Configuring NAT for IP Address Conservation

All access lists required for use with the configuration tasks described in this module should be configured prior to beginning a configuration task. For information about how to configure an access list, refer to the IP Access List Sequence Numbering document.

Note	If you specify an access list with a NAT command, NAT will not support the permit ip any any command that is commonly used in an access list.

Before configuring NAT in your network, you should know interfaces on which NAT will be configured and for what purposes. The following requirements will help you decide how to configure and use NAT:

• Define the NAT inside and outside interfaces if:
  • Users exist off multiple interfaces.
  • Multiple interfaces connect to the Internet.
• Define what you need NAT to accomplish:
  • Allow internal users to access the Internet.
  • Allow the Internet to access internal devices such as a mail server.
  • Allow overlapping networks to communicate.
  • Allow networks with different address schemes to communicate.
  • Allow the use of an application level gateway.
  • Redirect TCP traffic to another TCP port or address.
  • Use NAT during a network transition.

NAT allows organizations to resolve the problem of IP address depletion when they have existing networks and need to access the Internet. Sites that do not yet possess Network Information Center (NIC)-registered IP addresses must acquire IP addresses, and if more than 254 clients are present or are planned, the scarcity of Class B addresses becomes a serious issue. NAT addresses these issues by mapping thousands of hidden internal addresses to a range of easy-to-get Class C addresses.

Sites that already have registered IP addresses for clients on an internal network may want to hide those addresses from the Internet so that hackers cannot directly attack clients. With client addresses hidden, a degree of security is established. NAT gives LAN administrators complete freedom to expand Class A addressing, which is drawn from the reserve pool of the Internet Assigned Numbers Authority (RFC 1597). The expansion of Class A addresses occurs within the organization without a concern for addressing changes at the LAN or the Internet interface.

Cisco software can selectively or dynamically perform NAT. This flexibility allows network administrator to use a mix of RFC 1597 and RFC 1918 addresses or registered addresses.

NAT is designed for use on a variety of routers for IP address simplification and conservation. In addition, NAT allows the selection of internal hosts that are available for NAT.

A significant advantage of NAT is that it can be configured without requiring any changes to hosts or routers other than to those few routers on which NAT will be configured.

NAT is a feature that allows the IP network of an organization to appear from the outside to use a different IP address space than what it is actually using. Thus, NAT allows an organization with nonglobally routable addresses to connect to the Internet by translating those addresses into a globally routable address space. NAT also allows a graceful renumbering strategy for organizations that are changing service providers or voluntarily renumbering into classless interdomain routing (CIDR) blocks. NAT is described in RFC 1631.

Beginning with Cisco IOS Release 12.1(5)T, NAT supports all H.225 and H.245 message types, including FastConnect and Alerting, as part of the H.323 Version 2 specification. Any product that makes use of these message types will be able to pass through a Cisco NAT configuration without any static configuration. Full support for NetMeeting Directory (Internet Locator Service) is also provided through NAT.

A router configured with NAT will have at least one interface to the inside network and one to the outside network. In a typical environment, NAT is configured at the exit router between a stub domain and the backbone. When a packet leaves the domain, NAT translates the locally significant source address into a globally unique address. When a packet enters the domain, NAT translates the globally unique destination address into a local address. If more than one exit point exists, each NAT must have the same translation table. If NAT cannot allocate an address because it has run out of addresses, it drops the packet and sends an Internet Control Message Protocol (ICMP) host unreachable packet to the destination.

NAT operates on a router--generally connecting only two networks--and translates the private (inside local) addresses within the internal network into public (inside global) addresses before any packets are forwarded to another network. This functionality gives you the option to configure NAT so that it will advertise only a single address for your entire network to the outside world. Doing this effectively hides the internal network from the world, giving you some additional security.

The types of NAT include:

• Static address translation (static NAT)--Allows one-to-one mapping between local and global addresses.
• Dynamic address translation (dynamic NAT)--Maps unregistered IP addresses to registered IP addresses from a pool of registered IP addresses.
• Overloading--Maps multiple unregistered IP addresses to a single registered IP address (many to one) using different ports. This method is also known as Port Address Translation (PAT). By using overloading, thousands of users can be connected to the Internet by using only one real global IP address.

