration like:

ip nat pool Global_IP_Pool 171.16.10.52 171.16.10.56 netmask 255.255.255.0
ip nat inside source list NAT_IPs pool Global_IP_Pool

Our pool name is: Global_IP_Pool
ACL name is: NAT_IPs

Some of the other things done on R2 are: static route to ISP and RIP:

!
router rip
 passive-interface Serial1/0 ( this commands is configured to stop RIP advertisements to our emulated ISP)
 network 171.16.0.0
 network 192.168.1.0
!
ip route 171.16.0.0 255.255.0.0 171.16.10.2
!
!

And we are done with our Dynamic NAT! that was quite easy and simple. Now some other fun commands. In order to check the IP NAT translations going on in the network, we just issue show ip nat translations command on R2 and see the result:

From R1 we ping our ISP:

R1#ping 171.16.10.2 source 192.168.3.1
We get successful ping results to 171.16.10.2. The source IP was changed on R2 during the process of pinging as we have configured NAT on R2.

Now let’s see what’s happening on R2:












Our ping request was originated from inside local: 192.168.3.1 and has been translated into 171.16.10.52 inside global address.  One other interesting command for your geek mind:


I hope after going through all of the above commands, you will have confidence in yourself and will see how interesting it is to implement.  Just remember one thing: if dynamic NAT is used, we can’t access our local hosts from outside the network, as the router will not be sure to where it has to route the packets and for this purpose Static NAT is recommended, which we will discuss shortly.

Okay, as an example, please perform some practice of dynamic NAT with following requirements:

  • The routing protocol running is EIGRP with AS # 4
  • The IP Pool Name is CORP-IP pool
  • ACL is allows only 192.168.3.0/24 network to translate
--to be continued--

Network Address Translation II

Posted by Unknown Tuesday, February 19, 2013 1 comment


Static NAT: static NAT is a one to one mapping of internal addresses with the global IP addresses. In network design, static NAT is best if we are going to host some server inside our network and want it to be accessible from global internet.

Some of the terminology of NAT worth remembering:

  • Inside Local: the host address inside the network that we want to translate
  • Outside Local: translated address of the outside hosts, as seen inside their network
  • Inside Global: the addresses used to translate the inside addresses
  • Outside Global: addresses of outside hosts as seen on the outside
A few more terminologies of NAT:

  • Policy based NAT
  • Port redirection (one to one mapping for a single port, also called Static PAT)
  • NVIs or NAT virtual interfaces (a newer method of NAT configuration in which there is no need for inside/outside definition on an interface. NAT table is maintained on per interface basis)

I think we have covered enough of the terminology regarding Network Address translation, now it’s time to practically implement all of the above concepts for getting a strong technical grasp of above concepts.

For practical implementation of NAT on a Cisco router, follow the following three steps:

  • Designate the interfaces for inside/outside NAT
  • Define an ACL for the local host IPs
  • Implemented NAT from the global configuration mode
In VoIP packets, as it’s not possible to modify the source header, for this we had to enable some special services of NAT to support SIP or Skinny protocols etc. there are also some other issues that might arise by changing the IP in a packet as it will change the packet checksum value, encapsulated data and hence breaking the meaning of the application.

For an interesting demonstration of NAT, please check http://www.cisco.com/image/gif/paws/6450/nat.swf URL.

--to be continued-- 

Network Address Translation Part I

Posted by Unknown Sunday, February 17, 2013 0 comments

NAT (Network Address translation):

In simple words NAT is about IP address translation or conversion. This translation could be for two purposes
  • Translation of Private addresses into Public addresses
  • Translation of internal addresses to avoid duplication or for Topology hiding

As you know private IP addresses are not routable on the internet, that’s why we need to configure NAT on our gateways to talk to public internet domain.  The duplication of addresses can take place if we merge two organizations and they both have the same IP plan, in such case NAT is used to avoid such issues via a DNS server. As discussed in VLSM and CIDR, IP address preservation was also one of the main causes behind the induction of NAT.


NAT working:



The above diagram explains NAT in its simple form. NAT is configured on the Gateway and address translation or mapping take place here. The Global Network is unaware of the internal local addresses of our network, that’s why it’s helpful in hiding our network topology.



Types of NAT:

There are three types of NAT, mostly used in network design. 

  • Dynamic NAT
  • Dynamic NAT with overload (also called PAT: Port Address Translation)
  • Static NAT
While implementing NAT on a router, we first define an ACL (normally standard Access Control list) to define the internal IPs that we are going to translate. These addresses are technically called Inside Local addresses.  Then we apply our NAT commands in global configuration mode, specifying the list of addresses in our ACL and the public addresses in which we want to translate it. These public addresses are technically called Inside Global.

Dynamic NAT: In dynamic NAT, as the name suggest the address translation take place by allocating available Public IPs from a pool dynamically. We define a pool of global IP addresses for NAT and then this pool is associated with address local IPs for translation. The address translation works, until all of the addresses in pool are consumed and network established via it.

Dynamic NAT with overload or PAT: overloading is used to enhance the addressing capability of NAT and for this magic, PAT is used. PAT stands for Port address translation, so as the name implies, port numbers are used with local hosts. At the same time, port numbers are also used with the global inside IP. Via this association, a single global IP can be used for around 65000 addresses! This could be better explained via below chart:


Protocol
Inside Local IP : Port
Inside Global IP : Port
TCP
192.168.3.2:1723
170.16.3.2:1456
TCP
192.168.3.1:1744
170.16.3.2:1098
TCP
192.168.3.10:1764
170.16.3.2:4432

As you can see we have a single global IP, but with different port numbers. This table is maintained by router and it forwards the packet accordingly. Suppose if IP 192.168.3.2:1723 has established global connection via 170.16.3.2:1456, once any packet is received on this IP (170.16.3.2) with relevant port number, its forwarded according to the above table to 192.168.3.2:1723. You must be aware of the fact that port numbers are used by a host to establish different connections to the outside world and keep track of each established connection. Suppose a connection to web server port 80 would be like:

Inside Global IP : Port
Outside Global IP address: Port
170.16.3.2:1456
173.194.23.4:80
170.16.3.2:1098
173.194.23.4:80
170.16.3.2:4432
173.194.23.4:80





--To be continued--

Copyright © My CISCO Journal . All rights reserved.