1. Page 1 NAT & VPN Lecture 8 Hassan Shuja 05/02/2006

2. Page 2 NAT Network Address Translation (NAT) –Allows a host that does not have a valid registered IP address to communicate with other hosts through the Internet – Host might be using a private address or address assigned to another organization –The source IP address is changed within the packet from the private to the public address. –Cisco terminology uses “Inside” and “Outside” to describe where the IP addresses reside – “local” and “global” are also used to describe the location of the IP addresses –A table is kept with the translation Static NAT –A one to one mapping is setup where the inside address is always mapped to the same outside address – This mapping does not change – A second private address will require a second public address

3. Page 3 NAT Dynamic NAT –A one to one mapping is setup where the inside IP addresses are dynamically assigned to a pool of outside addresses – If all addresses in the outside pool are being used, then the host will not be able to access the outside Dynamic NAT & Static NAT – Dynamic NAT and Static NAT can work together – It is possible to setup a pool addresses and also statically map some of the addresses NAT Overload – Overloading allows NAT to scale to support many clients to one IP address – Also referred to as PAT – Instead of just translating the IP address, it also translates the port number – The translation table also maintains the port number

4. Page 4 NAT NAT Configuration –The interfaces on router need to be designated as the “inside” and “outside” interface – “ip nat inside” – “ip nat outside” Static NAT Configuration –Configuration commands – “ip nat inside source static 10.1.1.2 200.1.1.2” –Show commands – “show ip nat translations” – Displays the translation table – “sh ip nat statistics” – Displays various different statistics

5. Page 5 NAT Dynamic NAT –A NAT pool must be setup for outside addresses – “ip nat pool umbc 200.1.1.1 200.1.1.254 netmask 255.255.255.0” – The above command is executed in configuration mode –The addresses to be translated need to be identified – “access-list 1 permit 10.1.1.0 0.0.0.255” – The above command is executed in configuration mode –The inside addresses need to be mapped to the outside pool – “ip nat inside source list 1 pool umbc” – The above command is executed in configuration mode

6. Page 6 NAT NAT Overload –A NAT pool must be setup for outside addresses – “ip nat pool umbc 200.1.1.1 netmask 255.255.255.255” – The above command is executed in configuration mode –Two ways of mapping the inside addresses to the outside pool – “ip nat inside source list 1 pool umbc overload” – “ip nat inside source list 1 interface serial0/0 overload” – The above command is executed in configuration mode – This will map everything in access list 1 to the IP address of the serial interface –The addresses to be translated need to be identified – “access-list 1 permit 10.1.1.0 0.0.0.255” – The above command is executed in configuration mode

7. Page 7 VPN Virtual Private Network (VPN) –A private data network that makes use of the public telecommunication infrastructure (Internet), maintaining privacy through the use of a tunneling protocol and security procedures – A VPN is very cost effective –Traffic is encrypted as it travels across the Internet –An administrator must be aware of the traffic that flows through the tunnel and the end points of tunnel –All traffic on the secure VPN must be encrypted and authenticated – Encryption types – DES, 3DES, AES

8. Page 8 VPN Virtual Private Network (VPN) –The security properties on all end points of the VPN tunnel must be the same –No one outside the VPN tunnel should be able to effect the security properties of the tunnel –Split Tunneling allows for traffic to be sent through a tunnel and outside the tunnel at the same time – Very big security concern with Split Tunneling –IPSEC is used for encryption of VPN tunnel – Uses ISAKMP (IKE) – UDP port 500 for tunnel setup – Uses esp (protocol 50) and ah (protocol 51) for encryption

9. Page 9 VPN Types of VPN –A client based VPN tunnel handles only the connection for one workstation – Usually created from a PC to a VPN Gateway (server) –A LAN-2-LAN VPN tunnel is built for many clients to use – Usually created from one Gateway to another Gateway –Understand the design for each type – Discussed in class VPN Devices –Possible to create a VPN tunnel with any device than supports IPSEC –Cisco devices – IOS router – PIX Firewall – VPN concentrator