This document describes Network Address Translation (NAT) and provides configuration and monitoring information. It includes the following sections:
NAT Overview
How NAT Works
Sample NAT Configuration
Using Fixed IP Address Mappings
Translating Port Numbers
Displaying NAT Prompts
Configuring NAT
NAT Commands
NAT Overview
NAT lets a router represent an entire LAN to the Internet as a single, global IP address. The Internet sees all traffic from the local network as originating from the global IP address. Likewise, all traffic coming into the local network from the Internet is addressed to the global IP address. This allows your ISP to assign one IP address to your LAN, instead of allocating a block of IP addresses, one for each computer on the network.
NAT provides added security for network connections because it hides internal IP addresses from the Internet side of the NAT router. Also, like a firewall, NAT only accepts packets that are in response to internal requests or packets destined for officially published services.
This implementation of NAT is compliant with RFC 1631, The IP Network Address Translator (NAT).
IP Addressing
Since the outside world cannot see the inside network, you do not need to use registered IP addresses on the inside network. You can use any IP address range that does not exist in the outside network. The Internet Assigned Numbers Authority (IANA) has reserved the following blocks of IP addresses for private networks.
If you are unfamiliar with IP addressing, see IP Addresses.
Terminology
This discussion of NAT uses the following terminology.
How NAT Works
A basic NAT application consists of an inside network, such as a LAN in a small office, and an outside network, such as the Internet.
Figure 21 Basic NAT Configuration
The NAT interface uses a global registered IP address. It can use a dynamic IP address or you can assign a fixed IP address. The NAT interface cannot use an unnumbered IP address.
In this basic configuration, when a user on the
inside network sends a packet to the outside network, the NAT interface translates the user's inside address into the global IP address, and it translates the source port number to a unique port number.
This translation makes it look to the outside network as if all traffic on the inside network comes from one station.
outside network sends a packet to the inside network, the user sends the packet to the global IP address. The NAT interface translates the global IP address into an inside address and sends the packet to the appropriate device on the inside network.
If the packet is not in response to a request from the inside network, or it is not a packet destined for a service or IP address that you have specifically allowed, the NAT interface drops the packet and does not pass it to the inside network.
To do one of the following, you need to set up service table entries or fixed IP address mappings.
Offer services on the inside network to users on the outside.
Allow certain addresses on the inside network to be visible to the outside.
Dynamic Cache
When an inside user generates packets for the outside network,
Service Table
A NAT interface lets only packets that are in response
to internal requests into the inside network. To let outside users access services
on your inside network, you specifically allow each service by adding entries
to the NAT service table or you set up Fixed IP Address
Mapping.
Service table entries consist of the inside IP address of the device that provides the service and the protocol over which the service runs. TCP and UDP entries must also include a port number or range of port numbers. ICMP entries can include a packet type number.
For example, you can add a service table entry that causes the NAT interface to send all FTP packets to a particular server on the inside network. Using service table entries, only one device on the inside network can provide a service on a particular port number because the NAT interface cannot tell one from the other. To offer a service on more than one device, you need to use Fixed IP Address Mapping or Port Number Translation, or you need to set up different port numbers for the service.
Global versus Per Interface Service Tables
The NAT software maintains a global service table, as well as a service table for each NAT interface. When you add a service to your NAT configuration, you can add the service to the global service table or to the service table for a specific interface.
One reason to add service entries for a specific interface rather than to the global table is to provide added security. For example, you could add a service for traffic coming in through a VPN tunnel without giving anyone else access to that service.
Services that NAT Automatically Adds
If NAT is running on a router that has IP Tunnels, the NAT software automatically creates services necessary to run SKIP (Simple Key-Management for Internet Protocols). These services are
SKIP is IP protocol 57, which contains SKIP encrypted and authenticated data.
SKIPCDP is the SKIP Certificate Discovery Protocol.
DISCARD is UDP Discard port 9, which SKIP uses to test the reachability of remote tunnel endpoints.
Fixed IP Address Mapping
Fixed IP address mapping lets you have more than one outside IP address visible to the outside network. You can use fixed IP address mapping to offer a service on more than one inside device.
To use fixed IP address mapping, you set up a table where one outside address corresponds to one inside address. For example, each of the following outside addresses has a corresponding inside address.
