Please enable JavaScript.

Coggle requires JavaScript to display documents.

Module 6: NAT for IPv4 - Coggle Diagram

- - - - The pool of public IPv4 addressesis available to any device on the inside network on a first-come first-served basis.
        
        With dynamic NAT, a single inside address is translated to a single outside address. With this type of translation there must be enough addresses in the pool to accommodate all the inside devices needing concurrent access to the outside network. If all addresses in the pool are in use, a device must wait for an available address before it can access the outside network.
        
        6.5.2 Configure Dynamic NAT
        
        1.- Define the pool of addresses that will be used for translation using the ip nat pool command.
        
        The netmask or prefix-length indicates which address bits belong to the network and which bits belong to the host
        
        Example: ip nat pool NAT-POOL1 209.165.200.226 209.165.200.240 netmask 255.255.255.224
        
        2.- Configure a standard ACL to identify (permit) only those addresses that are to be translated. In ACL deny is default
        
        Example: R2(config)# access-list 1 permit 192.168.0.0 0.0.255.255
        
        3.- Vincule la ACL al pool
        
        Example: R2(config)# ip nat inside source list 1 pool NAT-POOL1
        
        Router(config)# ip nat inside source list {access-list-number | access-list-name} pool pool-name
        
        4.- Identify which interfaces are inside, in relation to NAT; this will be any interface that connects to the inside network.
        
        Example: R2(config)# interface serial 0/1/0
        R2(config-if)# ip nat inside
        
        5.- Identify which interfaces are outside, in relation to NAT; this will be any interface that connects to the outside network.
        
        Example: R2(config)# interface serial 0/1/1
        R2(config-if)# ip nat outsid
        
        Dynamic NAT - Inside to Outside
        
        Private IP addresses from the internal network are translated to public (or valid) IP addresses from a predefined set when local devices initiate traffic to the outside. This is the most common form of dynamic NAT.
        Typical use: Allows internal devices to access external resources (such as websites) using temporary public IP addresses.
        
        Dynamic NAT - Outside to Inside
        
        6.5.5 Verify Dynamic NAT
        
        show ip nat translations
        
        show ip nat translation verbose
        
        Verbose add additional information about each translation, including how long ago the entry was created and used.
        
        show ip nat statistics
        
        Displays information about the total number of active translations, NAT configuration parameters, the number of addresses in the pool, and how many of the addresses have been allocated.
        
        show running-config
        
        The output of the show ip nat translations command displays all static translations that have been configured and any dynamic translations that have been created by traffic.
        
        clear ip nat translation
        
        o clear dynamic entries before the timeout has expired
- - - - IPv6 was developed with the intention of making NAT for IPv4 with translation between public and private IPv4 addresses unnecessary. However, IPv6 does include its own IPv6 private address space, unique local addresses (ULAs).
        
        IPv6 unique local addresses (ULA) are similar to RFC 1918 private addresses in IPv4 but have a different purpose. ULA addresses are meant for only local communications within a site. ULA addresses are not meant to provide additional IPv6 address space, nor to provide a level of security.
        
        IPv6 does provide for protocol translation between IPv4 and IPv6 known as NAT64.
  - - - To aid in the move from IPv4 to IPv6, the IETF has developed several transition techniques to accommodate a variety of IPv4-to-IPv6 scenarios, including dual-stack, tunneling, and translation.
        
        Dual-stack is when the devices are running protocols associated with both IPv4 and IPv6. Tunneling for IPV6 is the process of encapsulating an IPv6 packet inside an IPv4 packet
        
        NAT for IPv6 should not be used as a long-term strategy, but as a temporary mechanism to assist in the migration from IPv4 to IPv6.
- - - - To allow a device with a private IPv4 address to access devices and resources outside of the local network, the private address must first be translated to a public address.
        
        NAT provides the translation of private addresses to public addresses
        
        NAT, combined with private IPv4 addresses, has been the primary method of preserving public IPv4 addresses
        
        The solution to the exhaustion of IPv4 address space and the limitations of NAT is the eventual transition to IPv6.
  - - - NAT-enabled routers can be configured with one or more valid public IPv4 addresses. These public addresses are known as the NAT pool
  - - - Inside local address
        
        Inside global address
        
        Outside local address
        
        Outside global address
      - it is important to remember that NAT terminology is always applied from the perspective of the device with the translated address:
        
        Inside address - The address of the device which is being translated by NAT.
        Outside address - The address of the destination device.
      - NAT also uses the concept of local or global with respect to addresses:
        
        Local address - A local address is any address that appears on the inside portion of the network.
        Global address - A global address is any address that appears on the outside portion of the network.
- - - - Step 1. The first task is to create a mapping between the inside local address and the inside global addresses. For example, the 192.168.10.254 inside local address and the 209.165.201.5 inside global address in the figure are configured as a static NAT translation.
        
