2

When NAT router is used for global address translation, two networks may have same private IP address. Am I right or wrong?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 12 '17 at 5:26
3

As long as whatever routable address space either network is using on the "External" side is unique, yes, the "Internal" address space may overlap.

| improve this answer | |
2

My internal private IP addressing and another person's internal IP addressing may be the same or similar, yes.

On a NAT router or Firewall, you have an inside interface and an outside interface. Using an ACL, or depending on your manufacturer's OS, you determine what internal traffic source is NAT'd to an external address when it crosses the Firewall or NAT router.

Out on the internet your public addresses are bought and assigned; there are no overlaps in Public address space. Overlaps in Public address space would cause serious problems.

| improve this answer | |
2

Yes, you are correct. This is why it is critically important in business to consider this in network architecture planning. It's awful after a merger to create VPN links between offices when they all use 10.0.0.0/8 for instance.

Keep your prefixes as small as you require (with space for predicted growth), and if you are setting up multiple offices, even if you think they'll never be connected, use different prefixes. Also, use an IPAM software or at minimum a spreadsheet to keep track of what prefixes are where.

You don't want to have to do multi-layer NAT and other trickery to connect overlapping subnets, unless absolutely necessary. Guaranteed you'll get "we can't change our IPs", so what you're left with is a hard-to-document setup that resembles spaghetti.

| improve this answer | |
  • It is interesting that IPv6 has something similar (not exactly the same) called Unique Local IPv6 Unicast Addresses. The range is fc00::/7, with the first half (fc00::/8) reserved for a global authority to make sure that the addresses would be unique. This authority has yet to be set up. The other half (`fd00::/8) is available to use, but the subnet portion of the address is required to be randomly generated to reduce the likelihood of duplicate subnets. See RFC 4193 for more information: tools.ietf.org/html/rfc4193 – Ron Maupin Aug 24 '15 at 16:27
0

You can't use same private IP pool under one NAT device for two networks. If you have multiple NAT devices then you can use same private IP pool under each NAT device.

| improve this answer | |
  • This is true for most NATs but it's not true universally. For example the ds-lite RFC specifies a combined deencapsulation and NAT device (the aftr element) that handles overlapping internal IP pools. – Peter Green May 27 '16 at 18:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy