• NAT enables customers to deploy private IP addresses within their network and perform translation to public IP addresses when connecting to the Internet or interconnecting with another corporate network.
• ESP entries in the translation table are normally delayed from being transmitted until a reply is received from the destination. With predictable security parameter indexes (SPIs) and SPI matching, the delay can be eliminated because the SPI entries are matched. Some third-party concentrators require both the source and incoming ports to use port 500. Use of the preserve-port keyword with the ip nat service command preserves the ports rather than changing them, which is required with regular NAT.

Cisco IP phones use the Skinny Client Control Protocol (SCCP) to connect with and register to Cisco Unified CallManager.

To deploy NAT between the IP phone and the Cisco Unified CallManager in a scalable environment, NAT must detect SCCP and understand the information that is passed within these messages. Messages that flow back and forth include the IP address and the port information to identify other IP phone users with whom calls can be placed.

The SCCP client to the Cisco Unified CallManager communication typically flows from inside to outside. The Domain Name System (DNS) is used to resolve the Cisco Unified CallManager IP address connection when the Cisco Unified CallManager is configured on the inside (behind the NAT device), or when static NAT is configured to reach the Cisco Unified CallManager on the inside.

When an IP phone attempts to connect to the Cisco Unified CallManager and matches the configured NAT rules, NAT translates the original source IP address and replaces it with one from the configured pool. This new IP address is reflected in the Cisco Unified CallManager and is visible to other IP phone users.

NAT provides SCCP video message translation support.

NAT provides virtual TCP (vTCP) support to handle TCP segmentation and reassembling for ALG. When a Layer 7 protocol uses TCP for transportation, the payload can be segmented due to various reasons, such as Maximum Segment Size (MSS), application design, and TCP window size. Proper recognition of these TCP segments is required to perform parsing. Therefore, a generic framework called vTCP is used by various ALGs to perform TCP segmentation.

Some applications such as SIP and NAT require the entire payload to rewrite embedded data. In addition, ALGs are not developed to consider data splitting between the packets, which is required for the firewall. Therefore, vTCP is also required for the firewall without any changes to current ALGs. NAT and the firewall ALG configuration activate the vTCP configuration.

vTCP does not support data channel traffic. To protect system resources, vTCP does not support reassembled messages larger than 8 KB.

• NAT ALG--vTCP for SIP

NAT application awareness includes support for Network Basic Input Output System (NetBIOS) applications. A NetBIOS ALG translates IP addresses and port numbers embedded in NetBIOS packets when a NAT mapping is processed. The NAT NetBIOS ALG Support feature introduced the show platform hardware qfp [active | standby] feature alg statistics netbios command to display NetBIOS-specific information for a device and the match protocol netbios command to configure network-based application recognition (NBAR) to match the NetBIOS traffic.

NAT application awareness includes support for remote command (RCMD) execution service applications, remote login (rlogin), remote shell (rsh) protocol, and remote execution (rexec). An RCMD ALG translates IP addresses and port numbers embedded in RCMD application packets when a NAT mapping is processed. The NAT RCMD ALG Support feature introduced the show platform software trace message process qfp active command to display RCMD-specific information for a device.

NAT application awareness includes support for Real-Time Streaming Protocol (RTSP) applications. An RTSP ALG translates IP addresses and port numbers embedded in RTSP packets when a NAT mapping is processed.

SIP is a protocol developed by the IETF Multiparty Multimedia Session Control (MMUSIC) Working Group. The Cisco Session Initiation Protocol (SIP) functionality equips Cisco devices to signal the setup of voice and multimedia calls over IP networks. SIP provides an alternative to H.323 within VoIP internetworking software.

Session Description Protocol (SDP) is a protocol that describes multimedia sessions. SDP may be used in SIP message bodies to describe multimedia sessions used for creating and controlling multimedia sessions with two or more participants.

The NAT Support for SIP feature allows SIP embedded messages passing through a device that is configured with NAT to be translated and encoded back to the packet. An ALG is used with NAT to translate SIP messages.

Note

By default, support for SIP is enabled on port 5060. Therefore, NAT-enabled devices interpret all packets on this port as SIP call messages. If other applications in the system use port 5060 to send packets, the NAT service may corrupt the packet as it attempts to interpret the packet as a SIP call message.

• NAT ALG--SIP Multiple Media Line Support

The NAT ALG--SIP REFER Method feature is used for call transfers. A REFER message is used to refer to a peer. The REFER method indicates that the recipient of a call, identified by a request Uniform Resource Identifier (URI), must contact a third party using the contact information provided in the request.

The NAT ALG--SIP REFER Method feature supports two types of call transfers, unattended (blind) transfer and attended (consultative) transfer.

A SIP trunk is a direct connection of an IP PBX to a service provider over an IP network using SIP. There can be numerous concurrent calls in a SIP trunk. During the call setup process, all calls use the same control channel for call establishment. More than one call uses the same control channel for call setup. When the same control channel is used by more than one call, the stateful information stored in the control channel sessions becomes unreliable. SIP stateful information consists of media channel information such as the IP address and port number used by client/server endpoints to send media data. The media channel information is used to create a door for the data channel in NAT. Because multiple calls use the same control channel for call setup, there will be multiple sets of media data. The NAT ALG--SIP Trunking Support feature uses a local database to store all media-related information within a SIP trunk. Call IDs of each call are used to index this local database.