        R2(config)# ip nat inside source static 192.168.10.254 209.165.201.5
      - Step 2. After the mapping is configured, the interfaces participating in the translation are configured as inside or outside relative to NAT. In the example, the R2 Serial 0/1/0 interface is an inside interface and Serial 0/1/1 is an outside interface.
        
        R2(config)# interface serial 0/1/0
        
        R2(config-if)# ip address 192.168.1.2 255.255.255.252
        
        R2(config-if)# ip nat inside
        
        R2(config-if)# exit
        
        R2(config)# interface serial 0/1/1
        
        R2(config-if)# ip address 209.165.200.1 255.255.255.252
        
        R2(config-if)# ip nat outside
  - - - The client wants to open a connection to the web server. The client sends a packet to the web server using the public IPv4 destination address of 209.165.201.5. This is the inside global address of the web server.
        
        The first packet that R2 receives from the client on its NAT outside interface causes R2 to check its NAT table. The destination IPv4 address of 209.165.201.5 is located in the NAT table and is translated to 192.168.10.254.
        
        R2 replaces the inside global address of 209.165.201.5 with the inside local address of 192.168.10.254. R2 then forwards the packet towards the web server.
        
        The web server receives the packet and responds to the client using the inside local address, 192.168.10.254 as the source address of the response packet.
        
        (a) R2 receives the packet from the web server on its NAT inside interface with source address of the inside local address of the web server, 192.168.10.254.
        
        (b) R2 checks the NAT table for a translation for the inside local address. The address is found in the NAT table. R2 translates the source address 192.168.10.254 to the inside global address of 209.165.201.5 and forwards the packet toward the client.
        
        (Not shown) The client receives the packet and continues the conversation. The NAT router performs Steps 2 to 5b for each packet.
  - - - R2# show ip nat translations
        
        Pro Inside global Inside local Outside local Outside global
        
        --- 209.165.201.5 192.168.10.254 --- ---
        
        Total number of translations: 1
    - - R2# show ip nat translations
        
        Pro Inside global Inside local Outside local Outside global
        
        tcp 209.165.201.5 192.168.10.254 209.165.200.254 209.165.200.254
        
        --- 209.165.201.5 192.168.10.254 --- ---
        
        Total number of translations: 2
    - - R2# show ip nat statistics
        
        Total active translations: 1 (1 static, 0 dynamic; 0 extended)
        
        Outside interfaces:
        
        Serial0/1/1
        
        Inside interfaces:
        
        Serial0/1/0
        
        Hits: 0 Misses: 0
        
        (output omitted)
- - - - Configure PAT to Use a Single IPv4 Address
        
        To configure PAT to use a single IPv4 address, simply add the keyword overload to the ip nat inside source command.
      - Configure PAT to Use an Address Pool
        
        NAT-POOL2 is bound to an ACL to permit 192.168.0.0/16 to be translated. These hosts can share an IPv4 address from the pool because PAT is enabled with the keyword overload.
      - Analyze PAT - PC to Server
        
        The packet from PC1 reaches R2 first. Using PAT, R2 modifies the source IPv4 address to 209.165.200.225 (inside global address). There are no other devices in the NAT table using port 1444, so PAT maintains the same port number. The packet is then forwarded towards Svr1 at 209.165.201.1.
        
        Verify PAT
        
        show ip nat translations
        
        show ip nat statistics
        
        Next, the packet from PC2 arrives at R2. PAT is configured to use a single inside global IPv4 address for all translations, 209.165.200.225. Similar to the translation process for PC1, PAT changes the source IPv4 address of PC2 to the inside global address 209.165.200.225. However, PC2 has the same source port number as a current PAT entry, the translation for PC1. PAT increments the source port number until it is a unique value in its table. In this instance, the source port entry in the NAT table and the packet for PC2 receives 1445.
        
        Both PC1 and PC2 are sending packets to Svr1 and Svr2, respectively. PC1 has the source IPv4 address 192.168.10.10 and is using TCP source port 1444. PC2 has the source IPv4 address 192.168.10.11 and coincidentally uses the same TCP source port of 1444.
      - Analyze PAT - Server to PC
        
        The servers use the source port from the received packet as the destination port, and the source address as the destination address for the return traffic. The servers seem as if they are communicating with the same host at 209.165.200.225; however, this is not the case.
        
        As the packets arrive, R2 locates the unique entry in its NAT table using the destination address and the destination port of each packet. In the case of the packet from Svr1, the destination IPv4 address of 209.165.200.225 has multiple entries but only one with the destination port 1444. Using the entry in its table, R2 changes the destination IPv4 address of the packet to 192.168.10.10, with no change required for the destination port. The packet is then forwarded toward PC1.
        
        When the packet from Svr2 arrives R2 performs a similar translation. The destination IPv4 address of 209.165.200.225 is located, again with multiple entries. However, using the destination port of 1445, R2 is able to uniquely identify the translation entry. The destination IPv4 address is changed to 192.168.10.11. In this case, the destination port must also be modified back to its original value of 1444, which is stored in the NAT table. The packet is then forwarded toward PC2.