Lab 6-2 NAT Configuration - PAT

Introduction to PAT

Port Address Translation (PAT), also known as NAT overload, is an advanced form of Network Address Translation that allows multiple devices on a private network to share a single public IP address. While standard dynamic NAT requires a one-to-one mapping between private and public IP addresses, PAT enables many-to-one translation by leveraging TCP/UDP port numbers to distinguish between different connections.

The Evolution from NAT to PAT

As the internet grew exponentially and IPv4 address exhaustion became a critical concern, network administrators needed more efficient ways to conserve public IP addresses. This necessity led to the development of PAT, which represents a significant enhancement over basic NAT implementations.

How PAT Works

PAT operates on a fundamental principle: by tracking both IP addresses and port numbers, a single public IP address can support thousands of simultaneous connections from different internal devices. Here's how the process works:

1. Connection Initiation: A device on the private network initiates a connection to an external destination.

2. Translation and Port Assignment: The PAT-enabled router:

   • Records the source IP address and port number

   • Replaces the private source IP with its public IP address

   • Assigns a unique port number on the public interface to track this specific connection

   • Creates an entry in its translation table

3. Return Traffic Handling: When return traffic arrives at the public IP address:

   • The router examines the destination port

   • Looks up the corresponding entry in its translation table

   • Translates the packet's destination to the original internal IP and port

   • Forwards the packet to the correct internal device

4. Connection Tracking: The router maintains a NAT table containing all active translations, allowing it to properly direct incoming and outgoing traffic.

The Mathematics of PAT Scalability

Each IP address can theoretically support up to 65,535 unique TCP ports and another 65,535 UDP ports. This means a single public IP address used with PAT can potentially accommodate thousands of internal devices simultaneously, making it incredibly efficient for address conservation.

Advantages of PAT Over Basic NAT

1. Address Conservation: PAT dramatically reduces the number of public IP addresses required for network connectivity.

2. Cost Efficiency: Organizations can minimize expenses related to purchasing and managing multiple public IP addresses.

3. Enhanced Security: PAT provides an inherent layer of security by hiding internal network structures behind a single address, making it more difficult for attackers to target specific internal devices.

4. Simplified Management: Network administrators need to manage fewer public IP addresses, reducing complexity in firewall configurations and routing tables.

Limitations of PAT

1. Application Compatibility: Some applications that embed IP addresses within their data (rather than using only headers) may require special handling or Application Layer Gateways (ALGs).

2. Connection Tracking Overhead: Maintaining the translation table consumes router resources, potentially affecting performance under extremely heavy loads.

3. Incoming Connection Challenges: PAT makes it difficult to host services that need to accept incoming connections from the internet, requiring additional port forwarding configurations.

Practical Implementation: PAT Lab

Let's explore how to implement PAT in a practical networking scenario. In this lab, we'll configure a network where multiple internal clients with private IP addresses (192.168.0.0/24) will share a single public IP address (30.0.0.120) when accessing the internet.

Network Topology

Our lab consists of:

• Router 1 (R1): Connected to internal network and Router 2

• Router 2 (R2): Connected to Router 1 and external networks/server

• Internal PCs: In the 192.168.0.0/24 network

• External server: In the 20.0.0.0/8 network

Configuration Steps

1. Configure Router Interfaces

First, we set up the router interfaces with appropriate IP addresses:

Router 1 (R1):

enable
configure terminal
hostname R1
interface fastethernet 0/0
ip address 192.168.0.1 255.255.255.0
no shutdown
exit
interface serial 0/0/0
ip address 30.0.0.1 255.0.0.0
no shutdown
exit

Router 2 (R2):

enable
configure terminal
hostname R2
interface fastethernet 0/0
ip address 20.0.0.1 255.0.0.0
no shutdown
exit
interface serial 0/0/0
ip address 30.0.0.2 255.0.0.0
no shutdown
exit

2. Configure Routing

For Router 1, we set a default route pointing to Router 2:

ip route 0.0.0.0 0.0.0.0 30.0.0.2

At this point, connectivity testing will fail as PAT is not yet configured.

3. Configure PAT on Router 1

The PAT configuration involves several key steps:

Define NAT interfaces:

interface fastEthernet 0/0
ip nat inside
exit
interface serial 0/0/0
ip nat outside
exit

Create Address Pool:

ip nat pool test 30.0.0.120 30.0.0.120 netmask 255.0.0.0

This creates a pool named "test" containing just one IP address (30.0.0.120) that will be shared among all internal clients.

Define Access List:

access-list 1 permit 192.168.0.0 0.0.0.255

This access list identifies which internal addresses are eligible for translation.

Apply PAT Configuration:

ip nat inside source list 1 pool test overload

This command ties everything together, specifying that:

• Traffic from the internal network matching access list 1

• Will be translated using the IP address(es) in pool "test"

• With the "overload" parameter enabling port-based multiplexing (PAT)

4. Verify PAT Configuration

To confirm PAT is working correctly:

show ip nat translations

This command displays the active NAT translations, showing how different internal IP address and port combinations are mapped to the single public IP address with unique port numbers.

Example output might look like:

Pro  Inside global     Inside local      Outside local     Outside global
tcp  30.0.0.120:1024   192.168.0.10:1024  20.0.0.2:80      20.0.0.2:80
tcp  30.0.0.120:1025   192.168.0.11:1024  20.0.0.2:80      20.0.0.2:80

This shows two different internal clients (192.168.0.10 and 192.168.0.11) both accessing the web server at 20.0.0.2, but using different source ports on the shared public IP address.

5. Test Access

After PAT configuration, all internal clients should be able to:

• Ping external addresses

• Access web services on the external server

• Use various applications requiring internet connectivity

Alternative PAT Configuration Methods

In addition to using an IP address pool, PAT can be configured to use the router's interface IP address directly:

ip nat inside source list 1 interface serial 0/0/0 overload

This approach is even more streamlined as it automatically uses whatever IP address is assigned to the specified interface.

Troubleshooting PAT

Common issues with PAT configurations include:

1. Translation Table Overflows: If too many simultaneous connections occur, the router might exhaust its NAT table capacity.

2. Application Compatibility: Some applications that embed IP addresses in their payload may not work correctly with PAT.

3. Asymmetric Routing: If return traffic takes a different path that bypasses the PAT router, connections will fail.

4. Port Exhaustion: In extremely busy networks, the available port numbers for a single public IP may become fully utilized.

Useful troubleshooting commands include:

• show ip nat statistics - Displays counters for NAT translations

• debug ip nat - Provides real-time information about NAT operations

• clear ip nat translation * - Clears all dynamic translations from the table

Conclusion

Port Address Translation has become an essential technology in modern networking, allowing organizations to efficiently manage their public IP address space while maintaining robust connectivity for all internal devices. By understanding the principles and implementation details of PAT, network administrators can design scalable, secure, and cost-effective network architectures.

The PAT implementation detailed in our lab exercise demonstrates how multiple clients can share a single public IP address, enabling internet connectivity for entire networks with minimal public address requirements.