Network Address Translation

Transcription

1 Network Address Translation "Qu'est-ce que la translation d'adresse?" Notions d'adressage privé ou public, techniques de masquerading, NAT et quand les employer

2 What s in a range? The first address in an IP network is the address of the network itself. The last address is the broadcast address for the network. All other addresses may be allocated to hosts on the network. Of these, the first or the last address is usually allocated to the Internet/Default gateway for the network.

3 Reserved IP addresses There are address ranges in each class reserved for use on local area networks (LANs). These addresses are guaranteed not to conflict with any addresses on the Internet proper. By the same token, if one of these addresses is assigned to a host then that host must not access the Internet directly but must access it through a gateway that acts as a proxy for individual services or else does Network Address Translation. These address ranges are given in the following table along with the number of ranges in each class. network addresses Class A 10.x.x.x /8 1 Class B x.x x.x /16 16 Class C x x / length how_many

4 Give Some Basic Uses of NAT Coping with the shortage of external (public) IP addresses Hiding internal addresses scheme Providing external services with hosts in internal networks when there are private IP addresses

5 NAT Processes Mapping methods NAT examples NAT and Protocol Helpers/Agents Proxy ARP

6 Mapping Methods Static NAT static source translation [one-to-one relationship] static destination translation [one-to-one relationship] destination port translation [one-to-one relationship] combination of static source and destination translation Dynamic NAT dynamic source translation [many-to-one relationship] dynamic source translation for outbound load balancing

7 Address and/or Port translation Source translation: From inside the router Destination translation: From outside the router Port redirection: Only translates connections to certain ports

8 Static Source IP Address Translation Internal network 1 Source packet SRC: DST: Static source NAT 2 Translated packet SRC: DST: External network SRC: DST: Translated packet 4 Translation back into source IP SRC: DST: Reply packet

9 Static Source IP Address Translation e.g.

10 Dynamic Source IP Address Translation Internal network 1 Source packet 2 Translated packet External network SRC: : 9057 DST: : 80 Dynamic source NAT SRC: : 9345 DST: : SRC: : 80 DST: : Translated packet 4 Translation back into source IP SRC: : 80 DST: : 9345 Reply packet

11 Dynamic Source IP Address Translation e.g.

12 Static Destination IP Address Translation Internal network 2 Translated packet 1 Source packet External network SRC: DST: Static destination NAT SRC: DST: SRC: DST: Reply packet 3 Translation back into source IP SRC: DST: Translated packet

13 Static Destination IP Address Translation e.g.

14 Resulting Example s NAT rules Do not forget to edit the corresponding Access Rules! Remember: 1. Anti-Spoofing 2. Access Rules 3. NAT Rules 4. Routing

15 Managing Security Policies & NAT Rules Security policies are based on the creation and maintenance of rule bases Rules can be edited using the appropriate Editors embedded into the Security Policy Manager. For each NAT rule specified, there should be at least one corresponding access rule to allow the connection NAT is applied only after the action from the access rule is performed Order of NAT rules should proceed from the most specific to the least specific

16 NAT and Protocol Helpers/Agents Protocols that require you to use a fixed source port or range should not be used with dynamic NAT. Critical: use a Protocol Helper (ALG) to modify problematic protocols (such as FTP).

17 Proxy ARP and NAT NAT rules generate ARP entries for the router/firewall on which they are installed. Allow the router/firewall to reply to an ARP request The router responds to ARP requests for addresses in a specified subnet. The router processes frames addressed to its Ethernet MAC If the connection encapsulated in this frame is not one of its addresses, it attempts to forward the frame.