Network Address Translation (NAT) enables private IP internetworks that use nonregistered IP addresses to connect to the Internet. NAT operates on a device, usually connecting two networks, and translates private (not globally unique) IP addresses in the internal network into legal IP addresses before packets are forwarded to another network. You can configure NAT to advertise only one IP address for the entire network to the outside world. This ability provides additional security, effectively hiding the entire internal network behind one IP address.

A device configured with NAT has at least one interface to the inside network and one to the outside network. In a typical environment, NAT is configured at the exit router between a stub domain and a backbone. When a packet leaves the domain, NAT translates the locally significant source IP address into a globally unique IP address. When a packet enters the domain, NAT translates the globally unique destination IP address into a local IP address. If more than one exit point exists, NAT configured at each point must have the same translation table.

NAT is described in RFC 1631.

Static Network Address Translation (NAT) allows the user to configure one-to-one translations of the inside local addresses to the outside global addresses. It allows both IP addresses and port number translations from the inside to the outside traffic and the outside to the inside traffic. The Cisco Nexus device supports Hitless NAT, which means that you can add or remove a NAT translation in the NAT configuration without affecting the existing NAT traffic flows.

Static NAT creates a fixed translation of private addresses to public addresses. Because static NAT assigns addresses on a one-to-one basis, you need an equal number of public addresses as private addresses. Because the public address is the same for each consecutive connection with static NAT, and a persistent translation rule exists, static NAT enables hosts on the destination network to initiate traffic to a translated host if an access list exists that allows it .

With dynamic NAT and Port Address Translation (PAT), each host uses a different address or port for each subsequent translation. The main difference between dynamic NAT and static NAT is that static NAT allows a remote host to initiate a connection to a translated host if an access list exists that allows it, while dynamic NAT does not.

The figure shows a typical static NAT scenario. The translation is always active so both translated and remote hosts can originate connections, and the mapped address is statically assigned by the static command.

These are key terms to help you understand static NAT:

• NAT inside interface—The Layer 3 interface that faces the private network.

• NAT outside interface—The Layer 3 interface that faces the public network.

• Local address—Any address that appears on the inside (private) portion of the network.

• Global address—Any address that appears on the outside (public) portion of the network.

• Legitimate IP address—An address that is assigned by the Network Information Center (NIC) or service provider.

• Inside local address—The IP address assigned to a host on the inside network. This address does not need to be a legitimate IP address.

• Outside local address—The IP address of an outside host as it appears to the inside network. It does not have to be a legitimate address, because it is allocated from an address space that can be routed on the inside network.

• Inside global address—A legitimate IP address that represents one or more inside local IP addresses to the outside world.

• Outside global address—The IP address that the host owner assigns to a host on the outside network. The address is a legitimate address that is allocated from an address or network space that can be routed.

Dynamic Network Address Translation (NAT) translates a group of real IP addresses into mapped IP addresses that are routable on a destination network. Dynamic NAT establishes a one-to-one mapping between unregistered and registered IP addresses; however, the mapping can vary depending on the registered IP address that is avkailable at the time of communication.

A dynamic NAT configuration automatically creates a firewall between your internal network and outside networks or the Internet. Dynamic NAT allows only connections that originate inside the stub domain—a device on an external network cannot connect to devices in your network, unless your device has initiated the contact.

Dynamic NAT translations do not exist in the NAT translation table until a device receives traffic that requires translation. Dynamic translations are cleared or timed out when not in use to make space for new entries. Usually, NAT translation entries are cleared when the ternary content addressable memory (TCAM) entries are limited. The default minimum timeout for dynamic NAT translations is 30 minutes. The minimum value of the sampling-timeout in the ip nat translation sampling-timeout command was reduced from 30 minutes to 15 minutes.

Timeout of a dynamic NAT translation involves both the sampling-timeout value and the TCP or UDP timeout value. The sampling-timeout specifies the time after which the device checks for dynamic translation activity. It has a default value of 12 hours. All the other timeouts start only after the sample-timeout times out. After the sampling-timeout, the device inspects the packets that are hitting this translation. The checking happens for the TCP or UDP timeout period. If there are no packets for the TCP or UDP timeout period, the translation is cleared. If activity is detected on the translation, then the checking is stopped immediately and a sampling-timeout period begins.

After waiting for this new sampling-timeout period, the device checks for dynamic translation activity again. During an activity check the TCAM sends a copy of the packet that matches the dynamic NAT translation to the CPU. If the Control Plane Policing (CoPP) is configured at a low threshold, the TCP or UDP packets might not reach the CPU, and the CPU considers this as inactivity of the NAT translation.

