TCP/IP Tutorial and Technical Overview - IBM Redbooks

packet, the destination address is checked if it is used by NAT. When this is true,
the address is translated to the original internal address. Figure 3-13 shows the
Basic NAT configuration.
To be translated
Exclude
Figure 3-13 Basic NAT configuration
When Basic NAT translates an address for an IP packet, the checksum is also
adjusted. For FTP packets, the task is even more difficult, because the packets
can contain addresses in the data of the packet. For example, the FTP PORT
command contains an IP address in ASCII. These addresses should also be
translated correctly; checksum updates and TCP sequence and
acknowledgement updates should also be made accordingly.
In order to make the routing tables work, the IP network design needs to choose
addresses as though connecting two or more IP networks or subnets through a
router. The NAT IP addresses need to come from separate networks or subnets,
and the addresses need to be unambiguous with respect to other networks or
subnets in the non-secure network. If the external network is the Internet, the
NAT addresses need to come from a public network or subnet; in other words,
the NAT addresses need to be assigned by IANA.
The assigned addresses need to be reserved in a pool in order to use them when
needed. If connections are established from the internal network, NAT can just
pick the next free public address in the NAT pool and assign that to the
requesting internal host. The NAT service keeps track of which internal IP
addresses are mapped to which external IP addresses at any given point in time,
so it will be able to map a response it receives from the external network into the
corresponding secure IP address.
92 TCP/IP Tutorial and Technical Overview
N
A
Map
T Exclude
Reserve
Pool
Secure network Firewall
Non-secure network