The Network Address Translator port (NAT)

The IP addresses inside a stub domain can be duplicated by another stub domain, for instance a single Class A address could be used in several stub domains. This situation very frequently happens when the domains are not administered by the same authority, as in the case of independent enterprises networks.

As long as the domains are isolated there are not problems, but as soon as they need to be interconnected the addresses overlapping would prevent it. Here is where Network Address Translation (NAT) plays its role: installing a Network Address Translator at each exit point between a stub domain and the backbone, or between stub domains, allows translations of addresses so that each stub domain can "see" valid addresses.

Network Address Translation (NAT) problems

Unfortunately Network Address Translation (NAT) is not for free. Because of the way some protocol/application behaves it may introduce compatibility problems, not always solved.

The problem: some protocols/applications places IP addresses, and/or TCP/UDP ports, in the payload of the packets, at the same "level" of the application data.
As a result, when the Network Address Translator changes the IP addresses or the TCP/UDP port of a datagram, it results in a misalignment between the new values in IP/TCP/UDP headers and the content of the packet, which carries the same information BUT at application level.

To successfuly apply Network Address Translation (NAT) it is therefore necessary to proceed with a further modification of the packet payload, so that it correspond the current values in the IP/TCP/UDP headers.
Unfortunately there is not a "good-for-all" method and each protocol/application must be identified and processed properly.

The List of protocols/applications supported by NAT section gives the exact view of the well known application/protocols that require a special handling and that are either supported or not supported by Abilis CPX Network Address Translator port.
Those not mentioned should be able to work without troubles.

Terminology

Inside.  The set of networks there are subject of translation, usually "private" networks.

Outside.  All other networks, usually "public" addresses located on the Internet.

Inside local IP address.  The IP address was assigned to a host on the inside network. The address may or may not be a valid outside address (usually on Internet), but in the second case it may actually belong to another organization to which it will impossible to connect, even with NAT. In the table of NAT Aliases this term called as NET:.

Inside global IP address.  The IP address of an inside host as it appears to the outside networks. If, as usual, the outside network is the Internet, the address must be one of the "public" addresses that the ISPs have assigned to user's router for those connections. In the table of NAT Aliases this term called as ANET:.

Processed IP packet. It mean in this packet was changed a source or destination address in some cases a source or destination port was changed too.

Ignored IP packet. It mean that this packet was not changed.

Types of address translation

Static Address Translation. The user can establish a one-to-one mapping between the inside local and global addresses, which happens when the number (netmask) of inside local and global addresses are identical.

Dynamic Source Address Translation. The user can establish dynamic mapping between the inside and global addresses, which happens when the number (netmask) of inside local and global addresses are different.

Port Address Translation (PAT). The user can conserve addresses in the global address pool by allowing source ports in TCP connections or UDP conversations to be translated. Different local addresses will be mapped to the same global address, with port translation providing the necessary uniqueness for TCP/UDP and other tricks providing uniqueness for ICMP.

This mode is indifferently called "PAT" or "NAT+PAT" and works only with TCP/UDP/ICMP protocols.

Extended filtering in PAT mode. The purpose of this feature is to allow a selective activation of the PAT translation based on the destination TCP/UDP port and on the IP protocol, with the result that network managers can empower their control of the network by:

• Granting access only to some service, e.g. web and ftp.

• Blocking access only to specific services, e.g. realaudio / realvideo servers

• Precisely distinguishing inbound connections from outbound ones

• Allowing internal users to access ANY service on the Internet while outside users may access only a restricted set

Destination port mapping. This behaviour is very useful in many situations, the most frequents are:

• The user has just one public IP address and on the internal LAN there are more computers on several IP addresses running different services that must be reached from outside, e.g. one runs FTP, another HTTP, another SMTP.

• The user has just one public IP address and on the internal LAN there are more computers on several IP addresses running the same service with different contents, e.g. a commercial web, a technical web, a restricted access web.

For more information see Configuration examples section.

Configuration of the NAT port

The NAT port is referred by the "NAT" abbreviation and it has all the parameters described in this chapter.

