WEBVTT

1
00:00.000 --> 00:04.700
So what exactly is address translation? Well, it's all about lying pretty much

2
00:04.700 --> 00:07.100
lying or changing the address

3
00:07.100 --> 00:10.430
Involved in the layer 3 header of a packet and to discuss view options

4
00:10.430 --> 00:12.080
regarding address translation

5
00:12.080 --> 00:15.780
We're gonna use this topology right here. So I've got a client a Windows client

6
00:15.780 --> 00:17.980
down here on the 1010 zero subnet

7
00:17.980 --> 00:20.480
I've got a little virtual PC up here on

8
00:20.480 --> 00:22.620
the 10 12 zero network

9
00:22.620 --> 00:26.590
We've got PC 20 on the 10 20 zero network and I've got PC 30 down here on the

10
00:26.590 --> 00:28.100
10 30 zero network and

11
00:28.100 --> 00:31.560
Currently routing in place between all our four routers
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:28.100 --> 00:31.560
Currently routing in place between all our four routers

12
00:31.560 --> 00:35.360
I also have a multiplayer switch just playing the role right here of a layer 2

13
00:35.360 --> 00:37.920
transparent switch and then I hear off of our four

14
00:37.920 --> 00:41.380
I've got a little simulated internet at 23.1.2

15
00:41.380 --> 00:45.500
That's the address base out here and this server is at dot 100 now this server

16
00:45.500 --> 00:48.560
does not have a route back to any of the private

17
00:48.560 --> 00:53.430
RFC 1918 address spaces. So if we want any of these devices the PCs or the

18
00:53.430 --> 00:55.680
Windows client to be able to reach the server for

19
00:55.680 --> 00:59.940
DNS or web services or anything else we need to implement address translation

20
00:59.940 --> 01:01.360
here at router 4
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
00:59.940 --> 01:01.360
here at router 4

21
01:01.360 --> 01:04.590
So let's talk about a few of our options one of our options for doing address

22
01:04.590 --> 01:05.200
translation is

23
01:05.200 --> 01:09.110
Static and that's where we simply tell the router that's doing the address

24
01:09.110 --> 01:11.160
translation that this PC let's say PC 30

25
01:11.160 --> 01:16.400
Which has an inside address of 10 30 0 51 as that traffic is routed through the

26
01:16.400 --> 01:18.100
router going to the outside world

27
01:18.100 --> 01:21.880
That we wanted to have a specific address that's reachable on the outside for

28
01:21.880 --> 01:22.240
example

29
01:22.240 --> 01:28.100
Maybe 23.1.2.51 if that's the address that's been assigned to us that we can

30
01:28.100 --> 01:31.340
use so that traffic is routed through our four in on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
01:28.100 --> 01:31.340
use so that traffic is routed through our four in on

31
01:31.340 --> 01:35.760
Gig 1 0 and out on gig 2 0 router 4 is gonna swap out the source address with

32
01:35.760 --> 01:39.020
source net and replace the 10 30 0 51 with

33
01:39.020 --> 01:43.620
2312 51 also while we're talking about source and destination

34
01:43.620 --> 01:48.020
Let's also talk about source net versus destination net. So static address

35
01:48.020 --> 01:50.260
translation we're mapping one address like this right here

36
01:50.260 --> 01:53.960
To another address on the outside and with that officially network address

37
01:53.960 --> 01:55.820
translation that is just for that client

38
01:55.820 --> 01:58.700
So it's a one-to-one mapping so if this client is going to that server or going

39
01:58.700 --> 02:01.140
to other servers or other resources up on the internet
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:58.700 --> 02:01.140
to other servers or other resources up on the internet

40
02:01.140 --> 02:06.120
That mapping is gonna stay because the static mapping between 10 30 0 51 and 23

41
02:06.120 --> 02:07.220
12 51

42
02:07.220 --> 02:10.810
So the packets go out we'll swap out these source address when the reply

