This document provides answers to frequently asked questions about Network Address Translation (NAT).

A. Network Address Translation (NAT) is designed for IP address conservation. It enables private IP networks that use unregistered IP addresses to connect to the Internet. NAT operates on a router, usually connecting two networks together, and translates the private (not globally unique) addresses in the internal network into legal addresses, before packets are forwarded to another network.

As part of this capability, NAT can be configured to advertise only one address for the entire network to the outside world. This provides additional security by effectively hiding the entire internal network behind that address. NAT offers the dual functions of security and address conservation and is typically implemented in remote-access environments.

A. Routing for IP addresses created by NAT is learned if:

• The inside global address pool is derived from the subnet of a next-hop router.

• Static route entry is configured in the next-hop router and redistributed within the routing network.

When the inside global address is matched with the local interface, NAT installs an IP alias and an ARP entry, in which case the router will proxy-arp for these addresses. If this behavior is not wanted, use the no-alias keyword.

When a NAT pool is configured, the add-route option can be used for automatic route injection.

A. The NAT session limit is bounded by the amount of available DRAM in the router. Each NAT translation consumes about 312 bytes in DRAM. As a result, 10,000 translations (more than would generally be handled on a single router) consume about 3 MB. Therefore, typical routing hardware has more than enough memory to support thousands of NAT translations.

A. Cisco IOS NAT supports Cisco Express Forwarding switching, fast switching, and process switching. For 12.4T release and later, fast-switching path is no longer supported. For Cat6k platform, the switching order is Netflow (HW switching path), CEF, process path.

Performance depends on several factors:

• The type of application and its type of traffic

• Whether IP addresses are embedded

• Exchange and inspection of multiple messages

• Source port required

• The number of translations

• Other applications running at the time

• The type of hardware and processor

A. Yes. Source and/or destination NAT translations can be applied to any interface or subinterfaces having an IP address (including dialer interfaces). NAT cannot be configured with Wireless Virtual Interface. Wireless Virtual Interface does not exist at the time of writing to NVRAM. Thus, after reboot, the router looses NAT configuration on the Wireless Virtual Interface.

A. PAT (overloading) divides the available ports per global IP address into three ranges: 0-511, 512-1023, and 1024-65535. PAT assigns a unique source port for each UDP or TCP session. It attempts to assign the same port value of the original request, but if the original source port has already been used, it starts scanning from the beginning of the particular port range to find the first available port and assigns it to the conversation. There is an exception for 12.2S code base. 12.2S code base uses different port logic, and there is no port reservation.

A. PAT works with either one global IP address or multiple addresses.

PAT with One IP Address

Condition	Description
1	NAT/PAT inspects traffic and matches it to a translation rule.
2	Rule matches to a PAT configuration.
3	If PAT knows about the traffic type and if that traffic type has "a set of specific ports or ports it negotiates" that it will use, PAT sets them aside and does not allocate them as unique identifiers.
4	If a session with no special port requirements attempts to connect out, PAT translates the IP source address and checks availability of the originated source port (433, for example). Note: For Transmission Control Protocol (TCP) and User Datagram Protocol (UDP), the ranges are: 1-511, 512-1023, 1024-65535. For Internet Control Message Protocol (ICMP), the first group starts at 0.
5	If the requested source port is available, PAT assigns the source port, and the session continues.
6	If the requested source port is not available, PAT starts searching from the beginning of the relevant group (starting at 1 for TCP or UDP applications, and from 0 for ICMP).
7	If a port is available it is assigned, and the session continues.
8	If no ports are available, the packet is dropped.

　

PAT with Multiple IP Addresses

Condition	Description
1-7	The first seven conditions are the same as with a single IP address.
8	If no ports are available in the relevant group on the first IP address, NAT moves on to the next IP address in the pool and tries to allocate the original source port requested.
9	If the requested source port is available, NAT assigns the source port and the session continues.
10	If the requested source port is not available, NAT starts searching from the beginning of the relevant group (starting at 1 for TCP or UDP applications, and from 0 for ICMP).
11	If a port is available, it is assigned and the session continues.
12	If no ports are available, the packet is dropped, unless another IP address is available in the pool.

