Network Address Translation fundamentals

Question

Could someone please help me understand the concepts of NAT? I thought I understood how this works, but I'm confused about there being two public addresses, as opposed to just one public internet address.

My understanding on NAT is this:

Inside Local - The RFC 1918 private address or addresses before translation

Outside Local - The outgoing interface IP of the router connected to the ISP (is this also an RFC 1918 private address???)

Inside Global - The local IP address after translation

Outside Global - The real internet address

Please correct me here if I'm wrong.

When I've seen examples of the NAT translations, I understand the inside local address is the local private IP range, with the inside global address being the local address address after translation. What I don't understand is where the public addresses for outside local and outside global come from.

The reason I ask this is because when I configure PAT, I'd use the following command for example:

ip nat pool test 2.2.2.2 2.2.2.2 net 255.255.255.0
access list 10 permit 192.168.100.0 0.0.0.255
ip nat pool inside source list 1 pool test overload

I'd then apply the following on the inside local interface:

ip nat inside

With the following on the serial interface going to the ISP

ip nat outside

By definition, I've specified the NAT pool address to use, and specified the allowed networks with the ip nat inside command, so is there something additional I'd need to configure for the actual public addresses?

Any help would be appreciated, as I'm having a hard time trying to grasp the concepts here.

Answer 1

I can help you understand the names of the NAT addresses.

Each name breaks down to...

The {inside | outside} device is {globally | locally} known as <Address Name>.

For the purpose of this explanation, inside and local both refer to the side of the network that the NAT inside interface is in. Outside and global both refer to the side of the network that the NAT outside interface is in.

For example, the Inside Local address. The Inside device is Locally known as the Inside Local address. On standard overload NAT, this is the private IP space that is actually assigned to hosts on your internal network.

Next is the Inside Global address. The Inside device is Globally known as the Inside Global address. On standard overload NAT, this is the public IP address of your router that the Internet sees your local hosts as.

Now the Outside Local address. The Outside device is Locally known as the Outside Local address. On standard overload NAT, this is the public Internet IP address that the internal clients direct their IP packets towards.

Finally, the Outside Global address. The Outside device is Globally known as the Outside Global address. On standard overload NAT, this is the public IP address that the internal clients direct their IP packets towards. Note that it is the same as the Outside Local address, since both inside clients and the public Internet see the same IP for the device.

As far as "using two public IP addresses": In your example, the "test" pool is defining the public IP address to use. Your other option would be to use the "interface interface" command instead of the pool. You only define the public IP (or pool of IPs) one time.

Answer 2

Since you used the Cisco tags, I will provide the Cisco definitions. Simply put, NAT is translating one or more addresses in packets.

There are several versions of NAT for Cisco devices: inside source, inside destination, and outside source. You seem to want to understand the inside source.

NAT doesn't really have anything to do with RFC 1918 address space. You can NAT any addresses, public or private. The most common use does translate from local private addressing to public addressing, but that is not a requirement for NAT.

If you search, Cisco has many documents about NAT, for example:

NAT: Local and Global Definitions:

Term Definitions

Cisco defines these terms as:

• Inside local address—The IP address assigned to a host on the inside network. This is the address configured as a parameter of the computer OS or received via dynamic address allocation protocols such as DHCP. The address is likely not a legitimate IP address assigned by the Network Information Center (NIC) or service provider.
• Inside global address—A legitimate IP address assigned by the NIC or service provider that represents one or more inside local IP addresses to the outside world.
• Outside local address—The IP address of an outside host as it appears to the inside network. Not necessarily a legitimate address, it is allocated from an address space routable on the inside.
• Outside global address—The IP address assigned to a host on the outside network by the host owner. The address is allocated from a globally routable address or network space.

These definitions still leave a lot to be interpreted. For this example, this document redefines these terms by first defining local address and global address. Keep in mind that the terms inside and outside are NAT definitions. Interfaces on a NAT router are defined as inside or outside with the NAT configuration commands, ip nat inside destination and ip nat outside source. Networks to which these interfaces connect can then be thought of as inside networks or outside networks, respectively.

• Local address—A local address is any address that appears on the inside portion of the network.
• Global address—A global address is any address that appears on the outside portion of the network.

Packets sourced on the inside portion of the network have an inside local address as the source address and an outside local address as the destination address of the packet, while the packet resides on the inside portion of the network. When that same packet gets switched to the outside network, the source of the packet is now known as the inside global address and the destination of the packet is known as the outside global address.

Conversely, when a packet is sourced on the outside portion of the network, while it is on the outside network, its source address is known as the outside global address. The destination of the packet is known as the inside global address. When the same packet gets switched to the inside network, the source address is known as the outside local address and the destination of the packet is known as the inside local address.

This image provides an example.

Answer 3

If you are trying to get a better understanding on NAT fundamentals. It would beneficial to watch a few introductory videos. Here is a great video to help get you started. https://www.youtube.com/watch?v=711xYxaRPwM