Subject: clarification on NAT

From: Krishnan Subramaniam <[email-masked]>
Date: Tue, 12 Dec 2000 14:05:01 +0530

hello,

i have the following clarifications regarding NAT.

1-)how are the routing lookup done in a NAT router ?
    a) whether the routing entries are based on virtual
        (translated)address (or) ,
    b) or whether the entries are based on private or 
    inner network address ;

in case of (a) while converting the destination address
from outer to inner the lookup has to be done first before
the conversion , while in case (b) it has to be the reverse

while CISCO has suggested (b) intel has suggested (a);

Intel's case is applicable when both sides of the NAT router
has private address (e.g. 10.1.0.0) they have to be translated
as (10.2.0.0) from interface-A to interface-B and as (10.3.0.0) 
from interface-B to interface-A. In this case the routing
table has to have the entries for 10.2.0.0 and 10.3.0.0 and not
10.1.0.0 

what is the correct way , or what is the way out for handling
both case (a) and (b) ;

2-)regarding PAT , how is the destination address translation 
taken care off when there is IP-fragmentation ; 

Generally we hash (src addr, src port ) to (assigned addr , assig-
ned port) when we do the translation from inner to outer ; While
there is no problem in hash lookup from inside to outside translation
the hash look up is not possible for outside to inside translation
except for the first fragment - the other fragments do not have UDP
or TCP header for which we still have to translate the destination 
ip-address ; In this case do we have to create a entry for the
translation when we see the frist fragment with the ip-identifier
(with offset = zero) and then for subsequent fragments with the same 
Id do a hash lookup with the Identifier field ; this appears to be 
the solution ;

is there a alternate way ?

thanking you before hand for your suggestions

krishnan

hello,

i have the following clarifications regarding
NAT.

1-)how are the routing lookup done in a NAT
router ?

a) whether the routing entries are based on virtual

(translated)address (or) ,

b) or
whether the entries are based on private or

inner network address ;

in case of (a) while converting the destination
address

from outer to inner the lookup has to be done first
before

the conversion , while in case (b) it has to be
the reverse

while CISCO has suggested (b) intel has suggested
(a);

Intel's case is applicable when both sides
of the NAT router

has private address (e.g. 10.1.0.0) they
have to be translated

as (10.2.0.0) from interface-A to interface-B and as
(10.3.0.0)

from interface-B to
interface-A. In this case the routing

table has to have the entries for 10.2.0.0 and 10.3.0.0
and not

10.1.0.0

what is the correct way , or what is the way out
for handling

both case (a) and (b) ;

2-)regarding PAT , how is the destination address
translation

taken care off when there is IP-fragmentation ;

Generally we hash (src addr, src port ) to (assigned
addr , assig-

ned port) when we do the translation from inner to
outer ; While

there is no problem in hash lookup from inside to
outside translation

the hash look up is not possible for outside to inside
translation

except for the first fragment - the other fragments do
not have UDP

or TCP header for which we still have to translate the
destination

ip-address ; In this case do we have to create a entry
for the

translation when we see the frist fragment with the
ip-identifier

(with offset = zero) and
then for subsequent fragments with the same

Id do a hash lookup with the Identifier field ; this
appears to be

the solution ;

is there a alternate way ?

thanking you before hand for your
suggestions

krishnan