Here is an example of the NAT port parameters.

[18:18:41] ABILIS_CPX: D P PO:NAT
                                                                               
PO:911 - Not Saved (SAVE CONF), Not Refreshed (INIT) --------------------------
NAT    ------------------------------------------------------------------------
       LOG:DS          ACT:NO           dimtable:1000   TOUT:60             
       - PAT mode timeouts ----------------------------------------------------
       TCP-CONN:3      TCP-CLOSING:180  TCP-CLOSED:1    TCP-RST:YES                         
       ICMP:30         UDP:3            DNS:30          SNTP:30             
       FRAG-ID:30      FRAG-PTR:30      SNMP-ALG:NO             

To activate changes made on the parameters displayed by low case characters, it is needed to restart the system; on the contrary for activating changes made on upper case parameters it is enough to execute the initialization command INIT PO:.
The changes made on the LOG: parameter are immediately active.

The "Not Saved (SAVE CONF)" message is displayed every time the port configuration is modified but not saved with the SAVE CONF command.

The "Not Refreshed (INIT)" message is displayed every time the port configuration is modified but not refreshed with the INIT PO: command.

Details of the NAT port parameters

Statistics of the NAT port

Example on how to show state and statistics of the Control Port through the command D S:

[15:00:45] ABILIS_CPX:d s po:911

PO:911 ------------------------------------------------------------------------
NAT    STATE:READY     CUR-TRANSLATIONS:0           MAX-TRANSLATIONS:1000
       ------------------------------------------------------------------------
       REQ:529         SUCCESS:0           IGNORED:529         ERROR:0
       OVERFLOW:0                          TCP-RST:0
       -----------|--IN SRC---|--IN DST---|--OUT SRC--|--OUT DST--|
       ICMP       |0          |0          |0          |0          |
       TCP        |0          |0          |0          |0          |
       UDP        |0          |0          |0          |0          |
       OTHERS     |0          |0          |0          |0          |
       ------------------------------------------------------------------------
       FTP        |0          |0          |0          |0          |
       DNS        |0          |0          |0          |0          |
       OTHERS     |0          |0          |0          |0          |
       ------------------------------------------------------------------------
       FRAG-ID:0                   FRAG-POINTER:0
       FRAG-UNRESOLVED:0           FRAG-HEADER-FOUND:0
       ------------------------------------------------------------------------

NAT port statistics fields detailed

Supported protocols/applications

Terminology

Regular protocol/application

It is a protocol/application that works correctly even if IP addresses and/or TCP/UDP ports are translated. They do not require a specific treatment.

Special protocol/application

It is a protocol/application that requires further specific treatment of the packets payload after the IP addresses and/or TCP/UDP ports translation.

Supported protocol/application.

It is special a protocol/application that CPX NAT can successfully manage.

Unsupported protocol/application.

It is a protocol/application that CPX NAT cannot manage correctly, in the sense that it can only translate IP addresses and/or TCP/UDP port but it cannot modify the packet payload.

Well known regular protocols

• HTTP
• HTTPS
• TFTP
• TELNET
• Any application that does NOT carry the IP addresses to be translated in the packet payload
• Any application that does NOT carry the IP addresses and/or TCP/UDP ports to be translated in the packet payload

Supported protocols/applications

Below is a list of well known special protocols/applications which are supported by CPX NAT.

• ICMP (used by "ping" and "traceroute" utilities)
• FTP on port 21 (PORT and PASV commands)
• DNS on port 53 ("A" and "PTR" queries)

Unsupported protocols/applications

Below is a list of well known special protocols/applications which cannot work with any NAT implementation, because the information in the payload is ciphered, and therefore NATs cannot modify them!

• IPsec and IKE
• Kerberos 4
• Kerberos 5
• X Windowing System

Below is a list of well known special protocols/applications which are not supported by the current CPX NAT implementation.

• NetBIOS over TCP/IP
• Progressive Networks' RealAudio
• NetMeeting
• NetMeeting Directory (Internet Locator Server)
• H.323
• PPTP

Print this page