2212 6-28nat

2212 1232_05_2000_c2
2000, Cisco Systems, Inc.
11
Deploying Network Address Translation

Session 2212
2212 1232_05_2000_c2
AgendaTerminology
Terminology Rehash Requirements (Hardware/Software) Considerations Configuration/Basic to Real World Examples Troubleshooting
2212 1232_05_2000_c2
TerminologyInside
ZONE Inside: Intranet/Private Address
Your companys network Typically a RFC 1918 network Local address is the real IP address of the host Not routable on the Internet
2212 1232_05_2000_c2
TerminologyOutside
ZONE Outside: Internet/Public Address
Everyone elses network Registered addresses only Global address is the virtual IP address of the inside host Is routable on the Internet
2212 1232_05_2000_c2
TerminologyStatic
Commonly used for inbound traffic Permanent Local address is always known by the same global address
2212 1232_05_2000_c2
TerminologyDynamic
Typically used for outbound (inside -> outside) traffic Short lived Local address might not always be known by the same global address
2212 1232_05_2000_c2
TerminologyNAT
Network Address Translation Layer 3 Maps one internal (local) address to one external (global) address
2212 1232_05_2000_c2
TerminologyPAT
Port Address Translation Layer 3 and 4 Similar to NAT, except it maps multiple internal (local) addresses to one external (global) address
2212 1232_05_2000_c2
AgendaRequirements
2212 1232_05_2000_c2
10
RequirementsSoftware
11.2IP plus only 11.3PAT: General availability 11.3NAT: IP plus 12.xFull NAT/PAT
2212 1232_05_2000_c2
11
RequirementsHardware
Most platforms Each translation = 160 bytes 10,000 translation = 1.6 megabytes Performance/latency is negligible
2212 1232_05_2000_c2
12
AgendaConsiderations
2212 1232_05_2000_c2
13
ConsiderationsApplications
Know Your Applications
Application Layer: Embedded IP information in the payload Transport/Network Layer: PAT/NAT compliant
2212 1232_05_2000_c2
14
ConsiderationsEmbedded IP
IP HDR : Src IP = 10.1.1.1
DATA : IP = 10.1.1.1
Inside Address Translation Outside

IP HDR : Src IP = x.x.x.x DATA : IP = 10.1.1.1
2212 1232_05_2000_c2
15
ConsiderationsIPSec-ESP
Encapsulating Security Payload (ESP): Tunnel Mode Only

NAT
Original Packet
IP HDR DATA
WORKS !
DATA Encrypted Authenticated
New IP HDR IPSec HDR IP HDR Layer 3
2212 1232_05_2000_c2
16
ConsiderationsIPSec-AH
Authentication Headers (AH) Transport Mode
Authenticated HDR + DATA = Checksum IP HDR DATA
Breaks!
NAT IP HDR Layer 3
2212 1232_05_2000_c2
IPSec HDR Checksum Stored
DATA
17
ConsiderationsAccess-Lists Inbound
Inside
NAT
Outside
Packet Flow
Routing Outbound ACL

*Only if the Packet is encrypted
2212 1232_05_2000_c2
Inbound ACL NAT
Inbound ACL*
Decryption
18
ConsiderationsAccess-Lists Outbound
Inside
NAT
Outside
Packet Flow
Inbound ACL
Routing NAT
Encryption Outbound ACL

19
Policy Routing
2212 1232_05_2000_c2
FTPActive
Server initiated Data Connections Client tells the server on which Port to send to the Client
SYN SYN and ACK ACK Inside Network Outside Network
NAT
Port Command <Address and Port> ACK SYN SYN and ACK ACK Data Flows Server to Client Control Connection TCP Connection 1 : Active Mode: LS Set TCP Connection 2 : Active Mode: Data
2212 1232_05_2000_c2
Translate Embedded AddressReserve Source Port, IF PAT is to be used
20
FTPPassive
Client initiates data connections Server tells the client on which port to send to the client
SYN SYN and ACK ACK PASV (Passive) Inside Network Outside Network
NAT
ENT PASV <Address and Port> SYN SYN and ACK ACK Data Flows Server to Client TCP Connection 1 : Control Connection TCP Connection 2 : Passive Mode: Data
2212 1232_05_2000_c2
Translate Embedded Address
21
Non Standard FTP Ports Server (172.16.1.1) is listening on port 6000

router(config)# access-list 1 permit host 172.16.1.1 router(config)# ip nat service list 1 ftp tcp port 6000
2212 1232_05_2000_c2
22
AgendaConfigurations
2212 1232_05_2000_c2
23
TopologyOutbound NAT
.20
Ethernet 0
Internet .10 NAT
10.1.1.0/24
Serial 0
ISP Assigned: 209.165.201.0 /27
2212 1232_05_2000_c2
24
Outbound NATGlobal Addresses

