Posted by

CCNA Class 17 : About NAT & PAT

Introduction of NAT

Network Address Translation (NAT) is a method used by network devices, such as routers, to translate bunches of private IP addresses of devices to a single Public IP address in order to communicate with the internet.

There are Different types of NAT - Static NAT & Dynamic NAT

Fig: The Network Address Translation (NAT)

Work Functionality of NAT

Inside refers to the addresses which must be translated. Outside refers to the addresses which are not in control of an organization. These are the network Addresses in which the translation of the addresses will be done

  • Inside local address—The IP address assigned to a host on the inside network. This is the address configured as a parameter of the computer OS or received via dynamic address allocation protocols such as DHCP. The address is likely not a legitimate IP address assigned by the Network Information Center (NIC) or service provider.
  • Inside global address—A legitimate IP address assigned by the NIC or service provider that represents one or more inside local IP addresses to the outside world.
  • Outside local address—The IP address of an outside host as it appears to the inside network. Not necessarily a legitimate address, it is allocated from an address space routable on the inside.
  • Outside global address—The IP address assigned to a host on the outside network by the host owner. The address is allocated from a globally routable address or network space.
Whenever a device on a private network needs to communicate with the internet, it sends a request to the NAT router to map its private IP address with a public IP address to access the internet. As soon as the response from the internet is received, the NAT router maps the public IP address to the private IP address. Once this is done, a response to the private network device is sent. Thus, the Reverse process of traversing the data done by this way. This whole process might be Static NAT or Dynamic NAT. 


Advantages of NAT
  • NAT conserves legally registered IP addresses.
  • It provides privacy as the device’s IP address, sending and receiving the traffic, will be hidden.
  • Eliminates address renumbering when a network evolves.
Disadvantage of NAT
  • Translation results in switching path delays.
  • Certain applications will not function while NAT is enabled.
  • Complicates tunneling protocols such as IPsec. 
  • Also, the router being a network layer device, should not tamper with port numbers(transport layer) but it has to do so because of NAT. 

Introduction of PAT

Port Address Translation (PAT), often referred to as NAT Overload, is a type of Network Address Translation (NAT) that allows multiple devices on a local network to share a single public IP address. It works by mapping multiple private IP addresses and their ports to a single public IP address and its ports. This is widely used in home and small office networks to enable internet access for all connected devices using a single ISP-provided public IP

How PAT Works

  • Device Sends a Packet:
    • A device in the private network sends data to a destination on the internet.
    • The packet contains the private IP address of the device and the source port of the application.
  • Router Modifies the Packet:
    • The router replaces the device's private IP address with the public IP address assigned to the routers.
    • The router also assigns a unique source port number from its available pool. This combination of the public IP and a unique port number allows the router to distinguish between multiple internal devices.
  • Mapping is Stored in a Table:
    • The router keeps a translation table (a mapping of private IP and port to public IP and port) to ensure that return traffic is correctly routed back to the originating device.
  • Packet Sent to the Internet:
    • The modified packet is sent to the destination on the internet.
  • Return Traffic:
    • When the server responds, the router checks its translation table to determine the private IP and port corresponding to the public IP and port used in the response.
    • The router modifies the destination IP and port of the packet back to the original private IP and port before delivering it to the device.

Advantages of PAT

  • Efficient IP Address Usage: Multiple devices can share a single public IP.
  • Enhanced Security: Private IP addresses are hidden from the outside world, reducing the attack surface.
  • Cost-Effective: Organizations and individuals do not need multiple public IP addresses for each device.

NAT Configuration

Static NAT Configuration:

https://drive.google.com/file/d/1G7rwTMp6jn3F4PUP8nuKVDvM7ZCKlRhn/view?usp=sharing 


Dynamic NAT Configuration:

https://drive.google.com/file/d/14y0mB8U16gtCcbsYgoMy6mssds4RxOhf/view?usp=sharing 



How to Configure Static NAT



Step-01: Basic Router and PC Configuration

CorporateRouter(config)#interface gigabitEthernet 0/0
CorporateRouter(config-if)#no shutdown 
CorporateRouter(config-if)#ip address 172.31.0.1 255.255.255.0
CorporateRouter(config-if)#int se0/0/0
CorporateRouter(config-if)#no shutdown 
CorporateRouter(config-if)#ip address 20.21.22.1 255.255.255.0
------------
CloudRouter(config)#interface serial 0/0/0
CloudRouter(config-if)#no shutdown 
CloudRouter(config-if)#ip address 20.21.22.2 255.255.255.0
CloudRouter(config)#interface gigabitEthernet 0/0
CloudRouter(config-if)#no shutdown 
CloudRouter(config-if)#ip address 10.150.0.1 255.255.255.0