　

A. NAT IP pools are a range of IP addresses that are allocated for NAT translation as needed. To define a pool, the configuration command is used:

ip nat pool <name> <start-ip> <end-ip> 
     {netmask <netmask> | prefix-length <prefix-length>}
     [type {rotary}]

Example 1

The following example translates between inside hosts addressed from either the 192.168.1.0 or 192.168.2.0 network to the globally unique 10.69.233.208/28 network:

ip nat pool net-208 10.69.233.208 10.69.233.223 prefix-length 28 
ip nat inside source list 1 pool net-208
!
interface ethernet 0
ip address 10.69.232.182 255.255.255.240
ip nat outside
!
interface ethernet 1
ip address 192.168.1.94 255.255.255.0
ip nat inside
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 permit 192.168.2.0 0.0.0.255

Example 2

In the following example, the goal is to define a virtual address, connections to which are distributed among a set of real hosts. The pool defines the addresses of the real hosts. The access list defines the virtual address. If a translation does not already exist, TCP packets from serial interface 0 (the outside interface) whose destination matches the access list are translated to an address from the pool.

ip nat pool real-hosts 192.168.15.2 192.168.15.15 prefix-length 28 type rotary
ip nat inside destination list 2 pool real-hosts
!
interface serial 0
ip address 192.168.15.129 255.255.255.240
ip nat outside
!
interface ethernet 0
ip address 192.168.15.17 255.255.255.240
ip nat inside
!
access-list 2 permit 192.168.15.1

A. In practical use, the maximum number of configurable IP pools is limited by the amount of available DRAM in the particular router. (Cisco recommends that you configure a pool size of 255.) Each pool should be no more than 16 bits. In 12.4(11)T and later, IOS introduce CCE (Common Classification Engine). This has limited NAT to only have a maximum of 255 pools. In 12.2S code base, there is no maximum pools restriction.

A. Static NAT translations have one-to-one mapping between local and global addresses. Users can also configure static address translations to the port level, and use the remainder of the IP address for other translations. This typically occurs where you are performing Port Address Translation (PAT).

The following example shows how to configure routemap to allow outside-to-inside translation for static NAT:

ip nat inside source static 1.1.1.1 2.2.2.2 route-map R1 reversible
!
ip access-list extended ACL-A
permit ip any 30.1.10.128 0.0.0.127'
route-map R1 permit 10
match ip address ACL-A

A. Yes. NAT overloading is PAT, which involves using a pool with a range of one or more addresses or using an interface IP address in combination with the port. When you overload, you create a fully extended translation. This is a translation table entry containing IP address and source/destination port information, which is commonly called PAT or overloading.

PAT (or overloading) is a feature of Cisco IOS NAT that is used to translate internal (inside local) private addresses to one or more outside (inside global, usually registered) IP addresses. Unique source port numbers on each translation are used to distinguish between the conversations.

A. In dynamic NAT translations, the users can establish dynamic mapping between local and global addresses. Dynamic mapping is accomplished by defining the local addresses to be translated and the pool of addresses or interface IP address from which to allocate global addresses and associating the two.

A. Traceroute from outside should always return the global address.

A. NAT supports only out-of-order IP fragments because of ip virtual-reassembly.

A. NAT uses the same debug CLI for both IP fragmentation and TCP segmentation: debug ip nat frag.

A. No. There in no supported NAT MIB, including CISCO-IETF-NAT-MIB.

A. If the three-way handshake is not completed and NAT sees a TCP packet, then NAT will start a 60-second timer. When the three-way handshake is completed, NAT uses a 24-hour timer for a NAT entry by default. If an end host sends a RESET, NAT changes the default timer from 24 hours to 60 seconds. In the case of FIN, NAT changes the default timer from 24 hours to 60 seconds when it receives FIN and FIN-ACK.

A. The LDAP settings add the extra bytes (LDAP search results) while processing messages of type Search-Res-Entry. LDAP attaches 10 bytes of search results to each of the LDAP reply packet. In the event that this 10 extra bytes of data result in the packet exceeding the Maximum Transmission Unit (MTU) in a network, the packet is dropped. In this case, Cisco recommends that you turn off this LDAP behavior using the CLI no ip nat service append-ldap-search-res command in order for the packets to be sent and received.

A. A route has to be specified on the NAT configured box for the inside global IP address for features such as NAT-NVI. Similarly, a route should also be specified on the NAT box for the outside local IP address. In this case, any packet from an in to out direction using the outside static rule will require this kind of route. In such scenarios, while providing the route for IG/OL, the next hop IP address should also be configured. If the next hop configuration is missing, this is considered a configuration error and will result in undefined behavior.

NVI-NAT is present in the output feature path only. If you have directly connected subnet with NAT-NVI or the outside NAT translation rule configured on the box, then in those scenarios, you need to provide a dummy Next Hop IP address and also an associated ARP for the Next Hop. This is needed for the underlying infrastructure to hand the packet to NAT for the translation.

A. CUCM 7 and all of the default phone loads for CUCM 7 support SCCPv17. The SCCP version used is determined by the highest common version between CUCM and the phone when the phone registers.

NAT does not yet support SCCP v17. Until NAT support for SCCP v17 is implemented, the firmware must be downgraded to version 8-3-5 or below so that SCCP v16 is negotiated. CUCM6 will not encounter the NAT problem with any phone load as long as it uses SCCP v16. Cisco IOS does not currently support SCCP version 17.

A. The number of calls handled by a NAT router is contingent on the amount of memory available on the box and the processing power of the CPU.

