163
The IPv4 Address Shortage
According to Vint Cerf (the father of IP), the IPv4 32-bit address size of was chosen arbitrarily. IP was a government/academic collaborative experiment, and the current public Internet was never envisioned. The IP paradigm was that each connected device would have a unique IP address (all packets sent between IP devices would be ...
33
Ron Maupin's answer gives a brilliant overview of the IPv4 shortage, but I'd like to address this part of your question:
Why can't a city (for example) have just one IP address and all homes in this city would just be on a private network of that city. Then this one city would be able to assign addresses from range 0.0.0.1 to 255.255.255.254.
On the face ...
18
CEF is Cisco's word for their FIB. When in L3 switch you do 'sh ip cef', none of this information is actually used to push the packets at all, this is just software trie which is used to populate the hardware ASIC.
CEF is just term Cisco uses to describe their optimize data storage/retrieval code, it is not specific technology with specific function.
In ...
17
The 100.64.0.0/10 address block is not private address space; it is shared address space. This is spelled out in RFC 6598, IANA-Reserved IPv4 Prefix for Shared Address Space (I highlighted the relevant verbiage):
Introduction
IPv4 address space is nearly exhausted. However, ISPs must
continue to support IPv4 growth until IPv6 is fully deployed. ...
17
As long as you are translating your "15.0.0.0" address space to something unique on the Internet that doesn't overlap, things will "work fine".
However, you won't be able to communicate (easily) to any users who own "the real" 15.0.0.0/8. At the moment some of that space seems to be owned by HP:
$ whois 15.0.0.1
[Querying whois.arin.net]
[whois.arin.net]
...
17
EDITED
I'm assuming you're considering using an IP block that is not registered to you. Otherwise, skip to the last paragraph.
Besides being a very poor practice, if you use public addresses on your internal network, that means that you can never reach hosts that use those real addresses. You may think you'll never need to reach servers in some other part ...
16
Let's say we have a STUN server at address stun_addr and a server at address srv_addr. Using STUN typically goes something like this:
Client connects to the STUN server at stun_addr through NAT device. The NAT device translates the source address to natted_addr_1
STUN server tells client the address from which it received the connection, which is ...
15
Strictly speaking, when performing (pure) NAT, only IP addresses are translated, and every internal IP address has to be translated to a different external IP address. This can be a static one-on-one mapping in the case of static NAT, or a dynamic mapping with a pool of public addresses.
With dynamic NAT, the router selects one IP address from the NAT pool ...
15
Right now, every home has its own IP address. Why can't a city (for example) have just one IP address and all homes in this city would just be on a private network of that city?
Exactly this is already done by many internet service providers since the end of the 1990s.
In the 1990s there were different reasons (not the IPv4 shortage) for doing this. ...
14
(For the following I will ignore any DNS lookups or layer two action, since that isn't the relevant part for the NAT story.)
Any TCP connection is a tuple of four parts:
<source IP> <source port> <destination IP> <destination port>
In short: the destination IP is used to get the packet to the correct machine, the destination port ...
14
IPv6 does not have a NAT standard as IPv4 does (NAT breaks the end-to-end premise of IP, and IPv6 was designed to restore that). There is an experimental RFC for IPv6 NAT, but it is a one-to-one NAT at the network layer, rather than something like the IPv4 NAPT that also translates port addresses, and, in fact, the experimental IPv6 NAT RFC expressly forbids ...
14
It means that IP was designed for each endpoint only to maintain the state of the communications. NAT requires that the NAT device in the middle to maintain a state of the communications.
IP was designed so that if something in the middle of that path changes, packets can be rerouted without any ill effect. If the path changes and misses the NAT device that ...
13
Details vary but basically it goes something like.
The two peers both open a UDP socket bound to a random local port
The two peers both contact a server on the internet. This server responds and tells them what IP and port their packet was received from. Since the server is on the Internet the IP/port seen by the server is the external IP and port
The two ...
12
Yes, you're missing something. And yes, "something fancy" is going on. The router's NAT state table will map the inside-outside translation for the traceroute probe. (UDP normally) As is required for ICMP to work through any firewall, an ICMP error message will be allowed as part of an established flow. The "fancy" part is the fact the ICMP error carries ...
