| 9.5 |  | Port Address Translation (PAT) |
| 9.5.1 |  | PAT for the PIX Security Appliance |

| PAT overview PAT was introduced in the first half of this course in conjunction with perimeter router security. To review, PAT is a translation method, like NAT, that allows network administrators to hide the inside network addressing scheme from outside hosts and allows for the conservation of IP addresses. However, unlike NAT, which leases IP addresses to inside hosts on a one-to-one basis, PAT is able to go a step further and allow numerous inside hosts to use a single IP address. This process is called overloading. It does this by allowing individual source ports in TCP connections or UDP conversations to be translated. This means that a single IP address can be used by numerous inside hosts, each of which has been assigned a unique port number.

One important thing to remember is that while PAT allows for greater conservation of IP addressing space than NAT, it is not easily compatible with a number of common applications. This is particularly true in multimedia applications, which may use random port numbers for communication. Therefore, network administrators must decide which translation method is appropriate, given the particular needs of their network.

PIX Security Appliance support of PAT
PAT is supported by the PIX Security Appliance and provides an alternative to NAT when an administrator wishes to allow connections through the PIX. PAT is a combination of an IP address and a source port number, which creates a unique session. PAT uses the same IP address for all packets but a different unique source port greater than 1024. PAT provides the following advantages to the PIX:

- PAT and NAT can be used together.
- A PAT address can be a virtual address, different from the outside address. Do not use PAT when running multimedia applications through the PIX Security Appliance.
- PAT provides for IP address expansion.
- One outside IP address is used for approximately 4000 inside hosts, which is the practical limit. The theoretical limit is greater than 64,000.
- PAT maps port numbers to a single IP address.
- PAT provides security by hiding the inside source address by using a single IP address from the PIX Security Appliance.

Figure illustrates two clients that are requesting connectivity to the Internet. The PIX Security Appliance checks security rules to verify the security levels, and then replaces the source IP address with the PAT IP address. To maintain accountability, the source port address is changed to a unique number greater than 1024.

The PIX Security Appliance PAT feature expands a company address pool as shown in Figure . This is covered in detail in the Online Command Reference.