- [Instructor] In this video,
we want to consider network address translation
or NAT for short.
What network address translation can do for us
is take an address on, what we're going to call
the inside of our network,
and translate it into a different IP address
on the outside of our network.
Consider this topology,
we have a couple of clients on the inside of our network,
notice that they're using private IP addresses,
RFC1918 addresses, and we want to go out
to that web server on the outside, out on the Internet.
When we're configuring NAT, we need to configure
which interface or interfaces
represent the inside of the network
and which interface or interfaces
represent the outside of the network.
In this case, we're going to tell router R1
that gigabit zero slash one, that's the inside interface.
And gigabit zero slash two, that's the outside interface.
And when we're sending traffic to that web server
from, let's say, client one,
the source IP address is client one's IP address,
that private IP address of 10.1.1.1,
and the destination, of course, is the web server
at 203.0.113.100.
Now, with NAT, when we get to the router
that's performing NAT,
we can translate this inside address into an outside address
an address that is routable over the public Internet.
Now sometimes we just have one IP address.
In fact that's typically what we have.
If we have, let's say, a cable modem
from our service provider,
they might give us one publicly-routable IP address
that we all have to share on the inside of the network.
However, sometimes we might have the luxury
of having multiple IP addresses into which we can translate
our inside, that private addresses.
Let's say that we do have this pool of addresses assigned,
let's say we've got these 99 addresses in this pool,
and we're going to pick one.
Router R1 is going to translate 10.1.1.1 into 192.0.2.101.
That's a public IP address and we send it
onto the web server.
Let's say that client two also wants to go
to that very same web server,
same thing's going to happen,
it sends the packet to R1, R1 translates that inside address
into this publicly-routable address of 192.0.2.102,
it's a different address from that same pool,
and it goes to the web server.
Now at this point we need to define some terminology.
These different addresses that we're throwing around here
have very specific names.
We have, for example, inside local addresses,
inside global addresses, outside local,
outside global addresses, let's talk about these.
First of all, consider that 10.1.1.1 address
assigned to client one.
That's considered to be an inside local address.
Let's walk through why that is an inside local address.
First, we're asking what device
is this IP address referring to?
Is it referring to a device on the inside of our network
or is it referring to a device
on the outside of our network?
Well it's referring to client one,
that's clearly on the inside of our network
so it's some sort of inside address.
But now, we're going to ask is it a locally-significant address
or is it a globally-routable address?
Well 10.1.1.1, that's only going to be usable
inside of our network
so that's going to be a local address.
We combine those two, it's inside of our network
and it's a locally-significant address.
That means 10.1.1.1, that's an inside local address.
We're converting that or we're translating that
into 192.0.2.101, that's going to be an inside global address.
It's inside because it's still referring to client one.
It's referring to a device on the inside of our network.
But now, this is a globally-routable address,
so it's an inside global address.
What about the web server, though, at 203.0.113.100?
Well, it's a device on the outside of our network
and it is a globally-routable address.
So the web server's address would be
an outside global address.
Now we don't have an example on screen
of an outside local address.
You'll probably never need to deal
with an outside local address.
What that means is we're talking about an address
on the outside of our network
that has a locally-significant address.
We might run into this if we have
a couple of corporate sites separated by the Internet
and we want to get to a private IP address,
inside our company but we have to across the Internet
or some WAN provider to get there.
Well that would be a locally-significant address
but it would be outside of our network,
outside of our local network.
That would be an outside local address
and you've got to do some DNS entries to make that work.
It's not something that you commonly see.
I primarily want you to understand the distinction
between an inside local, an inside global,
and an outside global address.
Now this is the way NAT is traditionally thought of.
We've got these inside local addresses
translated into inside global addresses
pointing to an outside global address.
But this assumes that we've got the luxury
of a pool of addresses.
And as we mentioned a few moments ago,
that's often not the case.
Often times, in fact, I would say usually,
we have to share a single IP address
amongst all the members of our local network.
We could do that using something called a PAT,
or port address translation.
Here, same topology but we've only got a single IP address
that is publicly routable that we can use.
It's that address assigned to gigabit zero slash two,
192.0.2.100.
What happens now when client one
wants to go to the web server?
Well, it's still going to use the same inside local address
of 10.1.1.1, we're still going to 203.1.113.100,
but notice, when we're sending traffic to a web server,
if it's http and not https,
the default TCP port is port 80.
That's our destination port number.
But, in order to have a conversation
with another device on the network
we have to pick a number.
We pick one of those dynamic port numbers like 41,025,
here's what's been picked by client one,
what's going to happen is, router R1 is going to make a note
of that source port number
and it could keep the same source port number
or it might use a different source port number
and send the traffic onto the web server in this case.
And it can use that port number
as an identifier of the source.
When the return traffic comes back in from the web server,
which client do we send it to?
The web server's sending traffic back in to 192.0.2.100,
but from there, where does it go?
Both clients got translated into that inside global address.
Well the way the router is going to know
where to forward that packet inside of our network
is based on the port number
as the traffic is coming back in from the web server.
Notice that these two clients have different port numbers
as they go to the web server
and our router is making note of that.
Now, back to a point I hinted at earlier.
I said that we might keep the same port number,
typically we do, but I showed you
a different port number here to make the point
that the router can assign a different port number.
Because, think about client one and client two,
if they both pick the same dynamic port number,
I mean they're not going to consult one another
about, Hey, what dynamic port number are you using?
No, if they pick the same dynamic port number,
R1 would catch that and it would give them
distinct port numbers.
So I'm showing you that they could be different,
but typically if there's not an overlap,
the router performing the address translation
will keep the same port number.
So this time, when we take a look
at R1's NAT translation table,
notice that the inside global address is the same
plus we have a port number associated
with each session going on.
And, one session is going on with client one
and the other session's going on with client two.
And another type of NAT, we don't typically call it NAT
but it really is a NAT configuration that's often used
is port mapping.
Sometimes you've got a small office, home office environment
and you want people to come in from the Internet
to get to a service at your site.
Let's say that we've got some sort of a Linux server
at our site that we want to be accessible via Telnet.
And inside of our network
that server has an IP address of 10.1.1.2,
it's a private IP address.
But what we can do is take that one address
that our router has, 192.0.2.100,
and we can set up a port mapping which says,
if traffic is coming into that IP address
and it's destined for port 23, the Telnet port,
then I know the outside person is trying
to get to my Telnet server,
and I'll redirect that to 10.1.1.2
which is server one on port 23.
That's called port mapping
and when you configure it,
even though we don't typically call it NAT,
it really is a static NAT configuration.
And static NAT, by the way, is where we say
this IP address is always going to be mapped
to this other IP address
and we can add on port number information as well.
In fact, in our next video,
let's take a look at a static NAT configuration.