NAT can be used for the following applications:

• When you want to connect to the Internet, but not all of your hosts have globally unique IP addresses. NAT enables private IP internetworks that use nonregistered IP addresses to connect to the Internet. NAT is configured on the router at the border of a stub domain (referred to as the inside network) and a public network such as the Internet (referred to as the outside network). NAT translates internal local addresses to globally unique IP addresses before sending packets to the outside network. As a solution to the connectivity problem, NAT is practical only when relatively few hosts in a stub domain communicate outside of the domain at the same time. When this is the case, only a small subset of the IP addresses in the domain must be translated into globally unique IP addresses when outside communication is necessary, and these addresses can be reused when they are no longer in use.
• When you must change your internal addresses. Instead of changing the internal addresses, which can be a considerable amount of work, you can translate them by using NAT.
• When you want to do basic load sharing of TCP traffic. You can map a single global IP address to many local IP addresses by using the TCP load distribution feature.

The term inside in a NAT context refers to networks owned by an organization that must be translated. When NAT is configured, hosts within this network will have addresses in one space (known as the local address space) that will appear to those outside the network as being in another space (known as the global address space).

Similarly, the term outside refers to those networks to which the stub network connects, and which are generally not under the control of an organization. Hosts in outside networks can also be subject to translation, and can thus have local and global addresses.

NAT uses the following definitions:

• Inside local address--The IP address that is assigned to a host on the inside network. The address is probably not a legitimate IP address assigned by the NIC or service provider.
• Inside global address--A legitimate IP address (assigned by the NIC or service provider) that represents one or more inside local IP addresses to the outside world.
• Outside local address--The IP address of an outside host as it appears to the inside network. Not necessarily a legitimate address, it is allocated from the address space routable on the inside.
• Outside global address--The IP address assigned to a host on the outside network by the owner of the host. The address is allocated from a globally routable address or network space.

This section describes the following topics:

• Inside Source Address Translation
  
• Overloading of Inside Global Addresses
  

NAT is used to translate your IP addresses if your IP addresses are neither legal nor officially assigned. Perhaps you can chose IP addresses that officially belong to another network. Index overlapping is when an IP address is used both illegally and legally. You can use NAT to translate inside addresses that overlap with outside addresses.

The figure below shows how NAT translates overlapping networks.

Figure 3

NAT Translating Overlapping Addresses

The router translates overlapping addresses as follows:

1. The user at host 10.1.1.1 opens a connection to Host C by name, requesting a name-to-address lookup from a Domain Name System (DNS) server.
2. The router intercepts the DNS reply and translates the returned address if there is an overlap (that is, the resulting legal address resides illegally in the inside network). To translate the return address, the router creates a simple translation entry to map the overlapping address 10.1.1.3 to an address from a separately configured, outside local address pool.

The router examines every DNS reply, to ensure that the IP address is not in the stub network. If it is, the router translates the address as follows:

1. Host 10.1.1.1 opens a connection to 172.16.0.3.
2. The router sets up the translation mapping of the inside local and global addresses to each other and the outside global and local addresses to each other.
3. The router replaces the SA with the inside global address and replaces the DA with the outside global address.
4. Host C receives the packet and continues the conversation.
5. The router does a lookup, replaces the DA with the inside local address, and replaces the SA with the outside local address.
6. Host 10.1.1.1 receives the packet and the conversation continues using this translation process.

The NAT Virtual Interface feature allows NAT traffic flows on the virtual interface, eliminating the need to specify inside and outside domains. When a domain is specified, translation rules are applied either before or after route decisions are applied, depending on the traffic flow from inside to outside or outside to inside. Translation rules are applied to a domain only after the route decision for a NAT Virtual Interface (NVI) is applied.

When a NAT pool is shared for translating packets from multiple networks connected to a NAT router, an NVI is created and a static route is configured that forwards all packets addressed to the NAT pool to the NVI. Standard interfaces connected to various networks are configured to determine if the traffic originating from and received on the interfaces needs to be translated.

