Please enable JavaScript.

Coggle requires JavaScript to display documents.

NAT for IPV4 - Coggle Diagram

- - - - ISP gives one public IPv4 address.
      - ISP gives multiple public IPv4 addresses (pool).
    - - Inside: PC1 (192.168.10.10), PC2 (192.168.11.10).
      - Outside: Svr1 (209.165.201.1), Svr2 (209.165.202.129).
      - Router R2 performs PAT using ports to distinguish traffic.
  - - - ip nat inside source list 1 interface serial0/1/1 overload
    - - access-list 1 permit 192.168.0.0 0.0.255.255
    - - Inside: serial0/1/0 → ip nat inside
      - Outside: serial0/1/1 → ip nat outside
  - - - ip nat pool NAT-POOL2 209.165.200.226 209.165.200.240 netmask 255.255.255.224
      - access-list 1 permit 192.168.0.0 0.0.255.255
      - ip nat inside source list 1 pool NAT-POOL2 overload
  - - - PC1: 192.168.10.10:1444 → 209.165.200.225:1444
      - PC2: 192.168.11.10:1444 → 209.165.200.225:1445
  - - - 209.165.200.225:1444 → PC1 (192.168.10.10:1444).
      - 209.165.200.225:1445 → PC2 (192.168.11.10:1444).
  - - - show ip nat translations → shows active mappings.
      - show ip nat statistics → shows totals, pool info, active sessions.
    - - tcp 209.165.200.225:1444 192.168.10.10:1444 209.165.201.1:80
      - tcp 209.165.200.225:1445 192.168.11.10:1444 209.165.202.129:80
- - - - Static NAT is especially useful for web servers or devices that require a consistent, internet-accessible address, such as a company's web server. It is also useful for devices that authorized personnel must access when they are out of the office, but not the general public on the internet
        
        Static NAT requires that there are enough public addresses available to satisfy the total number of concurrent user sessions.
- - - - The IPv4 private address space is a set of IPv4 address blocks defined by the IETF in RFC 1918 for use within private (internal) networks, not directly routable on the public Internet.
      - These ranges exist to enable organisations to assign IP addresses internally without consuming globally unique (public) IPv4 address space. Because IPv4 (32-bit) address space is finite, such mechanisms help conserve public addresses and allow many devices in a private network to share limited public-address resources.
  - - - Network Address Translation (or NAT) is a technique in IP networking where the source or destination IP address (and possibly port) of packets is changed (“translated”) by a NAT device (typically a router or firewall) as the packet traverses from one network to another—commonly from a private/internal network to a public/external network
        According to Cisco: “NAT enables private IP networks to use the Internet and cloud by translating (internal) private IP addresses to (external) public IP addresses.”
  - - - When a packet moves from a private (inside) network to a public (outside) network, the NAT device (router/firewall) rewrites the source IP address (and maybe port) of the packet to a public (global) address. When the return packet arrives, the NAT device uses a translation table to map the destination (which is the NAT device’s public address) back to the original internal (private) host and forwards accordingly.
        For example: A host 192.168.1.10 sends a packet destined for a public server. The NAT device rewrites the source to, say, 203.0.113.5 (its public interface), and tracks that mapping. When the server replies to 203.0.113.5, the NAT device looks up the mapping and sends it to 192.168.1.10.
  - - - The IP address of an internal host as it appears to the outside world (i.e., after translation). Typically this is a public IP address that the outside networks see
    - - The IP address of an external host as it appears to the inside network (i.e., from the inside perspective). This may or may not be translated.
    - - The actual public IP address of the external host as it exists on the outside network. In many simple NAT scenarios, Outside Local and Outside Global are the same.
    - - The IP address assigned to an internal host (inside network). This is often a private address (e.g., 192.168.x.x) though not always strictly so
- - - - Packet Flow Analysis
      - Based on your diagrams, the process occurs as follows:
      - Step 1: The external client (209.165.200.254) sends a packet to destination 209.165.201.5.
      - Step 2: The packet reaches R2 on its outside interface (S0/1/1).
      - Step 3: R2 consults its static NAT table and recognizes that 209.165.201.5 corresponds to internal host 192.168.10.254.
      - Step 4: R2 rewrites the destination address (DA) from 209.165.201.5 to 192.168.10.254 and forwards it inside.
      - Step 5a/5b: When the internal web server replies, R2 translates the source address (SA) from 192.168.10.254 to 209.165.201.5 before sending it out to the Internet.