Network Address Translation (NAT)

In Chapter 3.1.3 Public vs. Private IP Addresses, you learned that specific ranges from Class A, Class B, and Class C are reserved for internal use. These addresses are not routable on the public Internet. We call them private IP address ranges, or RFC1918 addresses.

What are the three RFC1918 Private IP address ranges?

These ranges were created to conserve IPv4 address space and slow down address consumption, which was accelerating quickly in the 1990s. If you want Internet access, you must use a public IP address (any IP address that is not in the private ranges), because only public IP addresses are routable on the Internet.

Below is a typical topology: a host inside a private network needs to communicate with a server somewhere on the Internet.

Image 210

Image Title - PC A within a Private network, connected to R1, which is connected to the Internet using a Public IP address

PC A is an endpoint inside a company called “XYZ Corp.” It’s connected to the private network 10.1.1.0/24, and its default gateway is the GigabitEthernet0/0 interface on R1. R1 is also connected to an ISP router, which provides Internet access. The link between R1 and the ISP router uses public IP addressing. This is a common design for both organizations and home networks.

Why private addressing alone breaks Internet return traffic

If PC A needs to communicate with the web server, outbound traffic is straightforward: as long as R1 has a default route toward the ISP router, packets from PC A can reach the web server.

The problem shows up on the way back. When the web server replies, it must put PC A’s IP address in the destination IP address field. But PC A’s address is private (10.1.1.2), and private addresses can’t be routed across the Internet.

Image 211

Image Title - PC A sending a packet to the Web Server’s Public IP address and Server A attempting to respond back to PC A using its Private IP address

This is the core issue when you use RFC1918 addresses without any translation:

• PC A’s packets can reach the web server.
• The web server’s reply is addressed to 10.1.1.2.
• Internet routers won’t route that destination, so the packet gets dropped.

In actuality, the packet may not even get a chance to reach an Internet router, depending on the routing on the Web Server’s Default Gateway. If the 10.1.1.0/24 network is also used inside the organization where the Web Server resides, then it might route the packet internally to a device that is not PC A. However, if the Web Server’s Default Gateway has a Default Route to its ISP Router, then it will send the packet there, where it will be dropped for sure.

NAT completes the solution

Creating RFC1918 address space was only half of the solution to conserving IPv4 address space. The other half is Network Address Translation (NAT).

NAT allows a router to translate one IP address into another. The router also keeps a translation table:

• When traffic leaves the network, the router translates the address and records the mapping.
• When return traffic comes back, the router uses the table to reverse the translation.

From the endpoint’s perspective (for example, the user at PC A), this is transparent - the host doesn’t need to know NAT is happening.

In this common Internet-access scenario, NAT translates private IP addresses to public IP addresses so traffic can be routed on the Internet. This is still how Internet access is handled in most organizations and homes.

It is important to note that NAT can actually be in different use cases other than just translating Private IP addresses to Public IP addresses. It does not have to be a translation from Private to Public and vice versa. In reality, NAT can simply translate any IP address to a different one. But in the scope of the CCNA 200-301 v1.1, you only need to think about NAT in the context of translating Private IP addresses to Public IP addresses, which is a form of “Source NAT”, as it is known across the industry.

What the NAT router does to each packet

As soon as an IP packet enters a router interface on a router configured for NAT, the router checks its NAT configuration to decide whether translation should occur. If it should:

• The router changes the source IP address to a translated address (a public IP address in this case).
• The server’s return traffic is then addressed to that public IP address, so it can be routed across the Internet.
• When the return traffic reaches the NAT router, the router translates the destination back to the original inside host and forwards it to PC A.

Image 212

Image Title - Web Server responding back to the translated IP address associated with PC A

Configuring NAT

There are several ways to configure NAT. For the CCNA 200-301 v1.1 exam, you’ll focus on two of the most common configurations.

Port Address Translation (PAT) a.k.a. “overloading”

The most common NAT configuration for Internet access is Port Address Translation (PAT), also called “overloading.” PAT allows many private IP addresses to share one public IP address. That public IP is typically the address on the router interface that connects to the ISP. Home routers commonly use PAT.

