How to configure NAT

When you configure a router to use NAT, you configure one interface to the inside of your network and another to the outside of your network. Any packets that have a source address belonging to the "inside" portion of your network have an inside local address as the source address and an outside local address as the destination address. The packet resides on the "inside" portion of your network. When that same packet gets switched to the "outside" network, the packet's source is known as the inside global address, and the packet's destination is known as the outside global address.

For any packet that has a source address belonging to the "outside" portion of your network, while it is on the "outside" network, its source address is known as the outside global address. The packet's destination is known as the inside global address. When the same packet gets switched to the "inside" of your network, the source address is known as the outside local address, and the packet's destination is known as the inside local address.

• Inside local address An IP address that is assigned to a host on your inside network.

• Inside global address A legitimate IP address that represents one or more of your inside local IP addresses to the outside world.

• Outside local address An IP address of an outside host as it appears to your inside network.

• Outside global address An IP address assigned to a host on the outside network by the owner of the host that is allocated from the globally routable address or network space.

A typical NAT implementation has NAT configured on the exit router between a stub domain and backbone, such as the Internet. When a packet leaves your domain, NAT translates the locally significant source address into a globally unique address and records it to memory. If the return packet matches what NAT has recorded, the packet is allowed back into the network. Otherwise, when a packet enters your domain, NAT translates the globally unique destination address into a local address if it's configured. Remember, if your domain has more than one exit point, each NAT process must have the same translation table to ensure proper translation. If NAT runs out of available addresses, the packet is dropped, and an ICMP host unreachable message is returned to the packet's originator.

When using PAT, in which several internal addresses are translated to only one or a few external addresses, additional translations of the packet are performed. Because each internal address may be translated to a single external address, PAT translates each packet's source port to a unique source port number, a 16-bit number or 65,536 ports per IP address, on the inside global IP address. This distinguishes them from other packets that are being translated. PAT tries to preserve the original source port. However, if the source port is already used in a translation, PAT attempts to find the first available port number, starting from the beginning of the appropriate port group0 to 511, 512 to 1023, or 1024 to 65535. If PAT cannot allocate another port number from the appropriate group, and you configured more than one IP address, PAT moves to the next IP address and tries to allocate the original source port again. This process continues until PAT runs out of available IP addresses and ports.

When your router is configured to use NAT, it must not advertise local networks to the outside. However, routing information that NAT receives from the outside may still be advertised in the stub domain as usual