1. M. Dahshan - TCOM52721 TCOM 5272 Telecomm Lab Dr. Mostafa Dahshan OU-Tulsa 4W 2 nd floor 660-3713 mdahshan@ou.edu

2. M. Dahshan - TCOM52722 Acknowledgements  The material of this presentation are based on: Cisco whitepaper “Cisco IOS Network Address Translation Overview”

3. M. Dahshan - TCOM52723

4. 4 Network Address Translation  Router connects two networks Inside: uses private addresses Outside: uses globally legal addresses

5. M. Dahshan - TCOM52725 Inside Addressing  Inside Local Configured IP address assigned to a host on the inside network Address may be globally unique, allocated out of the private address space defined in RFC 1918, or might be officially allocated to another organization  Inside Global The IP address of an inside host as it appears to the outside network, “Translated IP Address” Addresses can be allocated from a globally unique address space, typically provided by the ISP (if the enterprise is connected to the global Internet)

6. M. Dahshan - TCOM52726 Inside Addressing

7. M. Dahshan - TCOM52727 Outside Addressing  Outside Local IP address of an outside host as it appears to the inside network These addresses can be allocated from the RFC 1918 space if desired  Outside Global The configured IP address assigned to a host in the outside network  Simple Translation Entry A translation entry which maps one IP address to another  Extended Translation Entry A translation entry which maps one IP address and port pair to another

8. M. Dahshan - TCOM52728 Outside Addressing

9. M. Dahshan - TCOM52729 Translation Types  Static Address Translation One-to-one mapping between local and global addresses Can also configure Static address translations to the port level, and use the remainder of the IP address for other translations.  Dynamic Address Translation Dynamic mapping between the local and global addresses This is done by describing the local addresses to be translated and the pool of addresses from which to allocate global addresses, and associating the two  Match Host Assign the same Host portion of an IP Address and only translate the Network prefix portion of the IP Address Useful where you are using the host portion as a means to identify or number users uniquely

10. M. Dahshan - TCOM527210 Port Address Translation  Several internal addresses can be NATed to only one or a few external addresses  Also referred to as "overload"  PAT uses unique source port numbers on the Inside Global IP address to distinguish between translations  Because the port number is encoded in 16 bits, the total number could theoretically be as high as 65,536 per IP address

11. M. Dahshan - TCOM527211 PAT Operation  PAT will attempt to preserve the original source port  If source port is already allocated PAT will attempt to find the first available port number starting from the beginning of the appropriate port group: 0-5111 512-1023 1024-65535.  If there is still no port available from the appropriate group and more than one IP address is configured, PAT will move to the next IP address and try to allocate the original source port again  This continues until it runs out of available ports and IP addresses

12. M. Dahshan - TCOM527212 Basic Concept of PAT

13. M. Dahshan - TCOM527213 Unique Source Port per Trans Entry

14. M. Dahshan - TCOM527214

15. M. Dahshan - TCOM527215 Global Configuration  Defining a pool ip nat pool { netmask | prefix-length } [ type { rotary } ]  Enabling translation of inside source addresses ip nat inside source list pool [overload] (Dynamic 1-M Translation) ip nat inside source static (Static 1-1 Translation)

16. M. Dahshan - TCOM527216 Global Configuration  Define access list to match the inside addresses access-list permit

17. M. Dahshan - TCOM527217 Interface Configuration  ip nat { inside | outside }  Interfaces need to be marked whether they are on the inside or the outside  Only packets arriving on a marked interface will be subject to translation

18. M. Dahshan - TCOM527218 Example: TCOM Router OneNet 192.168.0.2/24 192.168.0.1/24 192.35.98.1/2410.5.5.1/24 156.110.24.0/24 gatewaytcom

19. M. Dahshan - TCOM527219 Example: TCOM Router  Global Configuration ip nat pool labnet 192.35.98.90 192.35.98.90 netmask 255.255.255.0 ip nat inside source list 9 pool labnet overload  Access List access-list 9 permit 10.5.5.0 0.0.0.255

20. M. Dahshan - TCOM527220 Example: TCOM Router  Interface Configurations ! interface FastEthernet0/0 ip address 192.35.98.1 255.255.255.0 ip nat inside ! interface FastEthernet0/1 ip address 10.5.5.1 255.255.255.0 ip nat inside ! interface FastEthernet1/0 ip address 192.168.0.2 255.255.255.0 ip nat outside

21. M. Dahshan - TCOM527221 Example: TCOM NAT ProInside globalInside localOutside localOutside global tcp192.35.98.90:173710.5.5.116:1737129.15.34.24:2967 tcp192.35.98.90:102710.5.5.113:1037207.46.107.25:1863 tcp192.35.98.90:428010.5.5.109:428064.233.187.165:80 tcp192.35.98.90:428110.5.5.109:428164.233.187.165:80 tcp192.35.98.90:366910.5.5.128:366989.101.10.196:1104289.101.10.196:11042 tcp192.35.98.90:297710.5.5.113:2977216.52.17.134:80