The figure below shows a typical NVI configuration.

Figure 4

NAT Virtual Interface Typical Configuration

An NVI has the following benefits:

• A NAT table is maintained per interface for better performance and scalability.
• Domain-specific NAT configurations can be eliminated.

Your organization may have multiple hosts that must communicate with a heavily-used host. By using NAT, you can establish a virtual host on the inside network that coordinates load sharing among real hosts. DAs that match an access list are replaced with addresses from a rotary pool. Allocation is done on a round-robin basis and only when a new connection is opened from the outside to the inside. Non-TCP traffic is passed untranslated (unless other translations are in effect). The figure below illustrates this feature.

Figure 5

NAT TCP Load Distribution

The router performs the following process when translating rotary addresses:

1. The user on Host B (192.0.2.223) opens a connection to the virtual host at 10.1.1.127.
2. The router receives the connection request and creates a new translation, allocating the next real host (10.1.1.1) for the inside local IP address.
3. The router replaces the destination address with the selected real host address and forwards the packet.
4. Host 10.1.1.1 receives the packet and responds.
5. The router receives the packet and performs a NAT table lookup by using the inside local address and port number, and the outside address and port number as keys. The router then translates the source address to the address of the virtual host and forwards the packet.
6. The next connection request will cause the router to allocate 10.1.1.2 for the inside local address.

A public wireless LAN provides users of mobile computing devices with wireless connections to a public network, such as the Internet.

The NAT Static IP Address Support feature extends the capabilities of public wireless LAN providers to support users configured with a static IP address. By configuring a router to support users with a static IP address, public wireless LAN providers extend their services to a greater number of potential users, which can lead to greater user satisfaction and additional revenue.

Users with static IP addresses can use services of the public wireless LAN provider without changing their IP address. NAT entries are created for static IP clients and a routable address is provided.

For NAT, a route map must be processed instead of an access list. A route map allows you to match any combination of access lists, next-hop IP addresses, and output interfaces to determine which pool to use. The ability to use route maps with static translations enables the NAT multihoming capability with static address translations. Multihomed internal networks can host common services such as the Internet and DNS, which are accessed from different outside networks. NAT processes route map-based mappings in lexicographical order. When static NAT and dynamic NAT are configured with route maps that share the same name, static NAT is given precedence over dynamic NAT. To ensure the precedence of static NAT over dynamic NAT, you can either configure the route map associated with static NAT and dynamic NAT to share the same name or configure the static NAT route map name so that it is lexicographically lower than the dynamic NAT route map name.

Benefits of using route maps for address translation are as follows:

• The ability to configure route map statements provides the option of using IPsec with NAT.
• Translation decisions can be made based on the destination IP address when static translation entries are used.

RADIUS is a distributed client/server system that secures networks against unauthorized access. Communication between a network access server (NAS) and a RADIUS server is based on UDP. Generally, the RADIUS protocol is considered a connectionless service. Issues related to server availability, retransmission, and timeouts are handled by RADIUS-enabled devices rather than the transmission protocol.

RADIUS is a client/server protocol. The RADIUS client is typically a NAS, and the RADIUS server is usually a daemon process running on a UNIX or Windows NT machine. The client passes user information to designated RADIUS servers and acts on the response that is returned. RADIUS servers receive user connection requests, authenticate the user, and then return the configuration information necessary for the client to deliver the service to the user. A RADIUS server can act as a proxy client to other RADIUS servers or other kinds of authentication servers.

Limiting the number of concurrent NAT operations using the Rate Limiting NAT Translation feature provides users more control over how NAT addresses are used. The Rate Limiting NAT Translation feature can be used to limit the effects of viruses, worms, and DoS attacks.

Because NAT is a CPU-intensive process, router performance can be adversely affected by DoS attacks, viruses, and worms that target NAT. The Rate Limiting NAT Translation feature allows you to limit the maximum number of concurrent NAT requests on a router.

