| 2.3 |  | Securing the Perimeter Router |
| 2.3.2 |  | Network Address Translation (NAT) |

| Network Address Translation (NAT) allows a single device, such as a router, to act as an agent between the Internet or public network and a local or private network. In a secure network, it is important that internal network IP addresses remain hidden from the outside so that potential attackers are not able to gain an understanding of the network topology and design. NAT can hide these addresses, which makes it more difficult for a potential attacker to gain an understanding of the network architecture, and to subsequently exploit it. NAT terminology is defined in Figure .

NAT provides additional perimeter security, as shown in Figures - . Its advantages are as follows:

- NAT hides the IP addresses used in the internal network from people on the outside.
- NAT maintains a table of translated IP addresses. To the outside world, the network appears to have a certain IP address range. Addresses in this range are mapped into the actual addresses used within the network. When a packet comes into the router from the Internet, the IP address is translated and the packet goes to the correct destination. Likewise, outgoing messages are given the public IP addresses. The real IP addresses are hidden.

In addition to hiding internal IP addresses, NAT also provides the following benefits:

- NAT makes it possible to connect the LAN to the Internet without worrying about Internet address limitations. In this way, NAT extends the IP address space. It is also not necessary to worry about duplicate addresses.
- NAT makes it possible to have unregistered IP users on the LAN connect to the Internet.

Static NAT
One of the main features of NAT is static NAT. Static NAT is designed to allow one-on-one mapping between global and local addresses. A common use for static NAT is to allow Internet users to access a Web server located in the private network.
PAT
One of the main features of NAT is Port Address Translation (PAT), which is also referred to as overload in Cisco IOS configurations - . With PAT enabled, the firewall chooses a unique port number for each outbound connection, thereby permitting many connections to use a single IP address.

Although less flexible than NAT, PAT provides much of the same IP address functionality. Additionally, PAT provides for IP address expansion and offers the following benefits:

- With PAT, one IP address can serve up to 64,000 hosts theoretically, and 4000 hosts practically.
- PAT makes economical use of IP addresses and physical connections.
- PAT re-maps different IP port numbers to a single IP address.
- PAT hides the source address of clients by using a single IP address from the perimeter router. Address pool density affects performance.

The user can conserve addresses in the global address pool by allowing source ports in TCP connections or User Datagram Protocol (UDP) conversations to be translated. Different local addresses then will map to the same global address, with port translation providing the necessary uniqueness. When translation is required, the new port number is picked out of the same range as the original, following the convention of Berkeley Standard Distribution (BSD):

- 0-->511
- 512--->1023
- 1024-->4999
- 5000--->65,535

This is a 16-bit field representing about 64,000 connections that translate into roughly 4000 local addresses that can be mapped to the same global address. This is because many connections require more than one port. PAT is not recommended when running multimedia applications through the router. Multimedia applications need access to specific ports, and can conflict with port mappings provided by PAT. Static translations can help solve this problem in some cases. However, this creates small security holes, allowing traffic to pass from outside to inside without an established connection.

| Lab Activity Lab Exercise: Configuring NAT/PAT In this lab, the student will use NAT and PAT to hide internal addresses.