CCNA 3 - Capitulo 6.2

CCNA 3 - Capitulo 6.2

1. NAT (NETWORK ADDRESS TRANSLATION )

   • TYPES OF NAT
     • STATIC NAT
       • REMAIN CONSTANT
       • WHERE CAN IT BE USED?
         • INBOUND (VIRTUAL IP )
           • WHEN SOMEONE ON THE INTERNET ACCESSES AN INTERNAL SERVER:
           • MUST BE ACESSIBLE BY AUTHORIZED PERSONNEL WHEN OFFISTE (VPN) BUT NOT BY GENERAL PUBLIC ON THE INTERNET
         • OUTBOUND - IP POOL ONE-TO-ONE FORTINET
           • IF THE INTERNAL HOST CONNECTS TO THE INTERNET
           • HAS DEVICE ACESSED THE INTERNET NEED ONE ADDRESS PUBLIC
       • HOW DOES IT WORK?
         • ONE TO ONE MAPPING OF LOCAL AND GLOBAL ADDRESSES
         • EX : 209.165.200.226 > 192.168.10.10
       • REQUEST MANY PUBLIC ADDRESSES
     • DYNAMIC NAT
       • POOL OF PUBLIC ADDRESSES
       • BY TRANSLATION EXPIRED
         • AFTER 24 HOURS
       • HOW DOES IT WORK?
         • USES A POOL OF PUBLIC ADDRESSES AND ASSIGNS THEM ON A FIRST COME
           • EACH DEVICE THAT ACCESSES THE INTERNET WILL CONSUME A PUBLIC ADDRESS FROM THE POOL.
       • REQUEST MANY PUBLIC ADDRESSES
       • ONLY OUTBOUND
         • THE EQUIVALENT IN FORTIGATE IS NAT ONE-TO-ONE WITH THE RANGE CONFIGURED.
   • TYPES OF NAT
     • PORT ADDRESS TRANSLATION (NAT OVERLOAD )
       • PORT ADDRESS TRANSLATION
       • OUTBOUND
         • NAT OVERLOAD
         • OUTGOING INTERFACE ADDRESS
       • HOW DOES IT WORK?
         • MAPS MULTIPLE PRIVATE IPV4 TO SINGLE PUBLIC IPV4 OR A FEW ADDRESSES
         • EACH PRIVATE ADDRESS IS ALSO TRACKED BY A PORT NUMBER
         • 1. WHEN A DEVICE INITIATES A TCP SESSION , IT GENERATES A TCP OD UDP SOURCE PORT VALUE , OR SPECIALLY QUERY IF FOR ICMP
           • THIS UNIQUELY IDENTIFY THE SESSION
         • 2. WHEN A NAT ROUTER RECEIVES A PACKET FROM THE CLIENT , IT USES SOURCE PORT NUMBER TO IDENTIFY THE SPECIFIC NAT TRANSLATION
         • PAT ENSURES THAT DEVICES USE A DIFFERENT TCP PORT NUMBER
           • EACH SESSION WITH A SERVER ON THE INTERNET
         • WHEN A RESPONSE COMES BACK FROM THE SERVER , THE SOURCE PORT NUMBER
           • WHICH BECOMES THE DESTINATION PORT NUMBER ON THE RETURN TRIP
             • DETERMINES TO WHICH DEVICE THE ROUTER FORWARDS THE PACKETS
         • VALIDATES THAT THE INCOMIMG PACKET WERE REQUETED
           • ADDING A DEGREEE OF SECURITY TO THE SESSION
       • THIS IS MOST COMMON FROM OF NAT FOR HOME AND ENTERPRISE
         • ISP ASSIGND ONE ADDRESS TO THE ROUTER , AND MEMBERS CAN SIMULTANEOUSLY ACCESS THE INTERNET
       • NEXT AVAIALBLE PORT
         • PAT ATTEMPTS TO PERSERVE THE ORIGINAL SOURCE PORT
         • HOWEVER , IF THE ORIGINAL PORT IS ALREADY USED
           • PAT ASSIGNS THE FIRST AVAILABLE PORT NUMBER
         • WHEN THERE ARE NO MORE PORT AVAILABLE AND THERE IS MORE THAN ONE EXTERNAL ADDRESS IN POOL ?
           • PAT MOVES TO THE NEXT POOL
       • UTILIZES SESSION TABLES
     • NAT64
       • USE NAT TOGETHER WITH IPV6.
   • NAT X PAT COMPARATION
     • NETWORK TRANSLATION ADDRESS (NAT)
       • ONE TO ONE MAPPING BETWEEN
         • INSIDE LOCAL ADDRESS
         • INSIDE GLOBAL ADDRESS
           • UNIQUE IS REQUIRED FOR EACH INSIDE HOSTS
       • USES ONLY IPs IN TRANSLATION PROCESS
       • FORWARD INCOMING RETURN TRANSLATING INSIDE GLOBAL TO CORRESPONDING INSIDE LOCAL
     • PORT ADDRESS TRANSLATION
       • MANY INSIDE LOCAL ADDRESSES
         • ONE INSIDE GLOBAL
       • USES TCP AND UDP IN TRANSLATION PROCESS
       • MODIFY IP AND PORT NUMBER
   • PACKETS WITHOUT A LAYER 4 SEGMENT
     • WHAT DOES PATH DO WITH SEGMENTS THAT DON'T CARRY TCP OR UDP, SUCH AS ICMP?
       • ECHO REQUEST AND ECHO REPLY CONTAINS A QUERY ID
         • WHATS IS QUERY ID ?
           • TO IDENTIFY AN ECHO REQUEST WITH ITS CORRESPONDING ECHO REPLY