Network Working Group                                       P. SrisureshRequest for Comments: 3022                              Jasmine NetworksObsoletes: 1631                                               K. EgevangCategory: Informational                                Intel Corporation                                                            January 2001      Traditional IP Network Address Translator (Traditional NAT)Status of this Memo   This memo provides information for the Internet community.  It does   not specify an Internet standard of any kind.  Distribution of this   memo is unlimited.Copyright Notice   Copyright (C) The Internet Society (2001).  All Rights Reserved.Preface   The NAT operation described in this document extends address   translation introduced in RFC 1631 and includes a new type of network   address and TCP/UDP port translation.  In addition, this document   corrects the Checksum adjustment algorithm published in RFC 1631 and   attempts to discuss NAT operation and limitations in detail.Abstract   Basic Network Address Translation or Basic NAT is a method by which   IP addresses are mapped from one group to another, transparent to end   users.  Network Address Port Translation, or NAPT is a method by   which many network addresses and their TCP/UDP (Transmission Control   Protocol/User Datagram Protocol) ports are translated into a single   network address and its TCP/UDP ports.  Together, these two   operations, referred to as traditional NAT, provide a mechanism to   connect a realm with private addresses to an external realm with   globally unique registered addresses.1. Introduction   The need for IP Address translation arises when a network's internal   IP addresses cannot be used outside the network either for privacy   reasons or because they are invalid for use outside the network.   Network topology outside a local domain can change in many ways.   Customers may change providers, company backbones may be reorganized,   or providers may merge or split.  Whenever external topology changesSrisuresh & Egevang          Informational                      [Page 1]RFC 3022                    Traditional NAT                 January 2001   with time, address assignment for nodes within the local domain must   also change to reflect the external changes.  Changes of this type   can be hidden from users within the domain by centralizing changes to   a single address translation router.   Basic Address translation would (in many cases, except as noted in   [NAT-TERM] and section 6 of this document) allow hosts in a private   network to transparently access the external network and enable   access to selective local hosts from the outside.  Organizations with   a network setup predominantly for internal use, with a need for   occasional external access are good candidates for this scheme.   Many Small Office, Home Office (SOHO) users and telecommuting   employees have multiple Network nodes in their office, running   TCP/UDP applications, but have a single IP address assigned to their   remote access router by their service provider to access remote   networks.  This ever increasing community of remote access users   would be benefited by NAPT, which would permit multiple nodes in a   local network to simultaneously access remote networks using the   single IP address assigned to their router.   There are limitations to using the translation method.  It is   mandatory that all requests and responses pertaining to a session be   routed via the same NAT router.  One way to ascertain this would be   to have NAT based on a border router that is unique to a stub domain,   where all IP packets are either originated from the domain or   destined to the domain.  There are other ways to ensure this with   multiple NAT devices.  For example, a private domain could have two   distinct exit points to different providers and the session flow from   the hosts in a private network could traverse through whichever NAT   device has the best metric for an external host.  When one of the NAT   routers fail, the other could route traffic for all the connections.   There is however a caveat with this approach, in that, rerouted flows   could fail at the time of switchover to the new NAT router.  A way to   overcome this potential problem is that the routers share the same   NAT configuration and exchange state information to ensure a fail-   safe backup for each other.   Address translation is application independent and often accompanied   by application specific gateways (ALGs) to perform payload monitoring   and alterations.  FTP is the most popular ALG resident on NAT   devices.  Applications requiring ALG intervention must not have their   payload encoded, as doing that would effectively disables the ALG,   unless the ALG has the key to decrypt the payload.   This solution has the disadvantage of taking away the end-to-end   significance of an IP address, and making up for it with increased   state in the network.  As a result, end-to-end IP network levelSrisuresh & Egevang          Informational                      [Page 2]RFC 3022                    Traditional NAT                 January 2001   security assured by IPSec cannot be assumed to end hosts, with a NAT   device enroute.  The advantage of this approach however is that it   can be installed without changes to hosts or routers.   Definition of terms such as "Address Realm", "Transparent Routing",   "TU Ports", "ALG" and others, used throughout the document, may be   found in [NAT-TERM].2. Overview of traditional NAT   The Address Translation operation presented in this document is   referred to as "Traditional NAT".  