Hot answers tagged

17

EDITED I'm assuming you're considering using an IP block that is not registered to you. Otherwise, skip to the last paragraph. Besides being a very poor practice, if you use public addresses on your internal network, that means that you can never reach hosts that use those real addresses. You may think you'll never need to reach servers in some other part ...


14

It means that IP was designed for each endpoint only to maintain the state of the communications. NAT requires that the NAT device in the middle to maintain a state of the communications. IP was designed so that if something in the middle of that path changes, packets can be rerouted without any ill effect. If the path changes and misses the NAT device that ...


13

IPv6 does not have a NAT standard as IPv4 does (NAT breaks the end-to-end premise of IP, and IPv6 was designed to restore that). There is an experimental RFC for IPv6 NAT, but it is a one-to-one NAT at the network layer, rather than something like the IPv4 NAPT that also translates port addresses, and, in fact, the experimental IPv6 NAT RFC expressly forbids ...


9

One drawback is that the upper layers would need to be aware of IP addresses, which sort of violates the layering principle. What would then happen if you switched to IPv4? Or something else? How would the upper layers tell the network layer that it should start responding to an IP address? Suppose a new application starts up. How does the network layer ...


8

It is merely a necessity constraint and personal preference. If a Network is being built that would only have 10, or 20, or 50, or even 100 hosts, there is no reason not to use a /24 from 192.168.0.0/16. This is why home networks typically use the 192.168.0.0 range. If a Network is being built that would (in all growth projections) only have up to 1000 or ...


8

You state that TCP connections run fine once they get established. That makes a cause on the ISP's network unlikely: ISP routers are usually stateless, so they don't care for layers above the network (IP) layer, and (random) packet loss would impact all packets alike, during and after establishing a connection. More likely, your NAT router fails to ...


7

What it does is simplify your network administration, particularly for large high-traffic networks. Running dual stack means administering two seperate IP allocations for every network. Running IPv6 with NAT64 means running only one. Dual stack networks can be a pain to debug, it can cause a lot of confusion if one protocol is working, but the other is not. ...


6

The need for NATs as a way to share public IP adresses will be gone with IPv6, but NATs may still have some uses for security reasons. Removing ports might be possible in theory, but it would be a huge undertaking. Even if you reserve the last 16 bits of the IP adress for port number + 1 bit for TCP/UDP flag, you would need to rework all the software that ...


6

How does NAT ensure that every machine has a unique public IP? It does not. Your question is more complicated than you seem to imagine. The range from which public addresses are drawn is 1.0.0.0 to 223.255.255.255, but there are some blocks within that range that cannot be used for public addresses. IANA maintains the IANA IPv4 Special-Purpose Address ...


6

If I understand correctly you are performing NAT for your traffic going to the Internet on RTR1 and RTR2. If the NAT tables are not synched between those 2 routers, then if a NAT translation is performed on RTR1 for example, but the answer come through ISP2 to RTR2, then RTR2 doesn't have a NAT entry for this traffic and cannot forward it to the originating ...


5

(1) Implementations vary but the most common NAPT uses a source port from the router's pool, regardless of the original source port. Sometimes this can be overridden to use a specific source port (e.g. port 25 for SMTP). (2) DHCP isn't related to NAT. With direct DHCP, a discovery doesn't cross the router and, as a broadcast, isn't NATed either. With DHCP ...


5

End to end paradigm means that any host X with public IP a.b.c.d can directly connect to any host Y with public IP e.f.g.h (assuming IPv4 addressing, but the same thing applies to IPv6). The same must be true in both directions (X initiating connection to Y as well as Y initiating connection to X). This is how Internet used to work before we run out of IPv4 ...


4

It wouldn't be IPv6. Such a system is of course feasible, but it would be an variation of the IP protocol. Today, IP's contain two parts: a host identifier and a service identifier. With your scheme, it would essentially be a service descriptor. This would require changes to DNS (e.g. how do you differentiate between the SMTP server for example.com and the ...


4

(1) When a computer communicates out, does the NAT PAT Router use the original source port number of the sending computer (?) or (for whatever reasons) does the router replace the original source port with it's own port number (from a free pool etc?) while keeping track of the original and given port numbers in a table somewhere? PAT is the Cisco-...


4

End to end means that host A on one side of the Internet can talk directly to host B on the other side of the internet. So e.g. I can ssh into a box in the US from Europe without any special configuration on any of the devices in between. When NAT is involved this is most likely not the case, e.g because some manual configuration is required on the NAT ...