43
02:10.810 --> 02:11.780
traffic comes back

44
02:11.780 --> 02:16.010
The device that the net will untranslated put the original IP address for the

45
02:16.010 --> 02:18.420
destination and then continue forward it down to the client

46
02:18.420 --> 02:22.320
So officially static net is a one-to-one mapping between one address on the

47
02:22.320 --> 02:23.820
inside and one address on the outside

48
02:23.820 --> 02:27.660
So next let's chat about source versus destination net on the initial flow of

49
02:27.660 --> 02:29.580
traffic going through a net device

50
02:29.580 --> 02:33.270
What are we swapping out on the initial flow? Are we swapping out the source
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
02:29.580 --> 02:33.270
What are we swapping out on the initial flow? Are we swapping out the source

51
02:33.270 --> 02:35.540
address or the destination address in this case?

52
02:35.540 --> 02:39.460
PC 30 as it goes out or swapping out the source address on the initial flow

53
02:39.460 --> 02:43.330
And that's why it's called source net when we're swapping out the source

54
02:43.330 --> 02:46.020
address initially on the other side of that coin

55
02:46.020 --> 02:49.610
We have destination net now when we have that let's imagine we have a router or

56
02:49.610 --> 02:50.580
a firewall here

57
02:50.580 --> 02:54.040
And out here is the internet and we have users out here on the internet that

58
02:54.040 --> 02:55.700
may want to access our servers

59
02:55.700 --> 03:00.460
So here let's say on the inside we have a server and maybe it's a web server
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:55.700 --> 03:00.460
So here let's say on the inside we have a server and maybe it's a web server

60
03:00.460 --> 03:03.340
unless it's at 10.1.1.10

61
03:03.340 --> 03:04.620
That's its IP address

62
03:04.620 --> 03:08.060
So if we want users to be able to access this server obviously users on the

63
03:08.060 --> 03:10.220
internet without a VPN or something else

64
03:10.220 --> 03:14.360
Cannot access a private RSC 1918 address space. So what we do is we can map

65
03:14.360 --> 03:17.140
that for example at 23.1.2.10

66
03:17.140 --> 03:20.150
Assuming that IP address is assigned to us and we can use it and we can map

67
03:20.150 --> 03:23.140
that address to the servers address and then furthermore

68
03:23.140 --> 03:24.900
We very likely have that in DNS as well

69
03:24.900 --> 03:30.130
So when users resolve the name of our server to 23.1.2.10 that traffic is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
03:24.900 --> 03:30.130
So when users resolve the name of our server to 23.1.2.10 that traffic is

70
03:30.130 --> 03:32.900
received here at the router and with destination net

71
03:32.900 --> 03:36.530
It's going to swap out the destination address on that first flow of traffic

72
03:36.530 --> 03:40.180
with the new destination address of the web server 10.1.1.10

73
03:40.180 --> 03:44.090
Again, it's on the initial flow of traffic. What are we swapping out the source

74
03:44.090 --> 03:45.420
or the destination address?

75
03:45.420 --> 03:49.620
And that's what determines if we're using source net or destination net again

76
03:49.620 --> 03:50.940
is on that initial flow of traffic

77
03:50.940 --> 03:54.620
Because on the reply when the server responds back the device that the address

78
03:54.620 --> 03:58.180
translation initially is going to untranslate that back to the address

79
03:58.180 --> 04:01.220
The client things they're using to get to that server before saying that packet
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:58.180 --> 04:01.220
The client things they're using to get to that server before saying that packet

80
04:01.220 --> 04:01.980
back to the user

81
04:02.380 --> 04:05.830
So I clean this up a little bit and let's continue to talk about a few other

82
04:05.830 --> 04:08.940
aspects regarding address translation for IPv4

83
04:08.940 --> 04:12.260
Another option beside static net is dynamic net

84
04:12.260 --> 04:15.840
And whenever you say officially the word net we're talking about a 1 to 1

85
04:15.840 --> 04:16.260
mapping

86
04:16.260 --> 04:19.650
Where one device on the inside is mapped to one IP address on the outside that

87
04:19.650 --> 04:20.940
it gets to use exclusively

88
04:20.940 --> 04:24.670
And the difference between static net and dynamic net is that with static net

89
04:24.670 --> 04:29.440
where we're mapping for example this IP address to the outside address of 23.1.