When the NAT interface receives a packet from the outside destined for 128.185.22.16, it forwards the packet to inside address 10.1.5.1. Likewise, when the NAT interface receives a packet from inside address 10.1.5.1 that is destined for the outside, it changes the packet's source IP address to 128.185.22.16. Therefore, anyone on the outside who is communicating with 10.1.5.1 sees only the outside address of 128.185.22.16.Outside Inside Mask
128.185.22.16 10.1.5.1 255.255.255.255
128.185.22.34 10.1.5.2 255.255.255.255
128.185.22.92 10.1.5.3 255.255.255.255
See Using Fixed IP Address Mappings for some examples.
How NAT Handles IP Packets
The following figures show how the NAT interface handles packets it receives from
the outside network that are destined to the global IP address
the outside network that are not destined to the global IP address
the inside network
Figure 23 How the NAT Interface Handles Packets It Receives from the Outside Network That Are Not Destined to the Global IP Address
Figure 24 How the NAT Interface Handles Packets It Receives From the Inside Network
Using Routing Protocols with NAT
You can enable RIP to run on the NAT router so that it learns routes in the inside network. However, the NAT interface does not forward RIP packets from the inside network to the outside network. The NAT interface also does not advertise OSPF routes from the inside network to the outside network.
Sample NAT Configuration
Figure 25 is a small
office setup using NAT. In this example, the inside network has two users (clients)
and an FTP server.
Figure 25 Sample NAT Configuration
To set up the NAT configuration in Figure 25,
Enable NAT on Interface 1, the WAN interface.
Add an entry in the service table for FTP and assign the FTP server's inside IP address to the service.
The following list describes what happens when Client 1 and Client 2 in Figure 25 browse the same outside Web site, which has an IP address of 128.185.5.6.
If it finds a match, the NAT interface translates the destination address to the inside IP address of the FTP server (10.1.1.4) and forwards the packet to the FTP server.
If it does not find a match, the NAT interface proceeds to step 2.
If it finds a match, the NAT interface translates the global IP address (50.19.2.1) to the inside IP address of the FTP server (10.1.1.4) and forwards the packet to the FTP server.
If it does not find a match, the NAT interface proceeds to step 3.
If it finds a match, the NAT interface translates the global IP address (50.19.2.1) to the inside IP address of the FTP server (10.1.1.4) and forwards the packet to the FTP server. It then creates a cache entry for this connection and forwards the packet.
If it does not find a match, the software drops the packet.
This section gives some examples of situations where you might want to use fixed IP address mapping and how to set it up.
Fixed IP address mappings apply to all NAT interfaces on the router.
Allowing Multiple Servers on the Inside Network
In Figure 26, there
are three servers on the inside network, each offering multiple services. Using
fixed IP address mapping, you can allow
clients on the outside network to access the three servers,
each server to be known by a unique outside IP address, and
each server to have its own private inside address.
To set up this fixed address mapping, add a mapping for each outside and each inside address. For example:
NAT Config>add fixed-ip-mappings
Public outside address [0.0.0.0]? 128.185.142.6
Mask [255.255.255.255]?
Private inside address [0.0.0.0]? 10.1.5.1
For example, to map all addresses on the inside subnet of 10.2.1.0 through 10.2.1.254 to a corresponding outside address in the outside subnet of 128.185.227.0 through 128.185.227.254, enter the following command.
By specifying a subnet mask, you can set up a fixed mapping translation of an entire subnet of outside addresses to an entire subnet of inside addresses using only one command.NAT Config>add fixed-ip-mappings
Public outside address [0.0.0.0]? 128.185.227.0
Mask [255.255.255.255]? 255.255.255.0
Private inside address [0.0.0.0]? 10.2.1.0
Allowing a Subnet to be Visible to the Outside Network
Another use for fixed IP addressing is to allow a group of users on a subnet to have their addresses visible to the outside. For example, to cause addresses in the range of 128.185.228.x to have their address visible to the outside, enter
By setting the outside and inside addresses to the same value, you essentially cause NAT to not translate certain ranges of IP addresses. This lets you partially run NAT, where NAT translates some, but not all, of your inside network addresses.NAT Config>add fixed-ip-mappings
Public outside address [0.0.0.0]? 128.185.228.0
Mask [255.255.255.255]?
Private inside address [0.0.0.0]? 128.185.228.0
Translating Port Numbers
Using service table entries, only one device on the inside
network can provide a service on a particular outside port number. To offer a
service on more than one device, you need to set up different outside port numbers
for the service, use fixed IP address mapping,
or set up the NAT interface to translate port numbers. Translating port numbers
instead of using fixed IP address mapping, allows you to have only one IP address
visible to the outside.
