| 8.2 |  | The Cisco PIX Security Appliance |
| 8.2.6 |  | Network Address Translation (NAT) |

| Firewalls, like routers, have the capability to support Network Address Translation (NAT). While NAT was discussed in the first half of this course, a quick review of the technology and how the PIX Security Appliance implements it is beneficial. NAT enables the network administrators to keep internal IP addresses, which are behind the PIX Security Appliance, undisclosed to external networks. NAT accomplishes this by translating the internal IP addresses, which are not globally unique, into globally accepted IP addresses before packets are forwarded to the external network. NAT is implemented in the PIX Security Appliance with the nat and global commands.

When an outbound IP packet that is sent from a device on the inside network reaches a PIX Security Appliance with NAT configured, the source address is extracted and compared to an internal table of existing translations. If the device address is in the table, the packet is marked with the translated address and allowed to proceed to its destination.

If the device address is not already in the table, NAT performs a translation. A new entry is created for that device, and the device is assigned an IP address from a pool of global IP addresses. This global pool is configured with the global command. After this translation occurs, the table is updated and the translated IP packet is forwarded. After a user-configurable timeout period or the default timeout of two minutes, during which there have been no translated packets for that particular IP address, the entry is removed from the table. Then another inside device frees the global address for use.

In Figure , host 10.0.0.11 starts an outbound connection. The PIX Security Appliance translates the source address to 192.168.0.20, so that packets from host 10.0.0.11 are seen on the outside as having a source address of 192.168.0.20. In this example, the 192.168.0.20 network represents a globally unique address.