NAT

Most of our networks nowadays use some sort of network address translation.

Terminology

It's important to understand some of the terminology when it comes to the CCNA exam. First of all, you need to understand the difference between public and private. We talked about that in our last video. When we're talking about public and private, we're really talking about blocks of addresses, or ranges of addresses, and it's defined by RFC 1918. A public address would just be those addresses we find in the outside world, the block of addresses that are routable on the internet. A private address would be just those blocks of addresses that are only found internally. It's defined by 1918 and found internally, but Cisco further defines the difference between local and global, and inside and outside.

What we could do is refer to a source, such as this laptop right here, and a destination, which would be maybe a web server out here. So let's say this is a web server. The problem with using source and destination is that as we go through this router, you know this goes to this destination, but then information comes back and this becomes the source and this becomes the destination. So using source and destination doesn't quite work for us. What we need to do is come up with different terminology, which is why Cisco did this. This is called the inside and this is called the outside, and therefore it doesn't change. The outside is always referring to this machine right here, and the inside is always referring to this machine right here.

But we have another problem, and that is that this is a packet that's being sent and it's got an IP header on it, and that IP header changes when it goes to the outside. So what we actually needed to do is define what IP addresses we find in this IP header on the local versus the IP headers that we find on the global. That's where local and global come in. Local is any of the IPs that we find in the IP headers that are inside your network. Global is all those IPs of the IP headers that you would find in the rest of the world. Inside is from the laptop or whatever is making this request inside your network, which is going to the outside machine that is outside of your network.

Let's go through that one more time with a little different look at this. This demo laptop is trying to reach a web server right here. It's sending out a packet, so this is the packet that's being sent out, it gets translated, and this is the packet that it gets translated to. If we were to take a look at it, it has a source IP address and a destination IP address, and that gets changed to a different source and a different destination. So what do we call this? When it is local, we can see that it says local right here, meaning it's on the local network, and the source is the inside computer and the destination is the outside web server. So inside local, outside local. Then that gets translated to inside global and outside global, and that's the outside global of the destination, and inside global is the source.

The NAT table

What's interesting about this is this demo laptop is reaching out to a web server that's out there, and that web server hopefully is going to reply and send that web page back to that demo laptop. So this router needs to keep track of that translation, because it's translating from some sort of inside local to inside global as it goes out to the rest of the world. What it does is keep track of that using a NAT table, a network address translation table. As traffic is heading out, it records the machine and the IP address that it's using. So in this case right here, it's translating from 184.191.63.4, translating from the inside local to the inside global address.

Other benefits of NAT

C 1918 was really a way to be able to stretch IPv4. We're running out of public addresses, and what this does is allow us, even though we have a lot of different IP addresses within our network, to only need a few public addresses on the outside world to facilitate this communication. That's why it was created, but there are several other benefits to this as well.

As an example, let's say this demo PI right here only has this NAT table that's set up if it's reaching to the outside world. It limits the exposure. If this doesn't have a public address, then there is no way that a machine can directly connect to this demo PI right here, making it more secure. So NAT can be a way of implementing security, although really what we need is a true firewall on the outside. But NAT does have a certain amount of security involved with it.

Another benefit is that it provides consistency within our network right here. What I mean by that is I've given this a 10.1.0.0 range and said anything in the second octet, if it's 1, represents my local network right here, represents the network connections or the links between these different routers. Anything that's a 10.2 represents this site over here. The third octet then represents the different networks that are at each one of those sites. I have lots of addresses that I can work with, so the fact that I chose this 10 range, I can say that each octet represents something different. This gives me a lot of flexibility and I don't need to worry about wasting addresses, so I'm really able to create consistency with how I'm using my IP addresses, and they all make sense within my network.

That's another advantage versus if I have public addresses. I've had networks that ran off public network addresses, and you have to be really conservative with how you use those public addresses. You can't just be using them for any devices; you've got to be very selective in how you break that apart and use it.

The other way that this is really beneficial is if you change an internet service provider. If these were all public addresses, then it could cause a problem if you switch internet service providers and now have a different set of IP addresses that you have to hand out to all these different devices. I have to go and change all of this networking and redesign all of the networking just because I want to go with a different provider. Whereas if I have this private addressing here, it's just a matter of connecting to another device. Failover is another thing too: if I have multiple providers for failover purposes, so I can have redundancy within my network, this makes it a lot easier. There's quite a few advantages to having it.

Disadvantages

There are, however, several disadvantages to network address translation. First of all, this is an extra function that this router has to do. It creates another delay point in getting your traffic from one point to the next.

Another disadvantage is that you have a loss of end-to-end connectivity, or end-to-end traceability. There is still some tracing that we can do throughout this network, but because we're translating, we can't as easily see what's happening in our network and figure out what's going on. So we lose a little bit of being able to visually see what's happening within our networks.

Another thing that it can complicate is things like tunneling protocols. At some point in time we'll talk more about tunneling protocols, which is tunneling to maybe some other site that we have. What happens when it gets translated? Does it get translated before the tunnel, or right after it gets into the tunnel? And do we want it to be translated, or do we not want it to be translated? So there are questions with that. It complicates some of the tunneling protocols, such as VPNs.

It also complicates outside traffic that's trying to get to maybe one of our web servers. If there's some sort of device that wants to get to our web server and this has a private address, how do we do that? We're going to have to do some reverse translation, so that can complicate things a little bit. I will say though that as we're troubleshooting these issues, it's more common to have private addresses on your network than public addresses. So even though it complicates things a little bit, there's a lot more information out there when it comes to this translation. When you're doing research, it's almost assumed that you are translating, and so troubleshooting guidance that's out there, or how to set things up, actually just assumes that you are doing some sort of network translation. It can be complicated trying to translate that document, or get the pieces out of the document, if you're using public addresses on your network, and I've experienced that firsthand when I've had networks that use public addresses.

One other thing that I'll add to this disadvantage list is you do have to be careful about your address range and making sure it doesn't overlap with another address range if you're connecting into another network. What I mean by that is, let's say you have remote employees that are connecting into your network. If they were to have something from the 10.1.0.0 range that's running on their home network, that could create some issues as they're trying to connect to resources in this 10.1.0.0 network. Their computers are going to see that as being a local network and take precedence, and will start routing traffic to its own network rather than the network that it's supposed to. So one other thing that you need to be careful about is that because there is private addressing that can overlap with other private addresses, if you connect those networks together and they're overlapping, that could be problematic as well.

This is one of the reasons why my home networks usually are not the default. What I mean by that is that you won't get onto my network and see a 192.168.0.0 network, because there are times when I'm VPNing in or remoting into other networks and that is a common network range. So for my home network I choose a different range, so I can VPN and connect into these other networks and not have an issue.