| 9.2 |  | Network Address Translations |
| 9.2.1 |  | Understanding NAT |

| Connections versus Translations Translations refer to the translation of one IP address to another. Typically, this means that the IP address of a host on an inside network is assigned a new address when that host wishes to access resources on an outside network. It can also refer to an outside host being assigned a new IP address when it wishes to enter the inside network. As has been discussed, the PIX Security Appliance supports NAT . It does this for two primary reasons:

- NAT can help conserve a limited number of IP addresses that a company may possess. It can do this because all of the hosts on the inside network, which use private IP addresses, will probably not need to reach an outside network simultaneously. It is, therefore, possible for an administrator to allocate fewer public addresses than there are hosts on the inside network.
- NAT provides an additional layer of security, because it does not allow hosts on the outside network to see the IP addressing scheme of the inside network. This makes it more difficult for attackers to locate specific devices that the attacker may wish to compromise.

Connections refer to individual TCP or UDP sessions that have been established across a network or networks. Connections occur at Layer 4 and are actually a subset of translations. Connections will be discussed in much greater detail later in this module.

Translation Types
The PIX Security Appliance supports the following four types of NATs :

1. Dynamic inside network address translation NAT - Translates host addresses on more secure interfaces to a range or pool of IP addresses on a less secure interface. This allows internal users to share registered IP addresses and hides internal addresses from view on the public Internet.
2. Static inside NAT - Provides a permanent, one-to-one mapping between an IP address on a more secure interface and an IP address on a less secure interface. This allows hosts to access the inside host from the public Internet without exposing the actual IP address.
3. Dynamic outside NAT - Translates host addresses on less secure interfaces to a range or pool of IP addresses on a more secure interface. This is most useful for controlling the addresses that appear on inside interfaces of the PIX Security Appliance and for connecting private networks with overlapping addresses.
4. Static outside NAT - Provides a permanent, one-to-one mapping between an IP address on a less secure interface and an IP address on a more secure interface.

Each of these types of translations will now be examined.