.20
Ethernet 0
Internet .10 NAT
10.1.1.0/24
Serial 0
Step 1: Create the Pool of usable Global Addresses

router(config)# ip nat pool natpool 209.165.201.10 209.165.201.30 netmask 255.255.255.224
2212 1232_05_2000_c2
25
Outbound NATLocal Addresses

.20
Ethernet 0
Internet .10 NAT
10.1.1.0/24
Serial 0
Step 2: Define the Local Addresses

router(config)# access-list 1 permit ip 10.1.1.0 0.0.0.255
2212 1232_05_2000_c2
26
Outbound NATBindings
.20
Ethernet 0
Internet .10 NAT
10.1.1.0/24
Serial 0
Step 3: Bind Local Addresses to Global Addresses

router(config)# ip nat inside source list 1 pool natpool
2212 1232_05_2000_c2
27
Outbound PAT
.20
Ethernet 0
Internet .10 NAT
10.1.1.0/24
Serial 0
Or Step 3: Bind Local Addresses to Outside Interface

router(config)# ip nat inside source list 1 interface serial 0 overload
2212 1232_05_2000_c2
28
Outbound NAT/PAT
.20
Ethernet 0
Internet .10 NAT
10.1.1.0/24
Serial 0
Or even Step 3: Bind Local Addresses to Global Addresses

router(config)# ip nat inside source list 1 pool natpool overload
2212 1232_05_2000_c2
29
Outbound NATInterfaces
.20
Ethernet 0
Internet .10 NAT
10.1.1.0/24
Serial 0
Step 4: Apply NAT reference points

router(config)# interface ethernet0 router(config-if)# ip nat inside router(config-if)# interface serial 0 router(config-if)# ip nat outside
2212 1232_05_2000_c2
30
Inbound NAT
.20
Ethernet 0
Internet .10 NAT
10.1.1.0/24
Serial 0
Internet needs to get to 10.1.1.10: Build a static translations

router(config)# ip nat inside source static 10.1.1.10 209.165.201.5
2212 1232_05_2000_c2
31
TopologyNAT by Destination
192.168.1.0/24
Partners
Internet
Available Addresses: 172.16.1.0/24
Serial 0 Serial 1 Available Addresses: 209.165.201.0/27
NAT
Ethernet 0 10.0.0.0/8
Your Company
2212 1232_05_2000_c2
32
NAT by Destinationto Partners

192.168.1.0/24
Partners
router(config)# access-list 110 permit ip 10.0.0.0 0.255.255.255 192.168.1.0 0.0.0.255

Serial 0
Available Addresses: 172.16.1.0/24 router(config)# ip nat pool partners 172.16.1.3 172.16.1.254 netmask 255.255.255.0
2212 1232_05_2000_c2
NAT
Ethernet 0 10.0.0.0/8
Your Company
33
NAT by Destinationto Internet

router(config)# ip nat pool internet 209.165.201.10 209.165.201.30 netmask 255.255.255.224
Internet
NAT
Serial 1
Ethernet 0 10.0.0.0/8
Your Your Company Company
2212 1232_05_2000_c2
router(config)# access-list 100 deny ip 10.0.0.0 0.255.255.255 192.168.1.0 0.0.0.255 router(config)# access-list 100 permit ip 10.0.0.0 0.255.255.255 any
34
NAT by Destination Route Map Declaration

192.168.1.0/24 Partners Serial 0 Serial 1 Available Addresses: 209.165.201.0/27 Internet
NAT Ethernet 0 10.0.0.0/8 Your Company
router(config)# route-map topartner permit 10 router(config-map)# match ip address 110 router(config)# route-map tointernet permit 10 router(config-map)# match ip address 100
2212 1232_05_2000_c2
35
NAT by DestinationBindings
192.168.1.0/24 Partners Serial 0 Serial 1 Available Addresses: 209.165.201.0/27
Internet
NAT Ethernet 0 10.0.0.0/8 Your Company
router(config)# ip nat inside source route-map topartner pool partners router(config)# ip nat inside source route-map tointernet pool internet
2212 1232_05_2000_c2
36
Translations Simple vs. Extended

