Tuesday’s question was worded so that it could test your understanding of several of the commonly-used NAT terms, in particular inside local and inside global. It also assesses whether you understand what happens in a typical NAT environment when a router translates the address used by a host inside the enterprise (source NAT), but does not translate the address used for the host that is presumably somewhere in the Internet (destination NAT). I’ll take a crack today at explaining a few terms, and then give the literal answer to the question at the end of the blog, so it’s easy to find the answer if that’s what you’re after.
The key concept to make sense of the NAT “inside” and “outside” terms is that the terms use the Enterprise engineer’s perspective, not the ISP engineer’s perspective. So, inside refers to hosts inside the Enterprise network, and outside refers to hosts outside the Enterprise – in the classic NAT case of connecting an Enterprise to the Internet, “outside” refers to a host in the Internet, like the web server in the figure.
Again thinking like the Enterprise network engineer, the term “source NAT” refers to changing, or natting (hey, it’s what we say – it just looks funny in written form) the source IP address of packets sent by an inside host. That’s the classic case for NAT – the Enterprise host uses a private IP address, like the 10.1.1.1 address shown in the following figure. Router R1 changes (“nats”) PC1’s IP address (10.1.1.1) into a public IP address known to R1 – in this case, 64.1.1.1 – because you can’t send packets with private IP addresses through the Internet. By using a public, registered, globally-unique IP address, the packet can now legally be forwarded through the Internet – and more importantly, the web server can send a packet back towards PC1.
After the server receives packet A, which had a source address of 64.1.1.1 in this case, the server replies with packet B, with destination address 64.1.1.1. After packet B1 arrives at R1, the router must change/NAT the destination IP address back to 10.1.1.1. That’s frankly one of the confusing parts – the “source NAT” feature translates packets that travel in both directions, but it’s the source address of packets sent by inside hosts, and destination address of packets sent to inside hosts. In this case, the figure shows the translation of the 64.1.1.1 destination address to 10.1.1.1.
(Aside – the IOS configuration for source NAT uses the consecutive keywords “inside source” – referring to the fact that source NAT translates the source address of packets sent by inside hosts.)
(Did I mention I don’t like NAT terms? They can be a pain in the neck. They’re also easy to miss on the exam, so it’s important to work through it. Just a little more to go…)
So, knowing all that, back to the question, which hinges on the terms “inside local” and “inside global”. In this case, 10.1.1.1 is the inside local address, and 64.1.1.1 is the inside global address. More generically, the inside local address is the IP address used to represent the inside host – the host inside the Enterprise, from the Enterprise engineer’s perspective – when the packet is in the local (Enterprise) network. If we could turn back the clock, “inside private” might be a better choice of terms. “Inside global” refers to the IP address used to represent the inside host as its packets flow through the global Internet.
So, if you compare all 5 answers to the facts in the figure, and the fact that 10.1.1.1 is in the inside local address, and that 64.1.1.1 is the inside global address, then you can see that C and E are the correct answers.
Thoughts? Make sense? Clarifications? Feel free to post. Be warned, I’ll be away from the blog until Monday AM, so if you do have questions, please be patient, or maybe some of the other readers will give you a quicker answer.
Answers: C and E
Also, here’s a quick advertisement to pay the bills: Talk with Wendell Odom live Wed. October 24, 2 p.m. – 3 p.m. EST. No registration necessary. Just head to http://www.networkworld.comhttps://www.networkworld.com//chat/ at the appointed time and login.