Viruses and worms are malicious programs designed to attack computer and networking equipment. Although viruses are typically embedded in discrete applications and run only when executed, worms self-propagate and can quickly spread on their own. Although a specific virus or worm may not expressly target NAT, it might use NAT resources to propagate itself. The Rate Limiting NAT Translation feature can be used to limit the impact of viruses and worms that originate from specific hosts, access control lists, and VPN routing and forwarding (VRF) instances.

A denial-of-service (DoS) attack typically involves the misuse of standard protocols or connection processes with the intent to overload and disable a target, such as a router or web server. DoS attacks can come from a malicious user or from a computer infected with a virus or worm. An attack that comes from many different sources at once, such as when a virus or worm has infected many computers, is known as a distributed DoS attack. Such distributed DoS attacks can spread rapidly and involve thousands of systems.

The Real Time Streaming Protocol (RTSP) is a client/server multimedia presentation control protocol that supports multimedia application delivery. Some of the applications that use RTSP include Windows Media Services (WMS) by Microsoft, QuickTime by Apple Computer, and RealSystem G2 by RealNetworks.

When the RTSP protocol passes through a NAT router, the embedded address and port must be translated for the connection to be successful. NAT uses Network Based Application Recognition (NBAR) architecture to parse the payload and translate the embedded information in the RTSP payload.

RTSP is enabled by default. Use the ip nat service rtsp port port-number command to reenable RTSP on a NAT router if this configuration has been disabled.

Inside source addresses can be configured for static or dynamic translations. Perform one of the following tasks depending on your requirements:

• Configuring Static Translation of Inside Source Addresses
  
• Configuring Dynamic Translation of Inside Source Addresses
  

The tasks in this section are grouped because they perform the same action but are executed differently depending on the type of translation that is implemented--static or dynamic:

Perform the task that applies to the translation type that is implemented.

• Configuring Static Translation of Overlapping Networks
  
• Configuring Dynamic Translation of Overlapping Networks
  

1.    enable

2.    configure terminal

3.    ip nat pool name start-ip end-ip {netmask netmask | prefix-length prefix-length}

4.    access-list access-list-number permit source [source-wildcard]

5.    ip nat inside source list access-list-number pool name overload

6.    interface type number

7.    ip address ip-address mask

8.    ip nat inside

9.    exit

10.    interface type number

11.    ip address ip-address mask

12.    ip nat outside

13.    end

When you configure NAT of external IP addresses, NAT can be configured to ignore all embedded IP addresses for any application and traffic type. Traffic between a host and the traffic outside an enterprise's network flows through the internal network. A device configured for NAT translates the packet to an address that can be routed inside the internal network. If the intended destination is outside an enterprise's network, the packet gets translated back to an external address and is sent out.

Note

When you configure the ip nat outside source static command to add static routes for outside local addresses, there is a delay in the translation of packets and packets are dropped. Packets are dropped because a shortcut is not created for the initial synchronization (SYN) packet when NAT is configured for static translation. To avoid dropped packets, configure either the ip nat outside source static add-route command or the ip route command.

Benefits of configuring NAT of external IP addresses only are:

• Allows an enterprise to use the Internet as its enterprise backbone network.
• Allows the use of network architecture that requires only the header translation.
• Gives the end client a usable IP address at the starting point. This address is the address used for IPsec connections and for traffic flows.
• Supports public and private network architecture with no specific route updates.

1.    enable

2.    configure terminal

3.    ip nat inside source {list {access-list-number | access-list-name} pool pool-name [overload] | static network local-ip global-ip [no-payload]}

4.    ip nat inside source {list {access-list-number | access-list-name} pool pool-name [overload] | static {tcp | udp} local-ip local-port global-ip global-port [no-payload]}

5.    ip nat inside source {list {access-list-number | access-list-name} pool pool-name [overload] | static [network] local-network-mask global-network-mask [no-payload]}

6.    ip nat outside source {list {access-list-number | access-list-name} pool pool-name [overload] | static local-ip global-ip [no-payload]}

7.    ip nat outside source {list {access-list-number | access-list-name} pool pool-name [overload] | static {tcp | udp} local-ip local-port global-ip global-port [no-payload]}

8.    ip nat outside source {list {access-list-number | access-list-name} pool pool-name [overload] | static [network] local-network-mask global-network-mask [no-payload]}

9.    exit

10.    show ip nat translations [verbose]

The NAT Default Inside Server feature helps forward packets from the outside to a specified inside local address. Traffic that does not match any existing dynamic translations or static port translations is redirected, and packets are not dropped.