For example, in Figure 27 there are two Web servers. Web Server 1 runs on port 80, and Web Server 2 runs on port 81. The service table entries cause the NAT interface to send all packets destined for port 80 to Web Server 1 and all packets destined for port 81 to Web Server 2. The NAT interface does not translate port numbers.
Figure 27 Publishing the Same Service Using Different Port Numbers
Alternatively, in Figure 28, there are two Web servers that both run on port 80. In this case, you need to set up the NAT interface to translate port numbers. One service table entry offers Web Server 1 on port 80 and another entry offers Web Server 2 on port 81. However, before the NAT interface sends packets to Web Server 2, it translates the port number from 81 to 80.
Figure 28 Publishing the Same Service Using Port Number Translation
Displaying NAT Prompts
NAT commands are available at the NAT Config> prompt and the NAT> prompt.
At the NAT Config> prompt, changes that you make are saved in the router's configuration memory. These changes take effect when you restart the router.
Display the NAT Config> prompt as follows:
At the*config
Config>protocol ip
Internet protocol user configuration
IP config>nat
Network Address Translation Configuration
NAT Config>
NAT> prompt, changes that you make take effect immediately. Unless you explicitly save your changes using the save command, they are not saved when you restart the router.
Display the NAT> prompt as follows:
*monitor
Monitor>protocol ip
IP>nat
Network Address Translation Console
NAT>
NAT Config> prompt
or the NAT> prompt as described in Displaying
NAT Prompts. This example uses the NAT Config> prompt.
NAT Config>enable nat
Interface # [0]? 1
NAT enabled on interface 1
Service table involved is the global table([Yes] or No): [yes]? yes
Service name ([CR] to get a list of well-known-services)? ftp
Server's IP address [0.0.0.0]? 10.12.1.1
Server's local port (0 = no port translation) [0]?
NAT Config>exit
IP config>exit
Config> Ctrl P
*restart
If you set up NAT at the monitoring prompt, the configuration takes effect immediately. To make the changes permanent, enter save.
NAT>save
If you do not explicitly set the NAT global IP address, the NAT interface uses the IP address of the interface on which NAT is enabled. It does not matter whether you assigned an IP address to the interface or are using a dynamically assigned address.
You can explicitly assign another outside address as the NAT global IP address by using the set nat-interface ip-address command.
Set a global IP address in the following situations.
You have a Web server and your ISP wants the outside address of your WAN interface and the outside address of the Web server to be different.
You require more than one outside IP address. In this case, setting a global IP address instead of using the default address ensures that NAT uses the address that you want to have as the global IP address.
You cannot use an unnumbered IP address as the global IP address.
You should not use an IP address mapped with the NAT fixed IP mapping feature as the global IP address.
Press Space twice after you type a command to display the available options for each command. Enter help for information about using the command line interface.
[C] means the command is available at the NAT Config> prompt.
[M] means the command is available at the NAT> prompt.
| Command | Function |
|---|---|
| Add [C] [M] | Adds fixed IP address mappings and service table entries to the NAT configuration. |
| Clear [C] [M] | Clears NAT configuration information and the cache of a NAT interface. |
| Delete [C] [M] | Deletes specific fixed IP address mappings, service table entries, NAT interface configurations, or cache entries. |
| Disable NAT [C] [M] | Disables NAT on an interface. |
| Enable NAT [C] [M] | Enables NAT on an interface. |
| Exit [C] [M] | Returns to the previous prompt. |
| List [C] [M] |
Lists the NAT configuration and service table entries. At the NAT> prompt, also lists cache entries. |
| Restore [M] | Restores the configuration that is in permanent memory. |
| Save [M] | Saves the current (running) configuration to permanent memory. |
| Set [C] [M] | Sets timers, cache size, global IP address, and lets you change service table entries. |
| Zero [M] | Clears the fixed IP address usage counters. |
Add [C] [M]
Adds fixed IP address mappings and service table entries to your NAT configuration.
Example: add fixed-ip-mappings
Interface number [0]? 1
Public outside address [0.0.0.0]? 128.185.2.45
Mask [255.255.255.255]?
