Content

| 6.1 |  | Characteristics of Transport Layer Technologies |
| 6.1.7 |  | Dynamic IP Network Address Translation |

NAT can be configured in a number of ways:

- Static table entries
- Dynamic table entries

Static tables are manually defined by a network engineer and traditionally define a one-to-one mapping between inside and outside IP addresses so that only the IP address portion of the packet header is altered.

Static NAT has the benefit of offering both connectivity and security because hosts on either side of the NAT router cannot communicate if the administrator has not defined an appropriate NAT table entry.

The main disadvantage of static NAT is that it requires one outside address for each inside address that needs to be translated. Because it is unlikely that all of the inside hosts will need to communicate through the NAT router at the same time, static NAT wastes precious outside addresses. Another significant disadvantage of static NAT is that it is must be manually administered. Manual administration of a NAT table can be difficult for a small network and is likely to be impossible for a large network.

Dynamic NAT has neither of the problems associated with static NAT. Dynamic NAT creates entries in the NAT table as required and removes them after they have remained idle for a predefined period. Dynamic NAT allows a large number of inside hosts to share a small number of outside addresses. Dynamic NAT also offers greater security than static NAT, because unlike static NAT, entries in a dynamic NAT table are deleted after they have been idle for a short time.

The main problem with dynamic NAT is that it can be more complex to troubleshoot as the mapping entries in the table change. Sometimes this results in intermittent symptoms and problems. Entries that fail to automatically expire from the NAT table also cause issues with network operation as they do not release outside addresses that would have otherwise become available.

Dynamic NAT operates by examining the packets as they are processed for forwarding. If a suitable entry already exists in the NAT table, the timer for that entry is reset, the address of the packet is updated as appropriate, and the packet is forwarded. If the NAT table does not already have a suitable entry, the NAT process uses an address from the pool of available outside addresses to create a new entry before setting the expiration timer for the entry. It will then update the header of the packet with the new addressing information, and forward the packet.

If all of the outside addresses are currently in use, the NAT process drops the packet and returns an error to the inside host.

NAT with overload and Port Address Translation
Dynamic NAT also has a feature called overloading, or Port Address Translation. NAT without overloading operates at the network layer only, and only IP address information is substituted in packet headers. NAT with overloading extends the operation of NAT into the transport layer and UDP and TCP port numbers are included with entries in the NAT table. A significant consideration for implementing NAT with overload is that it can only be used for sessions from network clients. Servers hosting specific applications must listen for session request traffic on specific ports and therefore cannot make use of port address translation technology.

Recall from previous curriculum that UDP and TCP have roughly 65,535 associated ports each. It is highly unlikely that a single client host accessing network resources will legitimately need to use all of these ports at the same time. Typically, a single host being used for normal Internet activities will maintain around a dozen sessions through a NAT router at any given time. Consider these typical Internet browsing activities:

- How many web pages are open at the same time?
- Is email or newsgroup software updating messages in the background?
- How many file download sessions are active?
- Are any IM applications running in the background?
- What background processes, like DNS, are supporting other applications?

Because a single inside host does not require all of the ports available on an outside address, NAT overload allows multiple inside hosts to make use of the unused ports on a common outside address. It does this by including the port numbers for a given session in the translation table. Recall that a single entry in a normal static or dynamic NAT table represents a single host inside the network. In a table for NAT with overload, a single entry now represents a single transport-layer session. Figure shows a translation table with entries for NAT with overload.