Because multiple inside hosts share the same public IP, the router must still be able to tell flows apart. PAT does this by using TCP and UDP port numbers:

• The router tracks each conversation using the source port (and other flow details).
• It records these mappings in its NAT table.
• When return traffic arrives, the router uses the table to send the traffic to the correct inside host.

Image 213

Image Title - Example of how PAT (NAT Overloading) works

Step 1: Identify inside and outside interfaces

First, define which router interface faces the inside (private) network and which faces the outside (public/ISP) network.

We’ll use the topology from the previous example above with the web server and configure NAT on R1.

On R1:

• Gigabitethernet0/0 points to 10.1.1.0/24, so it’s the inside interface.
• Gigabitethernet0/1 has a public IP address (203.0.113.1), so it’s the outside interface.

Configure each interface like this:

interface gigabitethernet0/0 ip nat inside

interface gigabitethernet0/1 ip nat outside

• The {`ip nat inside`} command marks an interface as an inside interface.
• The {`ip nat outside`} command marks an interface as an outside interface.

Step 2: Create a standard ACL to match inside addresses

Next, configure a standard ACL that identifies which inside (private) source addresses should be translated.

ip access-list standard PAT
permit 10.1.1.0 0.0.0.255

This creates a named standard ACL called “PAT” that matches the entire 10.1.1.0/24 network. Any host in that subnet is eligible for NAT when sending traffic to the outside.

Alternativley, of course a numbered Standard ACL could be used instead.

Step 3: Configure PAT (overload)

Finally, configure NAT in global configuration mode. This command references:

• The ACL that matches inside source addresses
• The outside interface whose public IP will be used
• The {`overload`} keyword to enable PAT

NAT Command	Source	ACL Name or #	Outside Interface	PAT (Overload) Command

When we plug in commands it should look like this:

NAT Command	Source	ACL Name or #	Outside Interface	PAT (Overload) Command
ip nat inside	source list	PAT	Interface gigabitethernet0/1	overload

ip nat inside source list PAT interface gigabitethernet0/1 overload

Let’s look at a screenshot of the full configuration entered on the router.

Image 214

Image Title - Entering the NAT Overload (PAT) configuration on R1

Now, whenever packets from any host in 10.1.1.0/24 exit Gigabitethernet0/1 on R1:

• Their source IP addresses are translated to the public IP on that interface (203.0.113.1).
• The Internet server replies to 203.0.113.1.
• R1 reverses the translation and forwards the return traffic to the correct inside host.

Configuring static NAT

Another common NAT scenario is a 1-to-1 translation, called static NAT.

Image 215

Image Title - Web Server with an internal Private IP address, but NATs to a Public IP address on the Internet

In this example, the web server’s real address inside its network is a private IP (172.16.1.250). That’s the IP configured on its NIC. To communicate with hosts on the Internet, the edge router translates that real (private) address to a public NAT address (100.64.0.250) that was assigned to the company.

So, to the outside world, the web server’s IP address is “100.64.0.250”. When return traffic comes back, the router translates the NAT address back to the server’s real address and forwards the packet to the server. Internally, the company will communicate with the server using it’s real “172.16.1.250” address.

To configure 1:1 static NAT on a router, use the following command in global configuration mode:

Static NAT command	Real IP Address	NAT Address
ip nat inside source static	172.16.1.250	100.64.0.250

ip nat inside source static 172.16.1.250 100.64.0.250

NAT address terminology

Before wrapping up NAT, you’ll want to know the standard terms used to describe addresses in a NAT deployment.

NAT Terminology	Meaning
Inside Local Address	This is the real IP address assigned to the Network Interface Card (NIC) of a host on the inside (Private) portion of your network.
Inside Global Address	This is typically a Public IP address that is assigned to an organization. It’s usually the IP that is assigned to a router interface that faces the Internet, on your organization’s Router. Despite the name, it is still considered to be on the “outside” portion of your network.
Outside Global Address	Typically, the Public IP Address of a (remote) external host, outside of your organization. (The Web Server’s Public IP address for example)
Outside Local Address	This is typically the Private (real) IP address of an external host, outside of your organization that is assigned to its NIC card, if they are also performing NAT.

The diagram below shows where each of these addresses appears in a NAT scenario.

Image 216

Image Title - Network topology with a NAT deployment, displaying the names for each type of IP address