0

As I read on Section 4.3.8 of this page https://www.manrs.org/isps/guide/antispoofing/,

The following code:

ip nat inside source list INSIDE pool OUTSIDE overload

will translate packets with a source address in access-list INSIDE and change the source address to an address in the pool OUTSIDE. However, packets that have a spoofed source address that is not included in the INSIDE access list will be forwarded without any translation, resulting in spoofed packets on the Internet

If the claim made on this page is true, why doesn't NAT drop packets that are not present in the INSIDE list? If this can be done then we can reduce spoofed IP addresses on the internet.

Improve this question
3
  • What if you have servers that have actual public Internet addresses? You would not want to translate those packet addresses.
    – Ron Maupin ♦
    Commented Mar 14, 2020 at 16:43
  • The purpose of NAT is to do network address translation. If you want to drop packets with a particular source IP range, use an ACL. But beware running out of TCAMs if you use an ACL and NAT on the same interface of an IOS device.
    – Darrell Root
    Commented Mar 14, 2020 at 17:12
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 17, 2020 at 16:22

2 Answers 2

Reset to default
2

There are (at least) two main reasons:

  1. The assumption is that you control the "inside" network. So, presumably, you're not doing the spoofing.
  2. Not every device needs to be NATted. You might have some devices that use addresses that don't need translation.
Improve this answer
0

There are at least three design principles like Separation of concerns, principle of least knowledge, single responsibility that make NAT focus on only translation and NOT try to be a security feature also. Users need to combine NAT and ACL to make sure they configure the desired functionality. If functionality from other features creep in to NAT, it may lead to side effects that may force a specific order of execution of features like anit-spoof, NAT, ACLs etc.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.