1

To preface this question, my question is somewhat related to what I'm trying to understand as the difference between layer 3 switches and routers. The main difference between the two is that layer 3 switches uses hardware optimized for the routing while routers use general purpose CPUs. I'm sure there are many jobs that the hardware is optimized for but I believe its main purpose is doing a fast lookup for a <address, port> table.

But in a configuration where you have

WAN - NAT capable gateway - Switch - client

The NAT is essentially storing a table of <address,port> and so when you receive internet from the WAN, NAT is doing a table lookup first to find the private address of the client, which is negating the benefit of the switch. So I'm confused on 1)how we are avoiding redundant work, and 2)why we aren't overloading the switch to do all the lookup duties

Edit)

For more context, let's compare it with a following setup.

WAN - Router - Switch - Client

I think the above case is pretty analogous to my original concern. There are plenty of cases where routers come between WAN and Switches. Let's assume some Switch A is connected to interface 5 of the router. Let's assume Switch A is connected to clients with IPs in the range of 123.123.123.0/24.

Wouldn't you say that the router here shouldn't have a lookup table with the end clients as entries, and instead should have a lookup table with the switches as entries? For example, if a client's ip is 123.123.123.123, the router wouldn't have a table where the destination is 123.123.123.123. Why would the router carry every entry of the clients when it's only directly connected to switches? Instead you would have a rule where for all IPs in the range of 123.123.123.0/24, the destination is interface 5.

As you can see here, we don't need to have the router do a lookup that includes all the clients because there are further classifications down the path. But a NAT before a switch is doing a lookup that includes all clients which seems inefficient.

1

2 Answers 2

3

I'm trying to understand as the difference between layer 3 switches and routers.

The difference between a layer 3 switch and a router is mostly nuance and detail of the specific platform/product in question. If you simplify things to an abstract concept, a layer 3 switch is a router. There is no need to make a distinction until you want to discuss actual products and their features.

The main difference between the two is that layer 3 switches uses hardware optimized for the routing while routers use general purpose CPUs.

That is incorrect. Many/most routers use specialized hardware that is purpose designed for network traffic forwarding.

I'm sure there are many jobs that the hardware is optimized for but I believe its main purpose is doing a fast lookup for a <address, port> table.

This is the beginning of your confusion. There are more than 1 type of address and 1 type of port. Switch port is a general term for the network interface port on a switch where you connect a network cable of some type or a transceiver where you connect a cable. Network devices have more than 1 kind of 'port' so it is important to clarify what you are talking about. A port on a switch is not the same thing as a port as used in Network Address Translation. In reference to NAT, the port is a TCP or UDP or other logical identifier for the distinction of specific network traffic.

There are over 65000 possible network service ports (0-65535) that are usually used as a sending or receiving identifier for a network connection. Ports below 1024 are considered to be 'well-known' as belonging to commonly defined services such as 80 for HTTP and 443 for HTTPS type TCP traffic, 25 for SMTP, etc. Some are actually reserved, assigned, etc. by IANA for specific services. Ports over 1024 to 49151 are 'registered' by IANA for specific services/application but you can use them for other things or dynamic use in NAT etc., though you may encounter issues with protocols that use those ports. Ports from 49152–65535 are 'ephemeral' and cannot be registered or assigned for specific services and are intended specifically for use in NAT or in dynamic connection setup, etc.

As for addresses, when discussing a switch, an address is usually a reference to a hardware address (Media Access Control or MAC address). Hardware addresses are also called 'burned in addresses' because they are usually set on a device during manufacture of the device and are not easily changed after manufacture on most devices (though it is possible on some). The MAC address of a device is learned by the switch and used so the switch can decide where to forward network frames destined for that MAC address. Layer 2 switches do not know what IP address equates to which MAC address, the sending or receiving device connected to the switch must make that determination (IP address to MAC address lookup via ARP). The sending device must have a MAC address to send to or it will fail to deliver the traffic. The layer 2 switch simply accepts the frames destined for a MAC address, and determines which physical switch port (interface is probably a better term) to deliver them to and forwards them. It does not know or care about IP addresses or TCP/UDP service ports.

Yes, layer 3 switches also exist and they do deal with IP addresses. That is why people usually specify which they are discussing. Layer 3 switches (or routers) do not, at their most basic level, deal with TCP/UDP ports either during their primary function. They simply perform the duty of checking their forwarding tables for destination networks/paths. If a device wants to send to an IP address that is not part of the local, connected network (otherwise it could be delivered via ARP resolution to a destination MAC, ie. layer 2 switch style function), then the router performs the duty of 'gateway' and accepts traffic from the sender and checks its forwarding table for any route that matches the intended destination IP address. Most simple routers will have maybe 2 entries on their forwarding table: their LAN network, and the default route (0.0.0.0/0) which it learns from the ISP.