Private inside address [0.0.0.0]? 10.34.34.2
service
Adds a service table entry to the NAT configuration. You can add global service table entries, which apply to all NAT interfaces in the router. Or you can add entries that apply to a specific NAT interface. One reason to add service entries for a specific interface rather than to the global table is to provided added security. For example, you could add a service for traffic coming in through a VPN tunnel without giving anyone else access to that service.
Add an entry for each service that the inside network offers to the outside network. You must also add services that the NAT interface itself offers, such as Telnet or Web authentication. See Service Table.
You can change service table entries using the set service commands.
If NAT is running on a router that has IP Tunnels, the NAT software automatically creates services necessary to run SKIP: Discard, SKIP, SKIPCDP.
Also, when you enable NAT on an interface, the software creates a service entry that allows Point-to-Point Tunneling Protocol (PPTP) client traffic to pass through the NAT interface.
Service table involved is the global table([Yes] or No): [yes]? no
Interface number [0]? 1
Service name ([CR] to get a list of well-known-services)? http
Server's IP address [0.0.0.0]? 10.12.1.1
Server's local port (0 = no port translation) [0]?
add service
Service table involved is the global table([Yes] or No): [yes]?
Service name ([CR] to get a list of well-known-services)? admin
Server's IP address [0.0.0.0]? 10.1.2.1
Server's local port (0 = no port translation) [0]?
Enter protocol [TCP]?
Enter starting port number ([CR] for all) [-1]? 90
Enter ending port number [1]?90
|
Service table involved is the global table?
| To apply this service table entry to all NAT interfaces in the router answer Yes. |
|
Interface number
| If you answered No to the previous question, the software prompts you for the interface to which you want to apply this service table entry. |
|
Service name
| You can enter a well-known service name from the list below or you can define your own service name. If you enter a well-known service name, the software fills in the protocol and port range. |
|
|
|
|
Server's IP Address
| The IP address of the host in the inside network that provides the service. If the NAT router provides the service, enter one of the router's own IP addresses. |
|
Server's local port
|
You can set up NAT to translate the destination port number that it receives from the outside network. When the NAT interface forwards the packet to the server, it sends the packet to this port number. The default is 0 (zero), which means the NAT interface does not translate the port number. |
|
Protocol
|
The protocol associated with this service. Enter ICMP, UDP, TCP, or All. Nx Networks recommends that you do not use All because All causes the NAT interface to send all IP packets that it receives to this server. |
|
Starting Port number
|
The lowest port number associated with this service.
For protocol ICMP, this value represents the packet type. The default is 8, which is an ICMP Echo Request. To change the default, use the set service port-range command. |
|
Ending Port number
|
The highest port number associated with this service. To match a single port, enter the same number for the starting port and the ending port.
For protocol ICMP, this value represents the packet type. The default is 8, which is an ICMP Echo Request. To change the default, use the set service port-range command. |
Clear [C] [M]
Clears NAT configuration information. At the NAT> prompt, you can also clear the NAT cache.
cache
Clears the cache of a NAT interface. This command is available only at the NAT> prompt.
Interface number [0]? 1
Example: clear fixed-ip-mappings
All fixed mappings have been cleared
NAT Config> prompt.
services
Clears all service table entries.
Delete [C] [M]
Deletes fixed IP address mappings, service table entries, or NAT interface configurations. At the NAT> prompt, also deletes cache entries.
NAT> prompt. Enter list cache at the NAT> prompt to display a list of ID numbers.
Interface # [0]? 1
Id number [0]?
Example: delete fixed-ip-mappings
Interface number [5]?
Public outside address [0.0.0.0]? 128.185.1.1
Mask [255.255.255.255]?
Interface # [0]? 1
NAT deleted from interface 1
Service table involved is the global table([Yes] or No): [yes]? Service name? http
disable nat
Interface # [0]? 1
NAT is disabled
enable nat
Interface # [0]? 1
Default NAT interface created
NAT enabled on interface 1
exit
List [C] [M]
Displays the current NAT interface configuration, fixed IP address mappings, and service table entries. At the NAT> prompt, also displays a summary of the current cache entries.
