Understanding the network.pdf - Back to Home

NAT's Shortcomings
Although NAT is useful, it is not without shortcomings, the largest of which is the
fact that NAT is CPU intensive. If you are planning to deploy NAT on any sizable scale
(a pool of 128 addresses or more), you will want to use a 36×0 series or higher
router to minimize any user-perceivable performance decrease. In terms of actual
deployment, if possible do not run NAT on your gateway router. In most cases, the
gateway router is performing security filtering and other CPU-intensive tasks.
Adding the additional NAT processing will only decrease the gateway's performance.
Use a separate router to provide NAT services, and it will dedicate that router's CPU
to a single task and make NAT/performance-related troubleshooting easier and
much less intrusive. It also provides you with the capability to do some additional
filtering (which is needed if you use NAT as part of a router-based firewall solution).
Not all IP-based applications behave well with NAT, particularly those that are
dependent on hostname/IP address verification and third-party authentication,
such as Kerberos and AFS. NAT also has trouble with certain ISO load sharing and
queuing schemes, depending on the IOS version the router is using (11.0 releases
are prone to this problem). Most IP applications behave just fine, however, though
it is always wise to test all your application requirements before you deploy.
Cisco Tunneling
The tunnel interface is a virtual point-to-point link tied to a physical source interface.
That is to say, there is a virtual interface that corresponds to a logical interface, and
between two interfaces of this type, traffic is wrapped and delivered across a
public/private internetwork as if it were a point-to-point link. The tunnel interface
has three components:
• The passenger protocol—The network protocol you are sending over the
tunnel, such as AppleTalk, IP, and so on.
• The carrier protocol—The protocol that encapsulates the data. Generic Route
Encapsulation (GRE) is the most commonly used protocol and is needed if
multiple protocols are being handled. Cisco also supports Cayman (for
AppleTalk over IP), EON (for CLNP over IP), and NOS.
• The transport protocol—This is IP (Internet Protocol), which handles the
delivery of the data between the physical links tied to the tunnels.
The disadvantage of tunneling is performance. The encapsulation and
de-encapsulation of the LAN protocols is time consuming, and processor and
memory intensive. With Cisco IOS 11.1, GRE tunneling is supported on all Cisco
1600 and IP routers. Tunneling's greatest advantage is that it allows multiprotocol
virtual private networks to be connected with a single access protocol, which (if