Help understanding NAT/PAT - With example

Question

Would anyone be able to clarify what ive been thinking is correct or if this is a complete misunderstanding and possibly answer these questions if you have time?

So I understand that NAT/PAT is giving a boundary device a public IP and then its “Children” private IP’s… based on their ports? In the below scenario the Core layer are the boundary devices?

Going off the picture Below. Cores 1,2&3 are one business, Core 4 is another business, but all are inside the same building and using the same provider.

Questions:

Core 1,2&3. Can they all use the same NAT/PAT Scheme? Would Core 2 understand the same NAT/PAT address as Core 1 has implemented?

Would Core 4 have the same NAT/PAT scheme as 1,2&3 or would it be completely separate/fresh?

Would Core 4 be on a different Vlan or a different private network completely?

Answer 1

So I understand that NAT/PAT is giving a boundary device a public IP and then its “Children” private IP’s… based on their ports?

That's one use of NAT. More generally, a NAT device forwards traffic from one interface to another, while translating the IP packet's addresses from the input interface to a set of addresses on the output interface. The device can translate the source address/port, destination address/port, or both, depending on the application.

There is always a one-to-one correspondence between the untranslated packet address/port and the translated packet address/port.

In the below scenario the Core layer are the boundary devices?

That is up to you. You define the "boundary" wherever it makes sense.

Would Core 4 have the same NAT/PAT scheme as 1,2&3 or would it be completely separate/fresh?

I think you are not clear on the purpose of NAT. It is used to solve some address incompatibility between two network/hosts. That can be duplicate address schemes or routing problems (public/private addresses). If devices behind core 4 need to talk to the other network, but there is an address compatibility issue, then NAT may be a solution. If there isn't an iuuse, NAT is not needed.

Would Core 4 be on a different Vlan or a different private network completely?

That depends on the design. It could be either one.

Answer 2

NAT/PAT is giving a boundary device a public IP and then its “Children” private IP’s…

It's more the other way around. You create a network using private IP addresses (for lack of public addresses) and then use NAPT as a means to enable communication with the Internet or any other network that can't make use of your private address range.

For outbound traffic, you translate your meaningless addresses to a public address (or one from a pool) that makes sense to the destination on your network edge. For inbound traffic you reverse the translation.

Whether the nodes are all in the same network or building or if the are distributed around the globe (e.g. using VPN or other tunneling) doesn't really matter. What matters is whether the far node can use the original source address (then don't use NAPT) or not (do use NAPT).

So it's more a matter of "administrative distance" rather than of geographical distance.

Core 1,2&3. Can they all use the same NAT/PAT Scheme? Would Core 2 understand the same NAT/PAT address as Core 1 has implemented?

Likely, but not necessarily. It depends on the overall address design.

By the way, the 11.55.150.x addresses you're using in the diagram are no private addresses as defined in RFC 1918.

Would Core 4 have the same NAT/PAT scheme as 1,2&3 or would it be completely separate/fresh?

Yes, they could use the same, contiguous private address space. Connecting them requires tunneling across public address space/the Internet.

Would Core 4 be on a different Vlan or a different private network completely?

VLANs are a concept for data link layer virtualization. That has (almost) nothing to do with network/transport layer translations.

A L3 subnet often lives within a VLAN, usually in a 1:1 relationship. For routing between VLANs you'd either have a contiguous addressing scheme and use normal, transparent routing, or different addressing schemes, requiring routing with NAT/NAPT.