You know what I've discovered over the years
is that users occasionally access the internet.
In fact, they do it all the time.
And, also, we might have servers in our DMZs
or at our cloud locations that customers on the internet
are accessing, as well.
So as we consider this network topology,
there is a huge problem, and that problem
is private addresses.
Inside of IPv4 addressing, there are certain ranges of addresses
that can be used by anybody.
So company A can use them, Company B can use them,
Company C can use them, but they're all private,
meaning they aren't routed and won't be forwarded
over the public internet.
And here are some examples of the private address
space-- anything that begins with a 10
or anything that begins with 172 dot and then 16
through 31 dot anything, and then any IP address
that begins with 192.168. anything.
Those are all IP addresses at layer 3
that the internet will not forward,
because they're part of the private address scheme.
And that's going to cause some problems in our network
if we've got some VLANs, which are layer 2 broadcast domains,
and associated with each of those respective VLANs,
we're using IP network addresses-- which we are--
in that private address space.
So, here, we have a layer 2 VLAN 100,
and associated with that, all the devices on that VLAN
100 are using the network address
base of 10.1.0, those first three numbers
being the network.
And then we have the individual computers
with the final number in this topology.
So computer 1 would be at 10.1.0.11 inside of VLAN 100.
And computer 2, perhaps its last number is 22,
and its IP address is 10.2.0.22.
And so the big problem is, though,
is that, when computer 1 or computer 2
wants to forward packets to servers on the internet--
we'll draw a little happy server out here, because he's
up and alive on the internet-- and let's
imagine his address on the internet is 67.83.0.2.
So that's the publicly reachable IP address
of this server on the internet.
And computer 1 and computer 2 want
to send packets back and forth between themselves
and that server.
And the problem is that they're using
private IP addresses, which the internet will not route.
So to solve that, we're going to go ahead and do
a little game called lying.
We are going to lie.
We are going to lie about the real IP addresses
that these devices are using.
And that lying game, regarding lying about the IP addresses,
is called network address translation, or its cousin,
port address translation.
Both of them have the end result of taking a packet that's
going from a private IP address going out to the internet,
lying about that IP address to make it appear
as a globally routable address, an address that can really
work on the internet.
It's always good to start off with a plan as far
as accomplishing network address translation,
to do so, let's go ahead and use this router right here.
And that will be our NAT device, our NAT router.
Let's also imagine that, working with our ISP,
we've been assigned the routable internet address of 23.1.1.1.
So that's a starting point, having
a routable address that we can use on the internet.
And if we only have one IP address,
we might have hundreds or thousands
of customers that need to be translated into that one
address.
That is what's referred to as port address translation.
And let's talk for a moment why it might be called port address
translation.
If we have 1,000 computers, and they're all sending packets
out to the internet, and they all
appear like they're coming from one single IP address, when
those replies all come back, it would be handy
if the router could keep track of all
those individual sessions so it could untranslate the replies
and send them back to the actual computers.
So to do so, the router, as it tracks all those sessions going
through it for translation, is going
to be looking not only at layer 3 information,
but also layer 4 information, including port numbers.
And by using a combination of both layer 3 information,
for example, computer 1's source IP address,
as well as the ports involved at layer,
4 if we're using TCP or UDP, all that information
goes into the translation table so that,
when the reply comes back, the router
can keep track of which PC should
receive that reply that's coming back from the server.
And because it's doing port address translation,
a client, when it makes a request, may use port 1234,
and the router could go ahead and use something completely
different, like 4359.
And as that request goes out using a source port of 4359,
the server is going to reply back
to that port, at which point this router is going
to untranslate that and put back 1234 and send that packet back
to that port.
So, in that sense, it literally is-- for UDP and TCP traffic--
it is also doing port address translation, as well as
the IP address translation.
So we can use the technique of port address translation
to translate lots and lots of hosts on the inside
to a single IP address on the outside.
I hope this has been informative for you,
and I'd like to thank you for viewing.