In this video, let's take a big picture look at the world of network address
translation
or as its friends call it, "NAT."
There's also a subset of that that's often referred to as "PAT," and we'll talk
about
all of that right now.
So why in the world do we need to do network address translation of any type?
Well, let's start off with a very common scenario, and that is we have a VM,
for example, right
here on the 10100 network that wants to access a server out here on the
internet.
Maybe it's a Google DNS server or something else that's out on the public
internet.
So this client, and forwarding to that destination address, would forward it to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this client, and forwarding to that destination address, would forward it to
its default gateway,
and then this gateway would make a decision to forward it up to this gateway,
and so forth,
and so on until it goes to all the layer three routing devices and finally
reaches the server.
So that's the goal.
However, if we are setting a packet from this VM and its source IP address, let
me go ahead
and put the source address right here in yellow.
So I'll say the source address of the IP packet here from VM1, the source would
be 10.10.0.10.
And this IP address starting with 10 is in the RFC 1918 list of private RFC WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And this IP address starting with 10 is in the RFC 1918 list of private RFC
1918 addresses.
So the question might be, so what?
Well, if we try to forward a packet out and send out through an internet
service provider,
when they see a source address like this in the 10 address space, they're going
to drop
it right there.
Or let's imagine that they didn't drop it and that packet gets forwarded all
the way
to this DNS server here at 8888, and it tries to respond back to the 10 network
.
This server is not going to be able to respond back to the 10 address and have
it reach all
the way back to this VM.
Because again, the 10 address space is a private RFC 1918 address space, and it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Because again, the 10 address space is a private RFC 1918 address space, and it
's not a reachable
or routable address on the public internet.
So how do we solve that problem?
And the answer is we lie.
We take this source IP address of 10, 10, 0, 10 that the client's using.
And at some point, before we forward it out to our service provider, we swap it
out.
So let's say we swap it out with these source address.
I'll put this in blue to represent a globally routable address.
Let's say we swap out this address 10, 10, 0, 10, and we swap it out for 23.1.2
.254.
So that would also presume by the way that this IP address that we're going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that would also presume by the way that this IP address that we're going to
swap it out
with is reachable at our enterprise.
So that way when the server gets that request, as he's it came from 2312.254,
it can make
you route any decision that the internet believes will lead back to one of our
routers right
here.
So here I'm going to call this the pre-net address.
And up here, I'll able this as the post-net address.
And if we implemented the network address translation right here, this would be
our NAT device,
the device doing the address translation.
And on that initial flow of traffic, when this device right here, tier zero, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And on that initial flow of traffic, when this device right here, tier zero,
did that
translation because it's swapping out the source address on that initial flow
as it goes
out to the internet that has a special name and that is source NAT.
Or it can be abbreviated as S NAT.
Now when we're implementing source NAT, one of those common ways of
implementing that
on this gateway here is to make it stateful, meaning it's going to remember
that translation.
And that's also important because when this DNS server responds back to that
address 2312.254,
this NAT device here, in our case, it's gateway zero, the one that did the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this NAT device here, in our case, it's gateway zero, the one that did the
initial translation
is also going to do the untranslation and swap out the address it used
previously, put
back on the real IP address of this VM before it forwards that back down to the
VM.
So you could say that this NAT device right here is doing translation on the
initial flow
and untranslation on the return packet.
However, it's called source NAT because the initial translation was done on the
initial
flow traffic, in this case coming from the client, going up to the server.
Now another really interesting option we have in the world of address WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now another really interesting option we have in the world of address
translation is called
destination NAT.
Or as his friends call it, D NAT for short.
And let's talk about what that means as well.
So let me go ahead and clear up a little bit of my scribbles over here on the
right.
That looks better.
Also, before we draw in when we would use this, let me also give you a spoiler
alert that says,
you know what, if source NAT is translating the source IP address on the
initial flow of
traffic going through the gateway, then destination NAT is translating the
destination address,
again, on that initial flow of traffic through the gateway. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
again, on that initial flow of traffic through the gateway.
