TCP/IP Tutorial and Technical Overview - IBM Redbooks

NAT is compute intensive even with the assistance of a sophisticated checksum
adjustment algorithm, because each data packet is subject to NAT lookup and
modifications.
It is mandatory that all requests and responses pertaining to a session be routed
through the same router that is running the NAT service.
Translation of outbound TCP/UDP fragments (that is, those originating from
private hosts) in a NAPT setup will not work (refer to “Fragmentation” on
page 104). This is because only the first fragment contains the TCP/UDP header
that is necessary to associate the packet to a session for translation purposes.
Subsequent fragments do not contain TCP/UDP port information, but simply
carry the same fragmentation identifier specified in the first fragment. When the
target host receives the two unrelated datagrams, carrying the same
fragmentation ID and from the same assigned host address, it is unable to
determine to which of the two sessions the datagrams belong. Consequently,
both sessions will be corrupted.
NAT changes some of the address information in an IP packet. This becomes an
issue when IPSec is used. Refer to 22.4, “IP Security Architecture (IPSec)” on
page 809 and 22.10, “Virtual private networks (VPNs) overview” on page 861.
When end-to-end IPSec authentication is used, a packet whose address has
been changed will always fail its integrity check under the Authentication Header
protocol, because any change to any bit in the datagram will invalidate the
integrity check value that was generated by the source. Because IPSec protocols
offer some solutions to the addressing issues that were previously handled by
NAT, there is no need for NAT when all hosts that compose a given virtual
private network use globally unique (public) IP addresses. Address hiding can be
achieved by the IPSec tunnel mode. If a company uses private addresses within
its intranet, the IPSec tunnel mode can keep them from ever appearing in
cleartext from in the public Internet, which eliminates the need for NAT.
3.1.8 Classless Inter-Domain Routing (CIDR)
Standard IP routing understands only Class A, B, and C network addresses.
Within each of these networks, subnetting can be used to provide better
granularity. However, there is no way to specify that multiple Class C networks
are related. The result of this is termed the routing table explosion problem: A
Class B network of 3000 hosts requires one routing table entry at each backbone
router. The same environment, if addressed as a range of Class C networks,
requires 16 entries.
The solution to this problem is called Classless Inter-Domain Routing (CIDR).
CIDR is described in RFCs 1518 to 1520. CIDR does not route according to the
Chapter 3. Internetworking protocols 95