Once you add in the concept of firewall and NAT capabilities, of course, you have to account for more than simple IP addresses and TCP/UDP service ports come into the discussion.

But in a configuration where you have 'WAN - NAT capable gateway - Switch - client' The NAT is essentially storing a table of <address,port> and so when you receive internet from the WAN, NAT is doing a table lookup first to find the private address of the client, which is negating the benefit of the switch. So I'm confused on 1)how we are avoiding redundant work, and 2)why we aren't overloading the switch to do all the lookup duties

Again you are confusing hardware network interface ports and TCP/UDP ports that relate to network protocols. They are two different things.

An incoming connection to a router (really a firewall) that performs NAT will generally have 2 possible actions.

  1. The connection to the router WAN interface will be denied/dropped because it was not a reply to a previously initiated connection from a device on the protected LAN network, or it does not qualify to pass through an open port (TCP/UDP or similar network service port) that has been configured to forward traffic to an IP address and associated TCP/UDP network service port on a LAN IP address.

  2. The connection is a reply to a connection initiated by a device with an IP address on the protected LAN or it matches an open port rule previously configured on the firewall so there is a qualified NAT table entry that allows and forwards the inbound connection.

  • How do the table entries work? TCP is connection/session oriented so the router/firewall can have entries in its NAT table to match TCP sessions and UDP connections trigger NAT table entries for a timed period and then expire but can be re-opened by a LAN client as needed, recreating the NAT table entry and resetting the timer for the entry.

As a separate function, after that connection has been allowed through the firewall, it may then need to be delivered to a physical switch interface given that many small business or home firewalls include a built in switch with a few ports. The switch functionality is separate from the router/firewall functionality, including NAT. Firewall and NAT functions are performed first and once completed, the traffic can then be 'routed' (this is the lookup of the appropriate interface for a destination IP network) and ARP can be performed to discover which MAC address should be used as destination for a desired IP address on the LAN. The traffic is then dispatched to the switch for delivery to a connected LAN device. The switch will then perform any layer 2 functions needed to find a destination MAC on a specific interface and forward the frames to that interface for delivery to the destination device.

As for the concept of a layer 3 switch 'behind' a router, that is a completely separate concern and is usually done to provide for better performance or traffic management in a complex LAN design and does not play a factor in NAT or other functions performed on the internet edge gateway device (router/firewall).

Consider the concept of a large office building housing multiple departments of staff. You may have a security guard outside the building to direct people to other parts of the campus if they are lost or do not have permission to enter. This is the firewall.

Inside the building, for those who have permission to enter, they will find a reception desk where they will need to wait and be directed to the office where they will meet their intended party. This is the layer 3 switch 'behind' the firewall/router at the edge of the network. If the building is large enough or the destined office is large enough, there may even be an additional reception desk (layer 3 switch) at the offices on the second floor for a specific department, etc. There may also be secure departments where another security staff again qualifies visitors who were allowed into the building and directed to the destination office but fail additional qualification at the door to the more secure area. This is another firewall inside the LAN.

Each of those job roles in that imagined office building is performed by a separate person and though some of their roles seem very similar at a distant glance, they are quite different and have different responsibilities and requirements for their roles. One cannot know the job of the other, nor replace the other without abandoning their primary function. They do different but similar things to work as a team to accomplish the desired results.

1
1

the difference between layer 3 switches and routers

A layer-3 switch is a basic router that's generally hardware based. It is usually limited in regard to more advanced firewall functionality, stateful inspection, NAT, handling multiple protocols, tunneling, etc. which most devices sold under a "router" label feature.

If there's a NAT-capable gateway between WAN and a switch, why is a switch helpful?

A switch has nothing to do with NAT or plain routing. A switch simply provides you with more ports than you start with.

From the technical perspective, a switch forwards by MAC address (data link layer/L2) within a network = L2 segment. In contrast, a router forwards by IP address (network layer/L3) between multiple networks. Both methods are conceptually stateless, so a beefed-up L3 switch can also be used to route between networks.

A NAT/NAPT router forwards by IP address and possibly transport layer port/L4 between different routing domains, translating between them. A routing domain is the scope where a certain address range makes sense. Private IPv4 addresses don't make sense to the public Internet, so they need to be translated when connecting out (source NAT), or when a public-side request needs to be forwarded to a private host (destination NAT, reverse NAT, port forwarding). These translations require stateful tracking and matching, so it's very resource heavy on the router, and there's always a hard limit of current connections that a NAT router can manage.

how we are avoiding redundant work?

The best solution is to get the ISP connection with a public IP address and then NAT on your router. Double NAT is double bad, especially when you need duplicate port forwarding rules to expose your services to the Internet.

why we aren't overloading the switch to do all the lookup duties

NAT isn't anything that a common switch can do, you need a NAT router. And you need a firewall as well, naturally, which may be the same box. The NAT router vanishes with IPv6 but the firewall is still essential.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.