Dynamic mapping and interface overload can be configured for gaming devices. For online games, outside traffic comes on a different UDP port. If a packet is destined for an interface from outside an enterprise's network and there is no match in the NAT table for the fully extended entry or the static port entry, the packet is forwarded to the gaming device using a simple static entry.

Note	You can use this feature to configure gaming devices with an IP address that is different from that of the PC. To avoid unwanted traffic or DoS attacks, use access lists. For traffic going from the PC to the outside, it is better to use a route map so that extended entries are created.

1.    enable

2.    configure terminal

3.    ip nat inside source static local-ip interface type number

4.    ip nat inside source static tcp local-ip local-port interface global-port

5.    exit

6.    show ip nat translations [verbose]

The NAT Virtual Interface feature removes the requirement to configure an interface as either NAT inside or NAT outside. An interface can be configured to use or not use NAT.

• Enabling a Static NAT Virtual Interface
  
• Enabling a Dynamic NAT Virtual Interface
  

1.    enable

2.    configure terminal

3.    ip nat pool name start-ip end-ip {netmask netmask | prefix-length prefix-length} type rotary

4.    access-list access-list-number permit source [source-wildcard]

5.    ip nat inside destination-list access-list-number pool name

6.    interface type number

7.    ip address ip-address mask

8.    ip nat inside

9.    exit

10.    interface type number

11.    ip address ip-address mask

12.    ip nat outside

13.    end

1.    enable

2.    configure terminal

3.    interface type number

4.    ip nat inside

5.    exit

6.    ip nat allow-static-host

7.    ip nat pool name start-ip end-ip netmask netmask accounting list-name

8.    ip nat inside source list access-list-number pool name

9.    access-list access-list-number deny ip source

10.    end

11.    show ip nat translations verbose

Device# show ip nat translations verbose

--- 172.16.0.0 10.1.1.1           ---                ---
create 00:05:59, use 00:03:39, left 23:56:20, Map-Id(In): 1, flags: none wlan-flags: Secure ARP added, Accounting Start sent Mac-Address:0010.7bc2.9ff6 Input-IDB:Ethernet1/2, use_count: 0, entry-id:7, lc_entries: 0

1.    enable

2.    configure terminal

3.    ip nat inside source {list {access-list-number | access-list-name} pool pool-name [overload] | static local-ip global-ip [route-map map-name]}

4.    exit

5.    show ip nat translations [verbose]

1.    enable

2.    configure terminal

3.    ip nat pool name start-ip end-ip netmask netmask

4.    ip nat pool name start-ip end-ip netmask netmask

5.    ip nat inside source route-map name pool name [reversible]

6.    ip nat inside source route-map name pool name [reversible]

7.    end

1.    enable

2.    show ip nat translations

3.    configure terminal

4.    ip nat translation max-entries {number | all-vrf number | host ip-address number | list listname number | vrf name number}

5.    end

6.    show ip nat statistics

1.    enable

2.    configure terminal

3.    ip nat pool name start-ip end-ip prefix-length prefix-length [accounting method-list-name] [arp-ping]

4.    ip nat translation arp -ping-timeout [seconds]

5.    end

You can configure address translation timeouts based on your specific configuration of NAT.

By default, dynamic address translations time out after some period of nonuse. You can change the default values on timeouts, if necessary. When overloading is not configured, simple translation entries time out after 24 hours. Use the ip nat translation timeout command to change the timeout value for dynamic address translations that do not use overloading.

You can use the ip nat translation max-entries command to change the default global NAT translation limit.

• Changing the Default Timeouts for Protocol-Based Translations
  

• Example: Configuring Static Translation of Inside Source Addresses
  
• Example: Configuring Dynamic Translation of Inside Source Addresses