A. IOS-NAT support TCP segmentation for H323 in 12.4 Mainline and TCP segmentation support for SKINNY from 12.4(6)T onward.

A. Yes. When you have NAT overload configs and a voice deployment, you need the registration message to go through NAT and create an association for out->in to reach this inside device. The inside device sends this registration in a periodic fashion and NAT updates this pin-hole/association from the information as in the signalling message.

A. In voice deployments when you isssue a clear ip nat trans * command or a clear ip nat trans forced command and have dynamic NAT, you will wipe out the pin-hole/association and must wait for the next registration cycle from the inside device to re-estabilish this. Cisco recommends that you do not use these clear commands in a voice deployment.

A. No. The co-located solution is currently not supported. The following deployment with NAT (on the same box) is considered a co-located solution: CME/DSP-Farm/SCCP/H323.

A. No. Note that UDP SIP ALG (used by most deployments) is not impacted.

72UUT(config)#ip nat inside
	 source static 1.1.1.1 22.2.2.2 72UUT(config)#ip nat inside source static
	 1.1.1.1 22.2.2.2 vrf RED 

A. Legacy NAT supports overloapping address config over different VRFs. You would have to configure overlapping at rule with the match-in-vrf option and set up ip nat inside/outside in the same VRF for traffic over that specific VRF. The overlapping support does not include the global routing table.

You must add the match-in-vrf keyword for the overlapping VRF static NAT entries for different VRFs. However, it is not possible to overlap global and vrf NAT addresses.

72UUT(config)#ip nat inside source static 1.1.1.1 22.2.2.2 vrf RED match-in-vrf
72UUT(config)#ip nat inside source static 1.1.1.1 22.2.2.2 vrf BLUE match-in-vrf

A. Cisco recommends that you use legacy NAT for VRF to global NAT (ip nat inside/out) and between interfaces in the same VRF. NVI is used for NAT between different VRFs.

A. There is no support for TCP segmentation for NAT-NVI.

A. No. Note that UDP SIP ALG (used by most deployments) is not impacted.

A. SNAT does not support any TCP ALGs (such as, SIP, SKINNY, H323, or DNS). Therefore, TCP segmentation is not supported. However, UDP SIP and DNS are supported.

A. SNAT does not support any TCP ALGs (such as, SIP, SKINNY, H323, or DNS). Therefore, TCP segmentation is not supported. However, UDP SIP and DNS are supported.

A. Asymetric routing supports NAT by enabling as queuing. By default, as-queueing is enable. However, from 12.4(24)T onward, as-queuing is no longer supported. Customers must make sure packets are routed properly and proper delay is added in order for asymmetric routing to work correctly.

A. NAT-PT is not supported in the CEF path.

A. NAT-PT supports TFTP/FTP and DNS. There is no support for voice and SNAT in NAT-PT.

A. SNAT is not available on Catalyst 6500 on the SX train.

A. VRF-aware NAT is not supported in hardware on this platform.

A. On the 65xx/76xx platform, VRF-aware NAT is not supported, and the CLIs are blocked.

Note: You can implement a design by leveraging a FWSM that runs in virtual context transparent mode.

A. No. There is no support for Skinny NAT ALG in 12.4T on the 850 series.

A. Yes. These are the NAT best practices:

1. When using both dynamic and static NAT, the ACL that sets the rule for dynamic NAT should exclude the static local hosts so there is no overlap.

2. Beware of using ACL for NAT with permit ip any any as you can get unpredictable results. After 12.4(20)T NAT will translate locally generated HSRP and routing protocol packets if they are sent out the outside interface, as well as locally encrypted packets matching the NAT rule.

3. When you have overlapping networks for NAT, use the match-in-vrf keyword.

   You must add the match-in-vrf keyword for the overlapping VRF static NAT entries for different VRFs, but it is not possible to overlap global and vrf NAT addresses.

   Router(config)#ip nat inside source static 1.1.1.1 22.2.2.2 vrf RED match-in-vrf
   

   Router(config)#ip nat inside source static 1.1.1.1 22.2.2.2 vrf BLUE match-in-vrf
   

4. NAT pools with same address range can not be used in different VRFs unless the match-in-vrf keyword is used.

   For example:

     ip nat pool poolA 171.1.1.1 171.1.1.10 prefix-length 24
     ip nat pool poolB 171.1.1.1 171.1.1.10 prefix-length 24
     ip nat inside source list 1 poolA vrf A match-in-vrf
     ip nat inside source list 2 poolB vrf B match-in-vrf 
   

   Note: Wven though CLI configuration is valid, without the match-in-vrf keyword the configuration is not supported.

5. When deploying ISPs load balancing with NAT interface overload, the best practice is to use route-map with interface match over ACL matching.

6. When using pool mapping, you should not use two different mapping (ACL or route-map) to share the same NAT pool address.

7. When deploying the same NAT rules on two different routers in the failover scenario, you should use HSRP redundancy.