WEBVTT 00:07.540 --> 00:13.840 So we have learned that a source snapped for outgoing connection and a destination at for income in 00:13.840 --> 00:14.920 connection. 00:14.950 --> 00:18.370 No let's make things a bit more complex. 00:18.370 --> 00:26.380 We also need to understand what is a dynamic net and what is a static net well a dynamic net maps the 00:26.410 --> 00:36.010 private IP addresses to the first available public address from a pool of possible addresses that you 00:36.070 --> 00:39.610 have got from your ISP in 48. 00:39.610 --> 00:42.710 This can be done using IP pools. 00:42.730 --> 00:46.930 The second type of a dynamic net is net overloading. 00:46.960 --> 00:50.250 This is the net that we use in our home. 00:50.350 --> 01:00.380 That kind of and net maps multiple private IP addresses to a single only one public IP address. 01:00.460 --> 01:04.510 How does it differentiate between the different client. 01:04.660 --> 01:09.870 It does so by using a different source port assignment. 01:09.880 --> 01:21.040 Now assume that this source port for a specific client is port number one thousand seventy two for another 01:21.040 --> 01:27.380 client the port this source port is one hundred and seventy three. 01:28.030 --> 01:33.750 Whenever a session is initiated it is initiated with the source port. 01:33.970 --> 01:41.050 Whenever the web server lets assume that we have asked for a web page whenever a web server since the 01:41.050 --> 01:52.800 responding traffic it is based on those port numbers so each session is actually mapped with this source 01:52.800 --> 01:56.010 port that the client initiated. 01:56.020 --> 02:04.150 Now let's take a look at our firewall policy and let's understand how we configure and net overloading 02:05.170 --> 02:12.670 and how we configure IP pools. 02:12.740 --> 02:20.010 All right so let's move over to one of our policies and see the different net that is being used. 02:20.010 --> 02:21.810 Now as you can see it can you. 02:21.830 --> 02:29.900 You can enable that or disable it if you choose the use of the use of outgoing interface address that 02:29.910 --> 02:37.980 is many to one many private addresses will use only one public IP address. 02:38.430 --> 02:44.080 That is the net overload but you can also use net overload in dynamic IP pools. 02:44.100 --> 02:51.090 Now we don't have any IP pool that is configure so we can add one right now. 02:56.940 --> 03:07.290 So if we use IP pools we actually use a range of IP addresses instead of the egress interface as we 03:07.290 --> 03:13.580 saw before we can name or pull its name it IP poll. 03:14.550 --> 03:21.800 And as we can see we have four types of IP pools. 03:21.930 --> 03:23.520 The first one is overload. 03:23.520 --> 03:25.020 There is many to want. 03:25.020 --> 03:34.270 There are many to a few IP addresses and the port translation is used. 03:34.460 --> 03:36.610 The second one one two one. 03:36.770 --> 03:44.960 Well the IP address the private IP address is being mapped on a first come first served. 03:45.290 --> 03:50.330 And we don't use the port address translation. 03:50.490 --> 04:01.470 Now the third one the fixed or 3G range allows better mapping between the internal private address and 04:01.470 --> 04:04.530 the external IP address. 04:04.530 --> 04:11.220 It also doesn't use Port address translation No. 04:11.250 --> 04:15.690 The third one the port block on location. 04:15.690 --> 04:23.390 It allows you to limit your client to a number of ports that can be used. 04:23.400 --> 04:29.270 You can use a specific number of port blocks size. 04:29.580 --> 04:38.000 Let's say that we use 65 clients with limited port block size. 04:38.060 --> 04:48.590 We're less likely to be influenced by a distributed denial of service where your network suffers from 04:48.590 --> 04:51.100 a flow of ICMP messages.