SIMPLE using access-lists
Router#show ip nat translation Pro Inside global Inside local --- 172.16.4.1 10.1.1.1 Outside local --Outside global ---
EXTENDED using route-maps

Router#show ip nat translation Pro Inside global Inside local tcp 172.16.4.1:11012 10.1.1.1:11012 tcp 172.16.3.1:11011 10.1.1.1:11011
2212 1232_05_2000_c2
Outside local Outside global 172.17.1.1:23 172.17.1.1:23 172.16.1.1:23 172.16.1.1:23
37
VPNsThe Issues
VPN Gateway
Internet
NAT 10.0.0.0/8
ISP
IPSec Tunn el
NAT:
Your Company
Access-list deny ip 10.0.0.0 0.255.255.255 ???
Roaming User
2212 1232_05_2000_c2
38
VPNsMode Configuration
VPN Gateway
NAT 10.0.0.0/8
l Tunne IPSec
Mode Config Pool: 172.16.1.1-.254
router (config)# access-list 100 deny ip 10.0.0.0 0.255.255.255 172.16.1.0 0.0.0.255 router(config)# access-list 100 permit ip 10.0.0.0 0.255.255.255 any
39
Your Company
2212 1232_05_2000_c2
VPNsStatic NATs
VPN Gateway
Internet
NAT
ISP
IPSec Tunn el
NAT:
10.1.1.1/8
ip nat inside source static 10.1.1.1 209.165.201.5
Roaming User
2212 1232_05_2000_c2
40
VPNsPolicy Routing
router (config)# access-list 100 permit ip 10.0.0.0 172.31.1.1/24 0.255.255.255 172.16.1.0 0.0.0.255 router(config)# route-map Internet bypassnat permit 10 NAT router(config-map)# match ip Ethernet 0 address 100 router(config-map)# set ip next-hop 172.31.1.2 router(config)# interface Ethernet 0 10.1.1.1/8 router(config-if)# ip policy route-map bypassnat
2212 1232_05_2000_c2
41
TCP Load Balancing

.3 Internet NAT
10.1.1.x
.2
.1
Virtual 209.165.201.5
Round-Robin
router(config)# ip nat pool tcpload 10.1.1.1 10.1.1.3 netmask 255.255.255.0 type rotary router(config)# access-list 1 permit host 209.165.201.5 router(config)# ip nat inside destination list 1 pool tcpload
2212 1232_05_2000_c2
42
Overlapping Networks
.2
Inside
.3 NAT
Outside
.1
.2
10.1.1.x
.1
10.1.1.x
Internet .3
Network
DNS
router-nat(config)# ip nat outside source static network 192.168.1.0 10.1.1.0 /24 router-nat(config)# ip nat inside source static network 10.1.1.0 172.16.1.0/24
2212 1232_05_2000_c2
43
Overlapping Networks DNS Query

.2
Inside
.3 NAT
Outside
.1
.2
10.1.1.x
.1
10.1.1.x
Internet .3
RED-3 ???
Network
DNS
Query
2212 1232_05_2000_c2
44
Overlapping Networks DNS Response

.2
Inside
.3 NAT
Outside
.1
.2
10.1.1.x
.1
10.1.1.x
Internet .3
RED-3 192.168.1.3
Network
DNS
Response = 10.1.1.3
DNS Response modified via address translation

2212 1232_05_2000_c2
45
Overlapping Networks The Packet Is Sent

.2
Inside
.3 NAT
Outside
.1
.2
10.1.1.x
.1
10.1.1.x
Internet .3
RED-3 192.168.1.3
Network
DNS
SA:10.1.1.3 DA:192.168.1.3
2212 1232_05_2000_c2
46
Overlapping Networks Source Translation

.2
Inside
.3 NAT
Outside
.1
.2
10.1.1.x
.1
10.1.1.x
Internet .3
RED-3 192.168.1.3
NAT
Network
DNS
SA:172.16.1.3 DA:192.168.1.3
2212 1232_05_2000_c2
47
Overlapping Networks Destination Translation

.2
Inside
.3 NAT
Outside
.1
.2
10.1.1.x
.1
10.1.1.x
Internet .3
RED-3 192.168.1.3
Network
DNS
SA:172.16.1.3 DA:10.1.1.3
2212 1232_05_2000_c2
48
Network Statics
.20
10.1.1.0 / 24
.10 NAT
Outside
SA= 10.1.1.20 -> 172.18.1.20 SA= 10.1.1.10 -> 172.18.1.10