So when exactly would we need this?
Let's imagine that we have a server that we're hosting and I'm going to put
right here
on segment 10.
So this is our server.
Let's imagine our servers right here at dot 17.
So it's at 10, 10, 0, 17.
And we want somebody on the public internet, for example, or an external
network to be
able to reach that IP address.
So I'll go ahead and draw here a little device.
I'll call this a client.
So clients are most of the time going to be using DNS to resolve a name to an
IP address.
However, this IP address of our server here at 10, 10, 0, 17 is not reachable WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
However, this IP address of our server here at 10, 10, 0, 17 is not reachable
over the
public internet.
So we need to have a publicly reachable address that we can map to this private
RFC 19 address
that the server is actually using.
So here's what we could do.
We could get a nice address that's reachable that's been assigned to us that we
can use.
Let's use 23 dot 1 dot 2 dot.
And I'm going to use the last octet the same 17.
Let's imagine that's the globally routable address on the internet that we want
to map
to this server on a private network right here.
So what we do is we'd pick a device to do it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So what we do is we'd pick a device to do it.
It could be this external router or it could be this gateway as part of NSX.
And we say that we want to go ahead and do network address translation.
And this will be our net device.
Specifically this time, the initial flow of traffic is going to be from clients
coming
into our network and down to that server going in this direction.
And so if a client tries to reach this IP address 23 12 17, we want our net
device to
swap out that destination address.
Hence the term destination at on that initial flow of traffic and swap it out
for this address
right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
right here.
So that's going to be mapped to 10 dot 10 dot 0 dot 17.
At which point after swapping out the destination address, it was continued for
the packet down
to that server who would receive it.
And then it would look like from the server perspective that it came from that
client
on the internet.
Then if it was going to respond back, it would respond back.
And then as the traffic goes through that net device again, once again, it's
going to
do an untranslation as it untranslates and continues to forward the packet.
So the key takeaway here is that on the initial flow of traffic, what are we
swapping out?
The source address, which would be source net or on that initial flow of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The source address, which would be source net or on that initial flow of
traffic.
Are we swapping out the destination address, which would be destination net?
And that's what those two terms mean.
Now in the event that we are doing a one to one mapping, for example, we're
mapping this
VM right here to a specific address out on the public internet and it gets to
use that
single IP address by itself.
And then we take this VM right here and we map it to get a different publicly
readable
address and that's referred to as a one to one mapping.
So one address on the inside gets mapped to one address on the outside.
For in the case of destination net, one address on the outside gets mapped to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
For in the case of destination net, one address on the outside gets mapped to
one address
on the inside and a different address on the outside, but you map to a
different address
on the inside.
And again, either way, that's referred to as one to one mapping between
internal and externally
routable addresses.
However, there's also the concept of many to one and we've been using this for
decades
and that's the only reason, by the way, that we haven't run out of IPV for
addresses is
because we can actually take dozens or hundreds or thousands of internal
clients that are
using private RFC 19, 18 addresses like the 10 address base and once they do 16 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
using private RFC 19, 18 addresses like the 10 address base and once they do 16
through
31 and so forth and we can map them to a single address before they go out to
the internet
using source net.
So here's an example of that.
Let's say we have a publicly readable address of 23.1.2.
Are you something different?
Let's use 151 as the address that we have that's associated with our
organization from
an internet perspective.
So the entire internet knows that when these are forward packets to this IP
address, they're
going to forward it back to us.
And then we can specify on our net device that we want to go ahead and do
source address
translation for any clients coming from 10.10 from that address base or from WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
translation for any clients coming from 10.10 from that address base or from
the 10.20 address
base or for that matter, we could also just say 10 anything like that as a rule
for our
network address translation and then any traffic that is coming through the
gateway that's
coming from 10 anything in this case with just this rule alone, we could map
that to
this specific globally readable address.
And so when you have that done for multiple inside devices mapping to a single
outside
address, that's referred to as PAP port address translation because the way the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
address, that's referred to as PAP port address translation because the way the
gateways
keeping track of those differences and the different sessions is by
manipulating and
modifying the port information layer four.