90
04:29.440 --> 04:30.580
2.51
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
04:29.440 --> 04:30.580
2.51

91
04:30.580 --> 04:34.190
If that's static, we configured whether or not this device is sending traffic

92
04:34.190 --> 04:35.140
out to the internet

93
04:35.140 --> 04:38.860
That mapping, that static mapping between those two addresses exists in the

94
04:38.860 --> 04:40.620
configuration on this router

95
04:40.620 --> 04:43.140
And here's how that compares in contrast to dynamic net

96
04:43.140 --> 04:46.850
With dynamic net we could have a rule in place that says okay for clients who

97
04:46.850 --> 04:49.420
are coming in to the net device

98
04:49.420 --> 04:53.620
And they're coming in from the 1010-0 subnet when they go out to the internet

99
04:53.620 --> 04:55.380
Go ahead and give them a 1 to 1 mapping

100
04:55.380 --> 05:01.100
So maybe we have a pull out here like 23.1.2.65 through 126
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
04:55.380 --> 05:01.100
So maybe we have a pull out here like 23.1.2.65 through 126

101
05:01.100 --> 05:04.350
And let's imagine we have rules in place that says of a client from the subnet

102
05:04.350 --> 05:05.540
is going out to the internet

103
05:05.540 --> 05:10.670
For example traffic is coming in on gig 10 or FA4-1 and being routed out to the

104
05:10.670 --> 05:12.700
internet through the gig 20 interface

105
05:12.700 --> 05:16.660
To go ahead and simply pull an available IP address from this pool of addresses

106
05:16.660 --> 05:20.340
And use that for the 1 to 1 mapping between this client machine here

107
05:20.340 --> 05:22.260
And it's traffic as it goes out to the internet

108
05:22.260 --> 05:25.940
So once that mapping is in place, if this client then goes to other websites or

109
05:25.940 --> 05:27.580
other locations on the internet

110
05:27.580 --> 05:29.660
The net device will continue to use that 1 to 1 mapping

111
05:29.660 --> 05:34.020
But the key is between static and dynamic is that it doesn't actually create
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

111
05:29.660 --> 05:34.020
But the key is between static and dynamic is that it doesn't actually create

112
05:34.020 --> 05:35.620
that translation with dynamic net

113
05:35.620 --> 05:39.880
Until it sees some traffic that matches the rule that would cause it to make

114
05:39.880 --> 05:40.660
that translation

115
05:40.660 --> 05:43.100
So think of it like static is always there

116
05:43.100 --> 05:45.020
And dynamic is when it's needed

117
05:45.020 --> 05:48.260
Meaning when a client for example is going out to the internet at that moment

118
05:48.260 --> 05:50.380
It creates the net 1 to 1 mapping

119
05:50.380 --> 05:54.540
And this example from this IP address of the PC at 1010-050 to some IP address

120
05:54.540 --> 05:55.820
that's available in the pool

121
05:55.820 --> 05:59.520
And then we have the idea regarding that which is a 1 to 1 mapping and pat

122
05:59.520 --> 06:01.020
which is a mini to 1 mapping
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
05:59.520 --> 06:01.020
which is a mini to 1 mapping

123
06:01.020 --> 06:02.420
So let's talk about how pat works

124
06:02.420 --> 06:04.700
We could set up a rule that says you know what?

