Overload PAT Question

Question

Learning details of NAT PAT. I understand basics wherein the PAT router incorporates a source port to ID the private address computer communicating out on the public address, enabling the public address side to return packets back to original private IP computer.

I have 2 questions on this premise.

(1) When a computer communicates out, does the NAT PAT Router use the original source port number of the sending computer (?) or (for whatever reasons) does the router replace the original source port with it's own port number (from a free pool etc?) while keeping track of the original and given port numbers in a table somewhere?

(2) I'm wondering how the router deals with these source port identifications during a DHCP lease update?

Answer 1

(1) When a computer communicates out, does the NAT PAT Router use the original source port number of the sending computer (?) or (for whatever reasons) does the router replace the original source port with it's own port number (from a free pool etc?) while keeping track of the original and given port numbers in a table somewhere?

PAT is the Cisco-specific term for NAPT* (Network Address Port Translation). The NAPT device replaces (translates) both the IPv4 address and the transport address (port) for TCP and UDP, or the Query ID for ICMP. The transport address is from a pool for the transport protocol used (TCP, UDP, or ICMP), so there are three transport pools, and there is a translation table for each of the three transport protocols. The translation tables allow replies to be translated back to the original IPv4 address and transport address.

(2) I'm wondering how the router deals with these source port identifications during a DHCP lease update?

Those are two completely different things, and if the IPv4 address on the host changes, then the NAPT is broken. That would happen with a TCP connection without NAT, too, because it depends on both the source and destination IP and TCP addresses remaining the same for the duration of the connection. Typically, a DHCP renewal will give the host the same address. A host will usually ask the DHCP server for the same address at about half the DHCP lease period.

---

*RFC 2663, IP Network Address Translator (NAT) Terminology and Considerations:

4.1.2. Network Address Port Translation (NAPT)

NAPT extends the notion of translation one step further by also translating transport identifier (e.g., TCP and UDP port numbers, ICMP query identifiers). This allows the transport identifiers of a number of private hosts to be multiplexed into the transport identifiers of a single external address. NAPT allows a set of hosts to share a single external address. Note that NAPT can be combined with Basic NAT so that a pool of external addresses are used in conjunction with port translation.

For packets outbound from the private network, NAPT would translate the source IP address, source transport identifier and related fields such as IP, TCP, UDP and ICMP header checksums. Transport identifier can be one of TCP/UDP port or ICMP query ID. For inbound packets, the destination IP address, destination transport identifier and the IP and transport header checksums are translated.

A NAPT router in figure 2 may be configured to translate sessions originated from N-Pri into a single external address, say Addr-i.

Very often, the external interface address Addr-Nx of NAPT router is used as the address to map N-Pri to.

Answer 2

(1) Implementations vary but the most common NAPT uses a source port from the router's pool, regardless of the original source port. Sometimes this can be overridden to use a specific source port (e.g. port 25 for SMTP).

(2) DHCP isn't related to NAT. With direct DHCP, a discovery doesn't cross the router and, as a broadcast, isn't NATed either. With DHCP relay, all information is contained in the packet's payload. The (wrapping) IP packet doesn't matter for the lease, it's just the return address for the offer or acknowledge.