Now it's also interesting to note that not every protocol we use has a port
number at
layer four.
For example, UDP and TCP do, but we have other protocols as well at layer four
that
don't have ports.
However, to make long story short, when we're using the mini one mapping, the
gateway is
responsible for the tracking and managing of those sessions.
So that way when this VM goes up to the internet and gets a response back, it's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that way when this VM goes up to the internet and gets a response back, it's
coming back
to the right device.
And when this device right here via one goes up to the internet and response
comes back,
it comes to the right device.
So a source net, which is typically used in this situation like this with
clients going
out to the internet on that initial flow of traffic, we're swapping out these
source private
addresses with a globally readable dress.
And then when the response comes back, we're doing the untranslation and
continuing forwarding
down to our clients.
It's also important to be aware that anytime we start implementing these
network services,
including network address translation, we're now invoking a services router
function, which WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is going to be implemented on one of our edge notes.
And depending on how we want to set up, we could set up our network address
translation
here at tier zero, which already has a services router from the function of
connecting to
the external world.
And we could also add the services router function here on our tier one gate
ways.
And as part of that implement that here, if we want to as well, most of the
time we're
going to be doing our net though, right here at the edge before it goes out to
the public
or external network.
Also another concept regarding that that's important to be aware of is static
versus dynamic.
With a static translation, we tell the gateway, hey, this translation between WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
With a static translation, we tell the gateway, hey, this translation between
this address
on the inside and this address on the outside should always be in place.
It's like a hard coded rule.
And the concept of dynamic simply says like a rule that says, hey, if traffic
shows up
from these subnets, for example, and it's going out to the internet, go ahead
and swap
it to either this IP address or a range of IP addresses.
However, the actual translation isn't created on the net device until that
traffic shows
up.
So that's the concept of static hard coded versus dynamic, just waiting for the
traffic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
traffic
to show up so it can dynamically on the fly create those translations.
So if we are using active standby for the implementation of our gateways, we
can set
up source net and we can use destination at when needed.
Again, D net would be when we have an internal resource that needs to be
reached from an
external network and source net would be for clients on the inside on their
initial flows
going out.
However, if we are using active active as opposed to active standby, which
means that
both routers, both gateways, both edge nodes are participating in the actual
flow of the
data plane. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
data plane.
At that point, we have yet another option in the world, VMware's NSX for
network address
translation.
And that is called reflexive.
And when we choose the option of reflexive, we have our rules in place
regarding what
can be translated to what however, the actual firewall isn't going to maintain
states.
That can maintain a net table with all those translations.
And that's because either of the gateways, edge one or edge two, because they
both could
be active.
Either one needs to be able to process that translation.
So in an active standby scenario, the one active gateway could maintain all WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that state
information.
However, with active active, we need to be prepared that either of the edges,
when there's
packets coming in or going out, either of the edges could be involved in that
traffic
flow.
And so reflexive is more like a set of hard coded rules that are in place that
can be
enforced.
However, the firewall's effective and reflexive net are not going to maintain
individual
state information regarding those translations.
Another option that's available in the world of NSX regarding net is no,
meaning no source
net or no destination net.
And the reason for that is because these net rules are going to be in a list WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the reason for that is because these net rules are going to be in a list
and they're
processed from top to bottom.
So if we have, for example, we want to do address translation for everybody in
a subnet,
except for one VM, we can make a rule for one VM saying no source net based on
that
source IP address that we don't want to do translation for.
And that way we can do exceptions.
So there's no SNAT and no D net that we can use as part of our rules.
There also is a net option for NAT 64, which we will be covering in a separate
skill as
we dive into IPV six. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we dive into IPV six.
So for now, we're just going to focus on IPV four and these options with net.
So with this overview in mind regarding some of our options regarding address
translation,
in the next video, let's put a specific game plan together regarding what we
want to implement
and then we'll follow that plan to configure and verify both source and
destination at in
our topology.
So I'll see you in the next video for that game plan.