Router(config)# ip nat inside source static network 10.1.1.0 172.18.1.0 /24 no-alias
2212 1232_05_2000_c2
49
Network Statics Cisco IOS Syntax

.20
10.1.1.0 / 24
.10 NAT
Outside
-ORrouter(config)# ip nat pool natpool 172.18.1.0 172.18.1.255 netmask 255.255.255.0 type match-host router(config)# ip nat inside source list 1 pool natpool
2212 1232_05_2000_c2
50
Network Statics Show Commands

.20
10.1.1.0/24
.10 NAT
Outside
router#show ip nat translations Pro Inside global Inside local Outside local Outside global --- 172.18.1.10 10.1.1.10 ----Subnet translation: Inside global Inside local Outside local Outside global /prefix 172.18.1.0 10.1.1.0 ----/24
2212 1232_05_2000_c2
51
Network StaticsDebugs
.20
10.1.1.0/24
.10 NAT
Outside
router#debug ip nat detailed router#debug IP NAT detailed debugging is on router# 00:12:30: NAT: i: icmp (10.1.1.10, 2458) -> (10.1.2.2, 2458) [20] 00:12:30: NAT: Create inside host entry from network translation: 00:12:30: 10.1.1.10 -> 172.18.1.10 (10.1.1.0 -> 172.18.1.0) 00:12:30: NAT*: o: icmp (10.1.2.2, 2458) -> (172.18.1.10, 2458) [20]
2212 1232_05_2000_c2
52
AgendaTroubleshooting
2212 1232_05_2000_c2
53
Show CommandsTranslations
show ip nat translation

router# show ip nat translation Pro Inside global Inside local tcp 172.16.4.1:11012 10.1.1.1:11012 tcp 172.16.3.1:11011 10.1.1.1:11011
Outside local Outside global 172.17.1.1:23 172.17.1.1:23 172.16.1.1:23 172.16.1.1:23
2212 1232_05_2000_c2
54
Show CommandsStatistics
show ip nat statistics

router# show ip nat statistics Total active translations: 1 (0 static, 1 dynamic; 0 extended) Outside interfaces: Ethernet1 Inside interfaces: Ethernet0 Hits: 191 Misses: 9 Expired translations: 1 Dynamic mappings: -- Inside Source access-list 1 pool natpool refcount 1 pool natpool: netmask 255.255.255.0 start 172.16.2.1 end 172.16.2.10 type generic, total addresses 10, allocated 1 (10%), misses 0
2212 1232_05_2000_c2
55
Global CommandsTime Out
ip nat translation
router(config)# ip nat translation ?
dns-timeout finrst-timeout icmp-timeout max-entries port-timeout syn-timeout tcp-timeout timeout udp-timeout

2212 1232_05_2000_c2
Specify timeout for NAT DNS flows Specify timeout for NAT TCP flows after a FIN or RST Specify timeout for NAT ICMP flows Specify maximum number of NAT entries Specify timeout for NAT TCP/UDP port specific flows Specify timeout for NAT TCP flows after a SYN and no further data Specify timeout for NAT TCP flows Specify timeout for dynamic NAT translations Specify timeout for NAT UDP flows
56
Debug ExampleWorking Translation

debug ip nat
00:01:54: NAT: s=10.1.1.1->172.16.2.1, d=172.16.1.1 [0] 00:01:58: NAT: s=172.16.1.1, d=172.16.2.1->10.1.1.1 [0] 00:01:58: NAT: s=10.1.1.1->172.16.2.1, d=172.16.1.1 [1] 00:01:58: NAT*: s=172.16.1.1, d=172.16.2.1->10.1.1.1 [1]
debug ip nat detailed

00:03:18: NAT: i: tcp (10.1.1.1, 11018) -> (172.16.1.1, 23) [0] 00:03:18: NAT: o: tcp (172.16.1.1, 23) -> (172.16.2.1, 11018) [0] 00:03:18: NAT: i: tcp (10.1.1.1, 11018) -> (172.16.1.1, 23) [1] 00:03:18: NAT*: o: tcp (172.16.1.1, 23) -> (172.16.2.1, 11018) [1]
2212 1232_05_2000_c2
57
Debug ExampleNon-Working Translation

router#debug ip nat IP NAT debugging is on router#debug ip nat detailed IP NAT detailed debugging is on router# NAT: i: tcp (172.16.1.2, 11010) -> (172.18.1.2, 23) [0] NAT: failed to allocate address for 172.16.1.2, list/map 1 NAT: translation failed (A), dropping packet s=172.16.1.2 d=172.18.1.2 NAT: o: icmp (172.16.1.1, 23) -> (172.16.1.2, 11010) [4]
(A)Means the packet was dropped after the translation

