CHAPTER 14 Understanding Firewall Fundamentals - Parte 2 (NAT)

CHAPTER 14 Understanding Firewall Fundamentals - Parte 2 (NAT)

1. Using Network Address Translation

   • Network Address Translation (NAT) is an important feature that is often implemented on firewalls
   • NAT Is About Hiding or Changing the Truth About Source Addresses
     • Lying is what NAT does for a living
     • The primary device that does NAT is either a router or a firewall
     • NAT not only allows us to have thousands of users hide behind a single IP address (using Port Address Translation [PAT], discussed momentarily)
     • but it also offers protection of those users because the outside world does not know exactly which devices have been dynamically assigned to which IP addresses
     • It is important to understand that NAT or PAT should not be considered as a security mechanism alone. The traffic is either allowed or denied by using ACLs.
   • Inside, Outside, Local, Global
     • Inside local (pre- NAT)
       • The real IP configured on an inside host, such as User 1.
     • Inside global (Pos NAT)
       • The mapped/global address that the router is swapping out for the inside host during NAT.
     • Outside local
       • this is the mapped address of the outside device
     • Outside global
       • The real IP configured on an outside host
     • The inside and outside have to do with where an IP exists before we touch it.
     • The local and global then have to do with the appearance of the address and may therefore be pre- or post-NAT manipulation
   • Port Address Translation (PAT)
     • is a subset of NAT
     • PAT device keeps track of individual sessions based on port numbers and other unique identifiers, and then forwards all packets using a single source IP address, which is shared
     • This is often referred to as NAT with overload
     • we are hiding multiple IP addresses on a single global address
   • NAT Options
     • Static NAT
       • This is a one-to-one permanent mapping
       • A typical use of a static mapping is this: We have a server on the inside of our network, or perhaps on a demilitarized zone (DMZ) interface off of our firewall, and we want to allow devices on the Internet access to that specific device.
     • Dynamic NAT
       • Dynamic NAT involves having a pool of global addresses and only mapping those global addresses to inside devices when those inside devices have and need to go out to the Internet
     • Dynamic PAT (NAT with overload)
       • This is the feature that is used for most users who access the Internet
     • Policy NAT/PAT
       • Traffic outside the policy is simply forwarded based on normal routing forwarding without translation .
       • Policy-based NAT is based on a set of rules, such as what is the source IP address, what is the destination IP address, and which ports are used that would qualify that packet to have NAT/PAT applied to it.
   • show ip nat translations