TCP segmentation in a SIP trunk can cause unexpected behavior that includes packet drops, TCP reset, and slow response.

NAT supports extended methods for SIP.

The ALG--SCCP Version 17 Support feature enables the SCCP ALG to parse SCCP Version 17 packets. Cisco Unified Communications Manager 7.0 and the IP phones that use Cisco Unified Communications Manager 7.0 support only SCCP Version 17 messages. The format of SCCP changed from Version 17 to support IPv6. The SCCP ALG checks for the SCCP version in the prefix of a message before parsing it according to the version. The SCCP message version is extracted from the message header and if it is greater than Version 17, the message is parsed by using the Version 17 format and the IPv4 address and port information is extracted. The SCCP ALG supports the inspection and translation of IPv4 address information in SCCP messages.

Note	IPv6 address inspection and translation are not supported.

H.323 is a recommendation published by the ITU-T defining a series of network elements and protocols for multimedia transmission through packet-based networks. H.323 defines a number of network elements used in multimedia transmission.

Although most H.323 implementations today utilize TCP as the transport mechanism for signaling, H.323 Version 2 enables basic UDP transport.

• H.323 Terminal--This element is an endpoint in the network, providing two-way communication with another H.323 terminal or gateway.
• H.323 Gateway--This element provides protocol conversion between H.323 terminals and other terminals that do not support H.323.
• H.323 Gatekeeper--This element provides services like address translation, network access control, and bandwidth management and account for H.323 terminals and gateways.

The following core protocols are described by the H.323 specification:

• H.225--This protocol describes call signaling methods used between any two H.323 entities to establish communication.
• H.225 Registration, Admission, and Status (RAS)--This protocol is used by the H.323 endpoint and gateway for address resolution and admission control services.
• H.245--This protocol is used for exchanging the capabilities of multimedia communication and for the opening and closing of logical channels for audio, video, and data.

In addition to the protocols listed, the H.323 specification describes the use of various IETF protocols like the Real Time Transport (RTP) protocol and audio (G.711, G.729, and so on) and video (H.261, H.263, and H.264) codecs.

NAT requires a variety of ALGs to handle Layer 7 protocol-specific services such as translating embedded IP addresses and port numbers in the packet payload and extracting new connection/session information from control channels. The H.323 ALG performs these specific services for H.323 messages.

NAT supports all H.225 and H.245 message types, including those sent in the Remote Access Service (RAS) protocol. RAS provides a number of messages that are used by software clients and VoIP devices to register their location, request assistance in call setup, and control bandwidth. RAS messages are directed toward an H.323 gatekeeper.

Some RAS messages include IP addressing information in the payload, typically meant to register a user with the gatekeeper or to learn about another user already registered. If these messages are not known to NAT, they cannot be translated to an IP address that is visible to the public.

Embedded IP addresses can be inspected for potential address translation.

ALG--H.323 v6 supports the parsing of H.323 v6 packets and the inspection and translation of IPv4 address information in H.323 messages. The basic H.323 ALG supports only the parsing of H.323 v4 messages. H.323 v6 extends the basic H.323 ALG support to recognize the new message format and to handle new fields that contain the IPv4 address information.

H.323 v6 consists of core protocols, H.225.0 v6, and H.245 v13 and uses an assigned gatekeeper for transmission.

ALG--H.323 v6 does not support:

• Stream Control Transmission Protocol (SCTP)--This protocol provides similar services like TCP or UDP.
• Configuring of the H225 port number.

NAT provides ALG support for NetMeeting directory Lightweight Directory Access Protocol (LDAP) Version 2 and Version 3 messages.

Users can establish calls/connections among each other directly or through a NetMeeting directory. NetMeeting implements a series of LDAP messages for users to register themselves and perform lookups of other NetMeeting users against the directory. These messages include IP address information.

Before a NAT device can use a NetMeeting directory, NAT needs to understand the LDAP messages and perform standard NAT processing against the IP address information within these messages.

NAT application awareness includes support for the Domain Name System (DNS). An application-level gateway (ALG) translates IP addresses and port numbers embedded in the DNS payload when a NAT mapping is processed.

With CSCuc05660, for DNS payloads that are address-translated, the DNS time to live (TTL) value in CNAME entries is passed through. Before CSCuc05660 and before support for the ip nat service dns-reset-ttl command was added, the TTL value in the CNAME entries was reset by default.

NAT application awareness includes translation support for the Internet Control Message Protocol (ICMP). An ALG translates data embedded in the ICMP payload when a NAT mapping is processed.

NAT application awareness includes support for TFTP. A TFTP ALG creates a path for the TFTP data to traverse the NAT-enabled device.

NAT application awareness includes support for FTP. An FTP ALG performs translation for the IP addresses and TCP port information embedded in the payload of an FTP control session.

• Network Address Translation (NAT) will translate only embedded IPv4 addresses.
• The multicast gatekeeper discovery mechanism is not supported.