Dynamic NAT supports Port Address Translation (PAT) and access control lists (ACLs). PAT, also known as overloading, is a form of dynamic NAT that maps multiple unregistered IP addresses to a single registered IP address by using different ports. Your NAT configuration can have multiple dynamic NAT translations with same or different ACLs. However, for a given ACL, only one interface can be specified.

After dynamic NAT translations are created, they must be cleared when not in use so that newer translations can be created, especially because the number of TCAM entries is limited. Cisco NX-OS Release 7.x supports syn-timeout and finrst-timeout . The following NAT translation timeout timers are supported on the switch:

• syn-timeout —Timeout value for TCP data packets that send the SYN request, but do not receive a SYN-ACK reply.

  The timeout value ranges from 1 second to 172800 seconds. The default value is 60 seconds.

• finrst-timeout —Timeout value for the flow entries when a connection is terminated by receiving RST or FIN packets. Use the same keyword to configure the behavior for both RST and FIN packets.

  • If an RST packet is received after the connection is established, SYN-->SYN-ACK-->RST, the flows are expired after the configured timeout value.

  • If a FIN packet is received after the connection is established, SYN-->SYN-ACK-->FIN, the finrst timer starts.

  • If a FIN-ACK is received from the other side, the translation entry is cleared immediately, else it clears after the timeout value completes.

    Note	If dynamic pool-based configuration is used and a FIN-ACK is received, the translation entry is not cleared.

  The timeout value ranges from 1 second to 172800 seconds. The default value is 60 seconds.

• tcp-timeout —Timeout value for TCP translations for which connections have been established after a three-way handshake (SYN, SYN-ACK, ACK). If no active flow occurs after the connection has been established, the translations expire as per the configured timeout value. This timeout value starts after the sampling timeout value completes.

  The timeout value ranges from 60 seconds to 172800 seconds, including the sampling-timeout.

• udp-timeout —Timeout value for all NAT UDP packets.

  The timeout value ranges from 60 seconds to 172800 seconds, including the sampling-timeout.

• timeout—Timeout value for dynamic NAT translations.

  The timeout value ranges from 60 seconds to 172800 seconds, including the sampling-timeout.

• sampling-timeout —Time after which the device checks for dynamic translation activity.

  The timeout value ranges from 120 seconds to 172800 seconds.

The tcp-timeout, udp-timeout, and the timeout value timers are triggered after the timeout configured for the ip nat translation sampling-timeout command expires.

Note	All the above timers will take additional time (01 to 30 seconds) to expire. This additional time is to randomize the timer expiry events for performance and optimization.

NAT inside refers to networks owned by an organization that must be translated. When NAT is configured, hosts within this network will have addresses in one space (known as the local address space) that will appear to those outside the network as being in another space (known as the global address space).

Similarly, NAT outside refers to those networks to which the stub network connects. They are not generally under the control of the organization. Hosts in outside networks can be subject to translation and can have local and global addresses.

Dynamic NAT allows the configuration of a pool of global addresses that can be used to dynamically allocate a global address from the pool for every new translation. The addresses are returned to the pool after the session ages out or is closed. This allows for a more efficient use of addresses based on requirements.

Support for PAT includes the use of the global address pool. This further optimizes IP address utilization. PAT exhausts one IP address at a time with the use of port numbers. If no port is available from the appropriate group and more than one IP address is configured, PAT moves to the next IP address and gets the allocation based on the user defined pool (ignoring the source port or attempting to preserve it).

With dynamic NAT and PAT, each host uses a different address or port for each subsequent translation. The main difference between dynamic NAT and static NAT is that static NAT allows a remote host to initiate a connection to a translated host if an access list exists that allows it, while dynamic NAT does not.

When both the source IP address and the destination IP address are translated as a single packet that goes through a Network Address Translation (NAT) device, it is referred to as twice NAT. Twice NAT is supported for static and dynamic translations.

Twice NAT allows you to configure two NAT translations (one inside and one outside) as part of a group of translations. These translations can be applied to a single packet as it flows through a NAT device. When you add two translations as part of a group, both the individual translations and the combined translation take effect.

A NAT inside translation modifies the source IP address and port number when a packet flows from inside to outside. It modifies the destination IP address and port number when the packet returns from outside to inside. NAT outside translation modifies the source IP address and port number when the packet flows from outside to inside, and it modifies the destination IP address and port number when the packet returns from inside to outside.

