Network Address Translation (NAT) enables private IP internetworks that use nonregistered IP addresses to connect to the Internet. NAT operates on a device, usually connecting two networks, and translates private (not globally unique) IP addresses in the internal network into legal IP addresses before packets are forwarded to another network. You can configure NAT to advertise only one IP address for the entire network to the outside world. This ability provides additional security, effectively hiding the entire internal network behind one IP address.

A device configured with NAT has at least one interface to the inside network and one to the outside network. In a typical environment, NAT is configured at the exit router between a stub domain and a backbone. When a packet leaves the domain, NAT translates the locally significant source IP address into a globally unique IP address. When a packet enters the domain, NAT translates the globally unique destination IP address into a local IP address. If more than one exit point exists, NAT configured at each point must have the same translation table.

NAT is described in RFC 1631.

Static Network Address Translation (NAT) allows the user to configure one-to-one translations of the inside local IP addresses to inside global IP addresses. It allows both IP addresses and port number translations from the inside to the outside traffic and the outside to the inside traffic. The Cisco Nexus® device supports Hitless NAT, which means that you can add or remove a NAT translation in the NAT configuration without affecting the existing NAT traffic flows.

Static NAT creates a fixed translation of private addresses to public addresses. Because static NAT assigns addresses on a one-to-one basis, you need an equal number of public addresses as private addresses. Because the public address is the same for each consecutive connection with static NAT, and a persistent translation rule exists, static NAT enables hosts on the destination network to initiate traffic to a translated host if an access list exists that allows it .

The main difference between static and dynamic NAT is that for dynamic NAT, translations do not exist in the NAT translation table until a device receives traffic that requires translation. Dynamic translations are cleared or timed out when not in use to make space for new entries based on configured and applicable NAT timeouts. Static entries exist all the time irrespective of the device receiving traffic. However, for both static and dynamic NAT, each host can use different address or port for each subsequent translation based on different configurations, like overload.

The figure shows a typical static NAT scenario. The translation is always active so both translated and remote hosts can originate connections, and the mapped address is statically assigned by the static command.

These are key terms to help you understand static NAT:

• NAT inside interface—The Layer 3 interface that faces the private network.

• NAT outside interface—The Layer 3 interface that faces the public network.

• Local address—Any address that appears on the inside (private) portion of the network.

• Global address—Any address that appears on the outside (public) portion of the network.

• Legitimate IP address—An address that is assigned by the Network Information Center (NIC) or service provider.

• Inside local address—The IP address assigned to a host on the inside network. This address does not need to be a legitimate IP address.

• Outside local address—The IP address of an outside host as it appears to the inside network. It does not have to be a legitimate address, because it is allocated from an address space that can be routed on the inside network.

• Inside global address—A legitimate IP address that represents one or more inside local IP addresses to the outside world.

• Outside global address—The IP address that the host owner assigns to a host on the outside network. The address is a legitimate address that is allocated from an address or network space that can be routed.

Dynamic Network Address Translation (NAT) translates a group of real IP addresses into mapped IP addresses that are routable on a destination network. Dynamic NAT establishes a one-to-one mapping between unregistered and registered IP addresses; however, the mapping can vary depending on the registered IP address that is available at the time of communication.

A dynamic NAT configuration automatically creates a firewall between your internal network and outside networks or the Internet. Dynamic NAT allows only connections that originate inside the stub domain—a device on an external network cannot connect to devices in your network, unless your device has initiated the contact.

Dynamic NAT translations do not exist in the NAT translation table until a device receives traffic that requires translation. Dynamic translations are cleared or timed out when not in use to make space for new entries based on configured and applicable NAT timeouts. Usually, NAT translation entries are cleared based on timers. The default minimum timeout for dynamic NAT translations is 3600 seconds.

Note	The ip nat translation sampling-timeout command is not supported. Statistics are collected every 60 seconds for the installed NAT policies. These statistics are used to determine if the flow is active or not.

Dynamic NAT supports Port Address Translation (PAT) and access control lists (ACLs). PAT, also known as overloading, is a form of dynamic NAT that maps multiple unregistered IP addresses to a single registered IP address by using different ports.

After dynamic NAT translations are created, they must be cleared when not in use so that newer translations can be created, especially because the number of TCAM entries is limited. This release supports syn-timeout and finrst-timeout . The following NAT translation timeout timers are supported on the switch:

The following NAT translation timeout timers are supported on the switch:

• syn-timeout —Timeout value for TCP data packets that send the SYN request, but do not receive a SYN-ACK reply. The timeout value ranges from 1 second to 172800 seconds. The default value is 60 seconds.

• finrst-timeout —Timeout value for the flow entries when a connection is terminated by receiving RST or FIN packets. Use the same keyword to configure the behavior for both RST and FIN packets. The timeout value ranges from 1 second to 172800 seconds. The default value is 60 seconds.

  If a FIN packet is received after the connection is established, SYN >SYN-ACK >FIN, the finrst timer starts.

  If a FIN-ACK is received from the other side, the translation entry is cleared immediately, else it clears after the timeout value completes.