2212 1232_05_2000_c2
58
Clear Commands
clear ip nat translation clear ip nat statistics
2212 1232_05_2000_c2
59
Summary
NAT/PAT (overload) -> one-to-one/many-to-one address mappings Can solve IP address shortages and/or conflicts Can hide your network address space from the OUTSIDE world Is flexible by utilizing route-maps and access-lists to determine what traffic needs to be translated. Only is performed if the packet traverses from the INSIDE to OUTSIDE ip nat interfaces and is permitted via the access-list
2212 1232_05_2000_c2
60
Deploying Network Address Translation

Session 2212
2212 1232_05_2000_c2
61
Please Complete Your Evaluation Form

Session 2212
2212 1232_05_2000_c2
62
2212 1232_05_2000_c2
63

2212 6-28nat

Transféré par

Informations du document

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

2212 6-28nat

Transféré par

Droits d'auteur :

Formats disponibles

2212 1232_05_2000_c2

2000, Cisco Systems, Inc.

Deploying Network Address Translation

2000, Cisco Systems, Inc.

2000, Cisco Systems, Inc.

2000, Cisco Systems, Inc.

2000, Cisco Systems, Inc.

2000, Cisco Systems, Inc.

IP HDR : Src IP = 10.1.1.1

Inside Address Translation Outside

2000, Cisco Systems, Inc.

Encapsulating Security Payload (ESP): Tunnel Mode Only

New IP HDR IPSec HDR IP HDR Layer 3

2000, Cisco Systems, Inc.

Authenticated HDR + DATA = Checksum IP HDR DATA

IPSec HDR Checksum Stored

2000, Cisco Systems, Inc.

Routing Outbound ACL

Inbound ACL NAT

Encryption Outbound ACL

Translate Embedded AddressReserve Source Port, IF PAT is to be used

Translate Embedded Address

Non Standard FTP Ports Server (172.16.1.1) is listening on port 6000

2000, Cisco Systems, Inc.

ISP Assigned: 209.165.201.0 /27

2000, Cisco Systems, Inc.

Outbound NATGlobal Addresses

Step 1: Create the Pool of usable Global Addresses

2000, Cisco Systems, Inc.

Outbound NATLocal Addresses

Step 2: Define the Local Addresses

2000, Cisco Systems, Inc.

Step 3: Bind Local Addresses to Global Addresses

2000, Cisco Systems, Inc.

Or Step 3: Bind Local Addresses to Outside Interface

2000, Cisco Systems, Inc.

Or even Step 3: Bind Local Addresses to Global Addresses

2000, Cisco Systems, Inc.

Step 4: Apply NAT reference points

Internet needs to get to 10.1.1.10: Build a static translations

2000, Cisco Systems, Inc.

Available Addresses: 172.16.1.0/24

Serial 0 Serial 1 Available Addresses: 209.165.201.0/27

2000, Cisco Systems, Inc.

NAT by Destinationto Partners

router(config)# access-list 110 permit ip 10.0.0.0 0.255.255.255 192.168.1.0 0.0.0.255

NAT by Destinationto Internet

Available Addresses: 209.165.201.0/27

NAT by Destination Route Map Declaration

Available Addresses: 172.16.1.0/24

NAT Ethernet 0 10.0.0.0/8 Your Company

2000, Cisco Systems, Inc.

Available Addresses: 172.16.1.0/24

NAT Ethernet 0 10.0.0.0/8 Your Company

2000, Cisco Systems, Inc.

Translations Simple vs. Extended

EXTENDED using route-maps

Outside local Outside global 172.17.1.1:23 172.17.1.1:23 172.16.1.1:23 172.16.1.1:23

2000, Cisco Systems, Inc.

Access-list deny ip 10.0.0.0 0.255.255.255 ???

2000, Cisco Systems, Inc.

Mode Config Pool: 172.16.1.1-.254

2000, Cisco Systems, Inc.