Without twice NAT, only one of the translation rules is applied on a packet, either the source IP address and port number or the destination IP address and port number.

Static NAT translations that belong to the same group are considered for twice NAT configuration. If a static configuration does not have a configured group ID, the twice NAT configuration will not work. All inside and outside NAT translations that belong to a single group that is identified by the group ID are paired to form twice NAT translations.

Dynamic twice NAT translations dynamically select the source IP address and port number information from pre-defined ip nat pool or interface overload configurations. Packet filtration is done by configuring ACLs, and traffic must originate from the dynamic NAT translation rule direction such that source translation is done by using dynamic NAT rules.

Dynamic twice NAT allows you to configure two NAT translations (one inside and one outside) as part of a group of translations. One translation must be dynamic and other translation must be static. When these two translations are part of a group of translations, both the translations can be applied on a single packet as it goes through the NAT device either from inside to outside or from outside to inside.

Static NAT has the following configuration guidelines and limitations:

• NAT supports up to 1024 translations which include both static and dynamic NAT.

• Cisco Nexus 3500 Series switches do not support static and dynamic NAT on vPC topology.

• The Cisco Nexus device supports NAT on the following interface types:

  • Switch Virtual Interfaces (SVIs)

  • Routed ports

  • Layer 3 port channels

• NAT is supported for IPv4 Unicast only.

• The Cisco Nexus device does not support the following:

  • Application layer translation. Layer 4 and other embedded IPs are not translated, including FTP, ICMP failures, IPSec, and HTTPs.

  • NAT and VLAN Access Control Lists (VACLs) that are configured on an interface at the same time.

  • PAT translation of fragmented IP packets.

  • NAT translation on software forwarded packets. For example, packets with IP-options are not NAT translated.

• Egress ACLs are applied to the original packets and not the NAT translated packets.

• By default, NAT can go up to 127 translations with 256 TCAM entries. If you need more NAT translations, you need to reduce the TCAM region allocation in other areas and then increase the NAT TCAM region using the hardware profile tcam region nat command.

• HSRP and VRRP are supported on NAT inside address and not on NAT outside addresses.

• Warp mode latency performance is not supported on packets coming from the outside to the inside domain.

• If an IP address is used for Static NAT or PAT translations, it cannot be used for any other purpose. For example, it cannot be assigned to an interface.

• For Static NAT, the outside global IP address should be different from the outside interface IP address.

• If the translated IP is part of the outside interface subnet, then use the ip local-proxy-arp command on the NAT outside interface.

• NAT statistics are not available.

• When configuring a large number of translations (more than 100), it is faster to configure the translations before configuring the NAT interfaces.

• Only one of the following features can be enabled on an interface at a time. If more than one of these features is enabled on an interface, only the feature that is enabled last will work:

  • NAT
  • DHCP Relay
  • VACL

• More than 127 PD NAT statics entries are not supported because of a hardware limitation that inconsistently increment the CoPP hardware counters.

See the following guidelines for configuring dynamic twice NAT:

• In dynamic twice NAT, if dynamic NAT flows are not created before creating static NAT flows, dynamic twice NAT flows are not created correctly.

• When an empty ACL is created, the default rule of permit ip any any is configured. The NAT-ACL does not match further ACL entries if the first ACL is blank.

• The maximum number of supported ICMP translations or flow entries is 176 for an optimal utilization of the TCAM space.

• NAT is ECMP aware and it supports a maximum of 24 ECMP paths.

• Cisco NX-OS Release 9.x supports Network Address Translation (NAT) statistics on Cisco Nexus 3548 switches.

• Traceroute is not supported on static and dynamic NAT

VRF aware NAT is supported by static and dynamic NAT configurations. When the traffic is configured to flow from a non-default VRF (inside) to the same non-default VRF (outside), the match-in-vrf option of the IP NAT command must be specified. 

When the traffic is configured to flow from a non-default VRF (inside) to a default VRF (outside), the match-in-vrf option of the IP NAT command cannot be specified. A NAT outside configuration is not supported on a non-default VRF interface when the NAT inside is configured on a default VRF interface.

When overlapping addresses are configured across different VRFs for a NAT inside interface, a NAT outside interface should not be the default VRF interface. For example, vrfA and vrfB are configured as NAT inside interfaces with same source subnets and a NAT outside interface is configured as the default VRF. NAT is not supported in a configuration like this because of the ambiguity in routing packets from a NAT outside interface to NAT inside interface.