  If an RST packet is received after the connection is established, SYN >SYN-ACK >RST, the translation entry is cleared immediately.

• tcp-timeout —Timeout value for TCP translations for which connections have been established after a three-way handshake (SYN, SYN-ACK, ACK). If no active flow occurs after the connection has been established, the translations expire as per the configured timeout value.

  The timeout value ranges from 60 seconds to 172800 seconds; default is 3600 seconds.

• udp-timeout —Timeout value for all NAT UDP packets.

  The timeout value ranges from 60 seconds to 172800 seconds; default is 3600 seconds.

• timeout—Timeout value for dynamic NAT translations.

  The timeout value ranges from 60 seconds to 172800 seconds; default is 3600 seconds.

• icmp-timeout— Timeout value for ICMP packets.

  The timeout value ranges from 60 seconds to 172800 seconds; default is 3600 seconds.

Note	When you create dynamic entries without timeouts configured, they take the default timeout of 3600 seconds. After you change the default timeout values to the new values, the translation entries created after will pick up the latest timeout values.

NAT inside refers to networks owned by an organization that must be translated. When NAT is configured, hosts within this network will have addresses in one space (known as the local address space) that will appear to those outside the network as being in another space (known as the global address space).

Similarly, NAT outside refers to those networks to which the stub network connects. They are not generally under the control of the organization. Hosts in outside networks can be subject to translation and can have local and global addresses.

NAT uses the following definitions:

• Local address—A local IP address that appears on the inside of a network.

• Global address—A global IP address that appears on the outside of a network.

• Inside local address—The IP address that is assigned to a host on the inside network. The address is probably not a legitimate IP address assigned by the Internet Network Information Center (InterNIC) or a service provider.

• Inside global address—A legitimate IP address (assigned by InterNIC or a service provider) that represents one or more inside local IP addresses to the outside world.

• Outside local address—The IP address of an outside host as it appears to the inside network. The address is not necessarily legitimate; it was allocated from the address space that is routable on the inside.

• Outside global address—The IP address that is assigned to a host on the outside network by the owner of the host. The address was allocated from a globally routable address or a network space.

Cisco NX-OS provides pool support for dynamic NAT. Dynamic NAT allows the configuration of a pool of global addresses that can be used to dynamically allocate a global address from the pool for every new translation. The addresses are returned to the pool after the session ages out or is closed. This allows for a more efficient use of addresses based on requirements.

Support for PAT includes the use of the global address pool. This further optimizes IP address utilization. PAT exhausts one IP address at a time with the use of port numbers. If no port is available from the appropriate group and more than one IP address is configured, PAT moves to the next IP address and gets the allocation based on the user defined pool (ignoring the source port or attempting to preserve it).

With dynamic NAT and PAT, each host uses a different address or port for each subsequent translation. The main difference between dynamic NAT and static NAT is that static NAT allows a remote host to initiate a connection to a translated host if an access list exists that allows it, while dynamic NAT does not.

Static NAT has the following configuration guidelines and limitations:

• NAT is supported for IPv4 Unicast only.

• If the translated IP is part of the outside interface subnet, then use the ip proxy-arp command on the NAT outside interface. If the add-route keyword is used, ip proxy-arp should be enabled.

• The Cisco Nexus device supports NAT on the following interface types:

  • Switch Virtual Interfaces (SVIs)

  • Physical layer 3 interfaces

  • Port channel layer 3 interfaces

• Non-TCP/ UDP packets are always software translated.

• show commands with the internal keyword are not supported.

• If an IP address is used for Static NAT or PAT translations, it cannot be used for any other purpose. For example, it cannot be assigned to an interface.

• When configuring a large number of translations (more than 100), it is faster to configure the translations before configuring the NAT interfaces.

• Twice NAT is not supported.

• Configuring NAT inside and outside rules together is not supported.

• NAT configurations such as IP NAT inside or IP NAT outside are not supported on loopback interfaces.

The following restrictions apply to dynamic Network Address Translation (NAT):

• show commands with the internal keyword are not supported.

• VXLAN routing is not supported on Cisco Nexus devices.

• Fragmented packets are not supported.

• Application layer gateway (ALG) translations are not supported. ALG, also known as application-level gateway, is an application that translates IP address information inside the payload of an application packet.

• Egress ACLs are not applied to translated packets.

• MIBs are not supported.

• Cisco Data Center Network Manager (DCNM) is not supported.

• Multiple global virtual device contexts (VDCs) are not supported on Cisco Nexus devices.

• Dynamic NAT translations are not synchronized with active and standby devices.

• Stateful NAT is not supported. However, NAT and Hot Standby Router Protocol (HSRP) can coexist.

• The timeout value for take up to the configured time-out + 119 seconds.

• For dynamic NAT, pool overload and interface overload are not supported for the outside NAT.

• The Cisco Nexus devices does not support NAT and VLAN Access Control Lists (VACLs) that are configured on an interface at the same time.

• NAT configurations such as ip nat inside or ip nat outside are not supported on loopback interfaces.