12
Before NAT every device connected to the internet had its own IP address. That was how the internet was designed. This gives you great flexibility and visibility. If you have a firewall then it can filter traffic for each address, protocol, port etc individually if you want. Because the source address and port (if applicable, not all protocols have ports) ...
12
You must remember that a flow using NAT will look like two different flows: a flow pre-NAT, and a flow post-NAT. This is because NAT is changing one or more of the addresses in the packets. This can present a distorted view of your flows.
As Cisco explains it, NAT stitching will stitch the (apparently) separate flows to give you the single flow view:
...
12
You don't have NAT enabled (you don't have ip nat outside on Vl 20).
Without NAT, the ISP doesn't know how to route back to your 192.9.200.0 network. If you NAT to the VLan 20 address, the ISP will be able to route back to you.
11
NAT works at layer 3 because it is modifying the IP header. If you use PAT you could argue that it is working at layer 4 as well because it MIGHT change the source port of the packet in case it is not unique.
Several internal addresses can be NATed to only one or a few external
addresses by using a feature called Port Address Translation (PAT)
which is also ...
11
Usually NAT will be used to translate between private to public IP address but this is not the only use case. You can also translate between any addresses you want such as private to private.
The terms local and global most often refer to the inside and outside of your network but this doesn't mean that it MUST be LAN and WAN although it often is.
So say ...
11
This depends on exactly how the ISP provides them to you. You may have "4 DHCP addresses", a "routed" /30, or a "connected" /29.
For example, Time Warner Cable (business class) allows 4 devices to use DHCP to get an address. (similar to residential service that's limited to one)
"routed" is what you'd see where you have a WAN side and LAN side. This is ...
11
First: What you describe is NAT, not firewalling. A firewall just filters what can go through, a NAT device changes addresses in packets.
You almost answer the first question yourself. Yes, a NAT device needs to keep track of every session going through it. Most communication on the internet uses TCP or UDP. Both of these protocols use port numbers. A ...
11
There is a general misconception between NAT (Network address translation) and PAT (Port Address Translation), which is what we mostly use in our home routers.
NAT
Let's assume we have a network with the following topology:
Private_Network <-------> Router <-------> The_Internet
The interface of the Router that is connected to the Private_Network ...
11
Any network addresses you use in your own company that are in use or assigned to a different company on the public Internet will be inaccessible to your users trying to reach those addresses on the public Internet, and you will not be able to advertise to the public Internet any addresses assigned to a different company.
There are three ranges of private ...
10
A PC in a private IP range can't be acccesed from the public internet.
Devices in private range connecting to internet use a proxy or router/NAT device that replaces the local source IP for a single public IP address that redides in your router/NAT.
However, you can make an exception to that, opening a port in the router and allowing that traffic directed ...
10
First, I'm assuming you're focused on TCP. UDP has some differences, and I'm not as up-to-speed on that part.
I’m beginning to learn about nat and I was wondering why does NAT
translate a source port?
You're right to ask this question, and to be frank, it doesn't always need to. However, sometimes that translation IS required. Given that it is ...
10
Network address translation (NAT) is a feature of Router which is
required for routing traffic.
That is completely incorrect. NAT is a kludge (a clumsy, inefficient solution) designed to extend the life of IPv4 addressing until IPv6 is ubiquitous. NAT breaks the IP paradigm of end-to-end connectivity, and many things have problems with NAT. Routing works ...
9
Does this mean CEF isn't used by edge routers and edge L3 switches? Is CEF's usefulness limited to the LAN?
CEF is useful because it permits a router to quickly rewrite the Layer2 information during Layer3 forwarding operations. WAN routers must rewrite Layer2 header information just like LAN switches do... CEF is extremely useful to both types of router.
...
9
(EDIT)
It seems that inside->outside works as expected, as seen in the answer below, but outside->inside actually does not, it allows everything, as OP suggested.
Adding 'reversible' in the NAT line it starts to honor the route-map for outside->inside, unfortunately it does not seem to work with ports:
permit ip any host 194.100.7.226 works
permit tcp any ...
9
Are you absolutely positive that all 60 devices need to have their own public WAN IP address?
The ISP is giving you the globally reachable IP addresses for internet connectivity. You can have well over 100 devices use just 1 WAN IP from your ISP. Using NAT (network address translation) the 60 (Inside - 192.168.1.x /24) devices can share the 1 WAN (outside) ...
Only top voted, non community-wiki answers of a minimum length are eligible