Step-02: Configure the Static NAT

CorporateRouter(config)#ip nat inside source static 172.31.0.10 50.0.0.10
CorporateRouter(config)#ip nat inside source static 172.31.0.20 50.0.0.11

//Optional for Both side natting. 
CloudRouter(config)#ip nat inside source static 10.150.0.10 60.0.0.10
CloudRouter(config)#ip nat inside source static 10.150.0.20 60.0.0.11

Step-03: Configure the Static Routing

CloudRouter(config)#ip route 172.31.0.0 255.255.255.0 20.21.22.1
CloudRouter(config)#ip route 50.0.0.0 255.255.255.0 20.21.22.1

//Optional for Both Side Communication
CorporateRouter(config)#ip route 10.150.0.0 255.255.255.0 20.21.22.2
CorporateRouter(config)#ip route 60.0.0.0 255.255.255.0 20.21.22.2


Special Note: If only Pinging source to destination but not browsing the Website from the Webservers, following command might be assigned to every Local or Remote Routers.

Router(config)#ip nat outside source static <Outside Global IP> <Outside Local IP>

Example: 
CloudRouter(config)#ip nat outside source static 50.0.0.10 172.31.0.10
CorporateRouter(config)#ip nat outside source static 60.0.0.10 10.150.0.10 

Step-04: Verify the NAT

CloudRouter#show ip nat translations
CloudRouter#debug ip nat


How to Configure Dynamic NAT


PKT File

Step-01: Configure the IP Access List and Dynamic NAT as Inside (Local & Remote Router)

Inside_R(config)#access-list 1 permit 10.0.0.10 0.0.0.0
Inside_R(config)#access-list 1 permit 10.0.0.20 0.0.0.0
Inside_R(config)#access-list 1 deny any
Inside_R(config)#ip nat pool ccna 100.0.0.10 100.0.0.11 netmask 255.255.255.0
Inside_R(config)#ip nat inside source list 1 pool ccna overload
Inside_R(config)#interface gigabitEthernet 0/0
Inside_R(config-if)#ip nat inside
Inside_R(config-if)#int se0/0/0
Inside_R(config-if)#ip nat outside
Outside_R(config-if)#ip nat inside
Outside_R(config)#int se0/0/0
Outside_R(config-if)#ip nat outside
Outside_R(config)#ip nat inside source static 8.8.8.8 200.0.0.10
Outside_R(config)#int gi0/0


Step-02: Static Routing Configuration

Outside_R(config)#ip route 100.0.0.0 255.255.255.0 172.31.0.1
Inside_R(config)#ip route 200.0.0.0 255.255.255.0 172.31.0.2
Inside_R(config)#ip route 8.8.8.0 255.255.255.0 172.31.0.2


Step-03: Dynamic NAT Configuration as Outside for Both Routers

Inside_R(config)#ip nat outside source static 200.0.0.10 8.8.8.8
Outside_R(config)#ip nat pool ccna 100.0.0.10 100.0.0.11 netmask 255.255.255.0
Outside_R(config)#ip access-list standard 1
Outside_R(config-std-nacl)#permit 10.0.0.10 0.0.0.0
Outside_R(config-std-nacl)#permit 10.0.0.20 0.0.0.0
Outside_R(config-std-nacl)#deny any
Outside_R(config)#ip nat outside source list 1 pool ccna


Method of PAT Configuration


To configure PAT, the following processes are required:

  • configure the router’s inside interface using the ip nat inside command.
  • configure the router’s outside interface using the ip nat outside command.
  • configure an access list that includes a list of the inside source addresses that should be translated.
  • enable PAT with the ip nat inside source list ACL_NUMBER interface TYPE overload global configuration command

Commands are: 

R1(config)#int Gi0/0 
R1(config-if)#ip nat inside 
R1(config-if)#int Gi0/1 
R1(config-if)#ip nat outside 

R1(config-if)#access-list 1 permit 10.0.0.0 0.0.0.255 
R1(config)#ip nat inside source list 1 interface Gi0/1 overload 

R1#show ip nat translations




Google Translate Integration
Email Post

Comments

Post a Comment

Thanks