network protocols handbook.pdf

27Protocols GuideTCP/IP - Application Layer ProtocolsProtocol NameNAT: Network Address TranslationProtocol DescriptionBasic Network Address Translation (Basic NAT) is a methodby which IP addresses are mapped from one group to another,transparent to end users. Network Address Port Translation, orNAPT, is a method by which many network addresses and theirTCP/UDP ports are translated into a single network address andits TCP/UDP ports. Together, these two operations, referred toas traditional NAT, provide a mechanism to connect a realm withprivate addresses to an external realm with globally unique registeredaddresses.The need for IP Address translation arises when a network’sinternal IP addresses cannot be used outside the network eitherfor privacy reasons or because they are invalid for use outsidethe network. Network topology outside a local domain canchange in many ways. Customers may change providers, companybackbones may be reorganized, or providers may mergeor split. Whenever external topology changes with time, addressassignment for nodes within the local domain must also changeto reflect the external changes. Changes of this type can behidden from users within the domain by centralizing changes toa single address translation router. Basic Address Translationallows hosts in a private network to transparently access theexternal network and enable access to selected local hosts fromthe outside. Organizations with a network setup predominantlyfor internal use and with a need for occasional external accessare good candidates for this scheme.There are limitations to using the translation method. It is mandatorythat all requests and responses pertaining to a sessionbe routed via the same NAT router. One way to ascertain thiswould be to have NAT based on a border router that is uniqueto a stub domain, where all IP packets either originated from thedomain or are destined for the domain. There are other ways toensure this with multiple NAT devices.The NAT solution has the disadvantage of taking away the endto-endsignificance of an IP address, and making up for this withan increased state in the network. As a result, with a NAT deviceenroute, end-to-end IP network level security assured by IPSeccannot be assumed to apply to end hosts. The advantage of thisapproach, however, is that it can be installed without changesto hosts or routers.Protocol StructureNAT is a procedure, not a structured protocol.Related protocolsIP, IPv6, TCP, UDP, NATPSponsor SourceNAT is defined by IETF (http://www.ietf.org) in RFC 3022.Referencehttp://www.javvin.com/protocol/rfc3022.pdfTraditional IP Network Address Translator (Traditional NAT)