4

Without NAT, you can't use private IPv4 addresses in your network (with Internet connectivity). You'll need to get a sufficient IP address range from your ISP, at least one address for each device with Internet access. You'll still need a router but it could route public-to-public without any need of NAT. Note that this is the standard way to connect IPv6. ...


3

Those are just confusing names for the behavior of the NAT. Think of a cone more as a funnel, like you're making things combine into a smaller space as it funnels down. Full cone: 1-to-1 (full NAT) Restricted cone: Many-to-one (like a NAT for a subnet to all use the same public IP address) Port Restricted cone: The same as above, but also restricting to ...


3

Your actual question: Is it possible with NAT for 192.168.1.1 to ping 192.168.1.2, but for 10.1.1.1 to be actually pinged ? and your comment: i want a ping from the 192 network to ping the 10.1.1.1 address with a source address of the 10.0.0.0 network are two very different things. First, we must make sure that you understand what happens when ...


3

"The nat translation works fine, i can ping from the pc on the blue square to the primary router of the yellow square, and vice versa but i cannot ping beetween pcs." That would be correct because you are using NAPT. If you originate traffic from inside, say from a host in the blue box, the blue router through which the traffic passes will create a NAT ...


3

NAT happens on a device that can perform NAT, e.g. a router (even layer-3 switches cannot NAT, except for something like the 65xx series). The outside and inside addressing is placed on different interfaces of the NAT device. You will need to either put in a router on each VLAN between the router and hosts, or it may be that your hosts can themselves NAT ...


3

In that scenario, the load-balancing decision needs to be done before branching to either router - within the core switch or between R1/R2 and the core switch. Also, there's no way to share a NAT table between routers, especially when their public IPs differ. A more viable scenario is to connect both WAN links to each router and run the routers in a fail-...


3

For ping (ICMP echo request) to work across NAT, you'd have to forward ICMP (echo requests) from the public IP router to the private IP host (aka destination NAT or reverse NAT). For a normal TCP service you'd just use port forwarding (also DNAT or reverse NAT).


3

The only sane way to solve this problem is renumbering the network. However, in addition to the present answers, you could assign multiple IP addresses to the end nodes. That way, they keep the address you mustn't change but you simply use an additional, unique address for inter-subnet routing. Sadly, this rules out DHCP (unless you use multiple (virtual) ...


3

If you move your NAT to the Palo Alto unit(s), you wouldn't have any issues with NAT on the ISRs, and you'd just route traffic accordingly via access segments, with whatever routing method you choose and whatever route preference or prepending you choose, to prefer one path over the other.


3

If routes to the same destination end up with equal cost on the PA, it'll use ECMP to distribute traffic across both RTRs (depending on configuration), possibly using different public IPs for NAT. While this may work with some protocols (like UDP) it definitely won't with others (like TCP). TCP's SYN may go one way, and data segments the other - that can't ...


3

We can see that the router responds to arp requests for this IP. Disable proxy ARP on the router (no ip proxy-arp) so that the router does not answer ARP for devices on a different network. Proxy ARP is a security hole that should be disabled in any case. Cisco actually has a particular type of NAT designed for overlapping networks (outside source). See ...


3

Yes, you can certainly configure a Static PAT on a Cisco ASA. Typically this is done using AutoNAT: Within an object definition, this is the syntax you would use: nat (<REAL-INTF>, <MAPPED-INTF>) static <MAPPED-IP> [service <tcp|udp> <REAL-PORT> <MAPPED-PORT>] There is also a way to do it with Manual NAT syntax, but ...


2

I have studied from various sources that router is a layer 3 device There is a difference between the functionality of a router as-invisaged by those who write the standards, and the functionality of a commercial device that says "router" on the box. The former is a layer 3 device, the latter will often have functionality at other layers too. Exactly what ...


2

NAT can't work in that case as Ron has pointed out. In order to provide end-to-end connectivity for IPv4, a tunnel is required. The tunnel allows you to pass privately addressed packets over the Internet (encapsulated by publicly addressed packets) unchanged. An IPsec tunnel should be preferred as it also encrypts the tunneled traffic.


2

As Eddie has very well explained, there's not much difference in which range you use. One tiny difference there is though: since 192.168.0.0/16 is allocated from the former C-class range 192.0.0.0/3 many systems default the network mask to 255.255.255.0 or /24. Those same systems default a 172.16.0.0/12 subnet to B-class, /16, and and 10.0.0.0/8 subnet to /...


Only top voted, non community-wiki answers of a minimum length are eligible