125
06:04.700 --> 06:09.700
Dear Mr. Router, if you see traffic that's coming in from let's say this subnet

126
06:09.700 --> 06:11.060
1020-0

127
06:11.060 --> 06:15.260
And if he's that traffic and it's being routed into your receive it on either

128
06:15.260 --> 06:18.020
Fast-eat-of-fourth-lush-1 or gig-a-bet-eat-net-once-lush-0

129
06:18.020 --> 06:21.540
And you're routing it out here go ahead and do source net and swap out that

130
06:21.540 --> 06:22.900
source address whatever it is

131
06:22.900 --> 06:26.780
But instead of giving this device its own 1 to 1 mapping on the outside

132
06:26.780 --> 06:30.780
Let's use one IP address and make people share it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
06:26.780 --> 06:30.780
Let's use one IP address and make people share it

133
06:30.780 --> 06:34.020
So for the mapped address we use 23.1.2.

134
06:34.020 --> 06:37.020
Let's say 99 if that's not already used since inside to us

135
06:37.020 --> 06:40.920
Then this PC and actually thousands of other PCs as they're going out to the

136
06:40.920 --> 06:41.260
internet

137
06:41.260 --> 06:44.220
Can be swapped out to this single IP address with source net

138
06:44.220 --> 06:46.620
And then when their responses come back from the servers

139
06:46.620 --> 06:49.940
The device that did the original translation will swap that back to the

140
06:49.940 --> 06:51.060
original source address

141
06:51.060 --> 06:54.420
And the way it can do that is by tracking details including ports that are

142
06:54.420 --> 06:54.860
being used

143
06:54.860 --> 06:57.900
For example this client is going out to the internet and using a source port

144
06:57.900 --> 06:59.820
for TCP of like 673

145
06:59.820 --> 07:02.550
The router is going to leverage that port information and oftentimes to the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

145
06:59.820 --> 07:02.550
The router is going to leverage that port information and oftentimes to the

146
07:02.550 --> 07:03.220
path device

147
07:03.220 --> 07:07.220
It'll even swap out not just the source address with source net with path

148
07:07.220 --> 07:10.750
But also it'll swap out the source port with some other port that it wants to

149
07:10.750 --> 07:12.220
use as it tracks that session

150
07:12.220 --> 07:16.550
And then when the response comes back based on that port and that IP address

151
07:16.550 --> 07:19.220
the path device will swap that out back to what it was

152
07:19.220 --> 07:23.250
So if originally the source port was 673 that would be the new destination port

153
07:23.250 --> 07:24.020
coming back

154
07:24.020 --> 07:29.450
If the original IP address was 1020.051 it'll swap that as well from the 23.1.2

155
07:29.450 --> 07:32.020
.99 before forwarding it through the network
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

155
07:29.450 --> 07:32.020
.99 before forwarding it through the network

156
07:32.020 --> 07:34.020
And have it go back to the client

157
07:34.020 --> 07:38.420
And that's why Pat is actually called Pat is actually port address translation

158
07:38.420 --> 07:42.420
And theoretically we can have thousands and thousands of internal IP addresses

159
07:42.420 --> 07:45.930
being mapped to a single IP address on the outside with port address

160
07:45.930 --> 07:46.620
translation

161
07:46.620 --> 07:51.130
And in a Cisco environment the keyword that influence or references doing that

162
07:51.130 --> 07:52.620
is the keyword of overload

163
07:52.620 --> 07:56.190
So it helped bring forth not only the concepts of the different types of NAT

164
07:56.190 --> 07:59.620
for IPv4 but also the implementation and verification of them

165
07:59.620 --> 08:02.640
In the next video let's put a game plan together regarding what we want to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

165
07:59.620 --> 08:02.640
In the next video let's put a game plan together regarding what we want to

166
08:02.640 --> 08:03.220
accomplish

167
08:03.220 --> 08:07.170
And then with that game plan in place we'll go through step by step of the

168
08:07.170 --> 08:10.020
implementation for static NAT dynamic NAT

169
08:10.020 --> 08:13.170
And as I mentioned at the tail end of the set of videos I'll give you hands on

170
08:13.170 --> 08:15.020
labs you can practice it as well

171
08:15.020 --> 08:17.620
So when you're ready I'll see you in the next video for the game plan