NAT Enabled on interface 5
Address is: Automatic Service Table Used: Global
Maximum # entries: 500 Global ageout: 1800 secs
TCP ageout (secs): 9000 TCP closed ageout: 30 secs
NAT Enabled on interface 4
Address is: Automatic Service Table Used: Global
Maximum # entries: 500 Global ageout: 1800 secs
TCP ageout (secs): 9000 TCP closed ageout: 30 secs
Global Service Table:
Name Protocol Port Range Server Address/Port Translation
--------- -------- ---------- -------------------------------
TIME UDP 37-37 10.10.2.2/None
Interface 5 - Interface-specific Service Table:
Name Protocol Port Range Server Address/Port Translation
--------- -------- ---------- -------------------------------
HTTP TCP 80-80 10.10.2.2/None
Interface 4 - No interface-specific service entries defined
Fixed IP Address Translation mappings for interface 5:
Outside Inside Mask
128.185.2.2 10.10.1.1 255.255.255.255
No fixed IP Address Translations for interface 4
This command is available at the NAT> prompt.
Note: Cache entries for the ICMP protocol age out after 10 seconds regardless of the ageout time you have set. This prevents ICMP traffic, such as PING and TRACEROUTE packets, from filling the cache with unnecessary entries.
Example:list cache
NAT Cache - Interface 0
ID Proto Inside Address Outside Address NAT's source address
---- ----- ---------------- ------------------- --------------------
1 TCP 192.168.3.20:26476 192.168.3.3:23 192.168.3.20:26476
Example: list fixed-ip-mappings
Interface number [5]?
Fixed IP Address Translation mappings for interface 5:
Fixed IP Address Translation mappings:
Outside Inside Mask
128.185.23.23 10.10.50.1 255.255.255.255
NAT> prompt, this command also displays
a count of how many times NAT used each mapping on packets from outside to inside
and from inside to outside. Clear the usage counters using the zero
command.
Example: list fixed-ip-mappings
Interface number [5]?
Fixed IP Address Translation mappings-ifc 5: Translation Usage Counts
Outside Inside Mask Out->In In->Out
128.185.23.23 10.10.50.1 255.255.255.255 0 0
Interface # [0]? 1
NAT Enabled on interface 1
Address is Auto
Maximum # entries 500
Global ageout 1800 secs
TCP ageout 9000 secs, closed 30 secs
Service table involved is the global table([Yes] or No): [yes]?
Global Service Table:
Name Protocol Port Range Server Address/Port Translation
---------- -------- ----------- --------------------------------
HTTP TCP 80-80 10.1.2.1/ 81
TELNET TCP 23-23 10.1.1.1/None
FTP TCP 20-21 10.1.2.3/None
list services
Service table involved is the global table([Yes] or No): [yes]? no
Interface number [5]? 5
Interface 5 - Interface-specific Service Table:
Name Protocol Port Range Server Address/Port Translation
--------- -------- ---------- -------------------------------
HTTP UDP 80-80 10.10.2.2/None
NAT> prompt.
Example: restore
This will overwrite your existing runtime configuration.
Continue? (Yes or [No]): yes
Restore complete
NAT> prompt to permanent memory so they are still present after you restart the router.
Example: save
This will overwrite your existing saved configuration.
Continue? (Yes or [No]): yes
Save complete
Example: set nat-interface ageout
Interface # [0]?
Ageout time (secs) [1800]?
This command is available at the NAT Config> prompt.
Note: You cannot use unnumbered IP on a NAT interface.
Example:set nat-interface ip-address
Interface number [1]?
NAT IP address (0.0.0.0 = use automatic default) [0.0.0.0]
Example: set nat-interface max-entries
Interface # [0]?
Maximum Cache Entries [500]?
Example: set nat-interface tcp-ageout
Interface # [0]?
TCP Ageout time (secs) [9000]?
TCP Closed time (secs) [30]?
service address
Changes the inside IP address of a service table entry.
Service table involved is the global table([Yes] or No): [yes]?
Service name? database
Server's IP address [10.1.99.8]?
service local-port name port#
Changes the local port number of a service table entry.
Example: set service local-port
Service table involved is the global table([Yes] or No): [yes]? Service name? rtradmin
Server's local port [0]?
service port-range name starting-port ending-port
Changes the range of ports for a service table entry.
Example: set service port-range
Service table involved is the global table([Yes] or No): [yes]?
Service name? http
Enter starting port number ([CR] for all) [-1]? 81
Enter ending port number [81]?
service protocol name protocol
Changes the protocol for a service table entry.
Service table involved is the global table([Yes] or No): [yes]?
Service name?
Enter protocol [TCP]?
Zero [M]
At the NAT> prompt, list
fixed-ip-mappings displays a count of how many times NAT used each mapping
on packets coming from outside to inside and from inside to outside. The zero
command clears these counters.
zero