Chapter 9: NAT for IPv4

Chapter 9: NAT for IPv4

1. All public IPv4 addresses used on the Internet must be registered in a regional Internet registry (RIR)

2. NAT conceptual

   • It is a process that companies use to provide security to users

3. Private IPv4 address space

   • There are not enough public IPv4 addresses to assign a unique address to every device connected to the Internet. Networks are often implemented through the use of private IPv4 addresses, as defined in RFC 1918

4. What is NAT?

   • the main one is to preserve public IPv4 addresses. This is achieved by allowing networks to use private IPv4 addresses internally and by providing translation to a public address only when necessary
     • NAT terminology
       • • Internal address: the address of the device that is translated by means of NAT. • External address: the address of the destination device. • Local address: any address that appears in the internal portion of the network. • Global address: any address that appears in the external portion of the network.

5. Static address translation (static NAT): assignment of one-to-one addresses between a local address and a global one.Static NAT consists of a one-to-one mapping between local and global addresses. These assignments are configured by the network administrator and remain constant.

6. Dynamic address translation (dynamic NAT): assignment of several addresses to several addresses between local and global addresses

7. Translation of the port address (PAT): assignment of several addresses to an address between local and global addresses PAT uses the ports as an additional parameter to provide a multiplier effect,

8. Next available port

   • PAT tries to preserve the original port of origin. However, if the initial source port is already in use, PAT assigns the first available port number from the beginning of the corresponding port group from 0 to 511, 512 to 1023 or 1024 to 65 535.

9. Comparison between NAT and PAT

   • NAT translates IPv4 addresses in a 1: 1 relationship between private IPv4 addresses and public IPv4 addresses. However, PAT modifies the address and port number.

10. Advantages of NAT NAT retains the legally registered addressing scheme by allowing the privatization of intranets With overloaded NAT, internal hosts can share a single public IPv4 address for all external communications. NAT increases the flexibility of connections to the public network NAT provides consistency to internal network addressing schemes NAT hides the IPv4 addresses of users.

11. Disadvantages of NAT Another disadvantage of using NAT is that end-to-end addressing is lost End-to-end IPv4 tracking is reduced. The use of NAT also generates complications in the use of tunneling protocols The start of TCP connections may be interrupted

12. Configure static NAT

    • Step 1: The first step is to create an assignment between the internal local address and the internal global addresses
      • Step 2: Once the assignment is configured, the interfaces involved in the translation are configured as internal or external with respect to NAT.
    • Verification of static NAT A command that is useful to verify the operation of NAT is show ip nat translations. This command shows the active NAT translations
      • Dynamic NAT operation Dynamic NAT allows the automatic assignment of internal local addresses to internal global addresses

13. Dynamic NAT configuration

    • Step 1: Define the set of addresses that will be used for the translation with the ip nat pool command. Step 2: Configure a standard ACL to identify (allow) only those addresses that must be translated. An overly permissive ACL can generate unpredictable results. Step 3: Connect the ACL to the assembly. The ip nat inside source list access-list-number pool pool name command is used to link the ACL to the set. Step 4: Identify which interfaces are internal with respect to NAT; that is, any interface that connects to the internal network. Step 5: Identify what interfaces are external with respect to NAT; that is, any interface that connects to the external network.
    • Dynamic NAT verification The result of the show ip nat translation command

14. PAT configuration: set of addresses retains the addresses of the set of internal global addresses by allowing the router to use an internal global address for many internal local addresses. In other words, you can use a single public IPv4 address for hundreds, even thousands of internal private IPv4 addresses

    • PAT configuration: single address Step 1: Define an ACL to allow traffic to be translated. Step 2: Configure the source translation with the keywords interface and overload. The keyword interface identifies the IPv4 address of the interface that should be used when translating internal addresses. Step 3: Identify what the internal interfaces are with respect to NAT. Step 4: Identify what is the external interface with respect to NAT.

15. Forwarding of ports Forwarding to assigned port consists of forwarding traffic routed to a specific network port from one network node to another. This technique allows an external user to reach a port on a private IPv4 address (within a LAN) from the outside through a router with NAT enabled.

16. El comando debug ip nat Para verificar el funcionamiento de la característica de NAT, utilice el comando debug ip nat, El comando debug ip nat detailed genera una descripción de cada paquete que se tiene en cuenta para traducir.

17. NAT for IPv6? With a 128-bit address, IPv6 provides 340 sextillions of addresses. Therefore, the address space is not a problem. IPv6 was developed with the intention that NAT for IPv4 with its translation between public and private IPv4 addresses is unnecessary.

    • Unique local IPv6 addresses The unique local IPv6 addresses (ULA) resemble the private addresses in IPv4 defined in RFC 1918, but there are also considerable differences.
      • NAT for IPv6 NAT for IPv6 is used in a context very different from NAT for IPv4. Varieties of NAT for IPv6 are used to provide transparent access between IPv6 only networks and IPv4 only networks. It is not used as a form of translation from private IPv6 to global IPv6.