There are other variations of NAT   that will not be explored in this document.  Traditional NAT would   allow hosts within a private network to transparently access hosts in   the external network, in most cases.  In a traditional NAT, sessions   are uni-directional, outbound from the private network.  Sessions in   the opposite direction may be allowed on an exceptional basis using   static address maps for pre-selected hosts.  Basic NAT and NAPT are   two variations of traditional NAT, in that translation in Basic NAT   is limited to IP addresses alone, whereas translation in NAPT is   extended to include IP address and Transport identifier (such as   TCP/UDP port or ICMP query ID).   Unless mentioned otherwise, Address Translation or NAT throughout   this document will pertain to traditional NAT, namely Basic NAT as   well as NAPT.  Only the stub border routers as described in figure 1   below may be configured to perform address translation.        \ | /                 .                                /   +---------------+  WAN     .           +-----------------+/   |Regional Router|----------------------|Stub Router w/NAT|---   +---------------+          .           +-----------------+\                              .                      |         \                              .                      |  LAN                              .               ---------------                        Stub border            Figure 1: Traditional NAT Configuration2.1 Overview of Basic NAT   Basic NAT operation is as follows.  A stub domain with a set of   private network addresses could be enabled to communicate with   external network by dynamically mapping the set of private addresses   to a set of globally valid network addresses.  If the number of local   nodes are less than or equal to addresses in the global set, each   local address is guaranteed a global address to map to.  Otherwise,   nodes allowed to have simultaneous access to external network areSrisuresh & Egevang          Informational                      [Page 3]RFC 3022                    Traditional NAT                 January 2001   limited by the number of addresses in global set.  Individual local   addresses may be statically mapped to specific global addresses to   ensure guaranteed access to the outside or to allow access to the   local host from external hosts via a fixed public address.  Multiple   simultaneous sessions may be initiated from a local node, using the   same address mapping.   Addresses inside a stub domain are local to that domain and not valid   outside the domain.  Thus, addresses inside a stub domain can be   reused by any other stub domain.  For instance, a single Class A   address could be used by many stub domains.  At each exit point   between a stub domain and backbone, NAT is installed.  If there is   more than one exit point it is of great importance that each NAT has   the same translation table.   For instance, in the example of figure 2, both stubs A and B   internally use class A private address block 10.0.0.0/8 [RFC 1918].   Stub A's NAT is assigned the class C address block 198.76.29.0/24,   and Stub B's NAT is assigned the class C address block   198.76.28.0/24.  The class C addresses are globally unique no other   NAT boxes can use them.                                    \ | /                                  +---------------+                                  |Regional Router|                                  +---------------+                                WAN |           | WAN                                    |           |                Stub A .............|....   ....|............ Stub B                                    |           |                  {s=198.76.29.7,^  |           |  v{s=198.76.29.7,                   d=198.76.28.4}^  |           |  v d=198.76.28.4}                    +-----------------+       +-----------------+                    |Stub Router w/NAT|       |Stub Router w/NAT|                    +-----------------+       +-----------------+                          |                         |                          |  LAN               LAN  |                    -------------             -------------                              |                 |            {s=10.33.96.5, ^  |                 |  v{s=198.76.29.7,             d=198.76.28.4}^ +--+             +--+ v d=10.81.13.22}                             |--|             |--|                            /____\           /____\                          10.33.96.5       10.81.13.22                      Figure 2: Basic NAT OperationSrisuresh & Egevang          Informational                      [Page 4]RFC 3022                    Traditional NAT                 January 2001   When stub A host 10.33.96.5 wishes to send a packet to stub B host   10.81.13.22, it uses the globally unique address 198.76.28.4 as   destination, and sends the packet to its primary router.  The stub   router has a static route for net 198.76.0.0 so the packet is   forwarded to the WAN-link.  However, NAT translates the source   address 10.33.96.5 of the IP header to the globally unique   198.76.29.7 before the packet is forwarded.  Likewise, IP packets on   the return path go through similar address translations.   Notice that this requires no changes to hosts or routers.  For   instance, as far as the stub A host is concerned, 198.76.28.4 is the   address used by the host in stub B.  The address translations are   transparent to end hosts in most cases.  Of course, this is just a   simple example.  There are numerous issues to be explored.2.2. Overview of NAPT   Say, an organization has a private IP network and a WAN link to a   service provider.  The private network's stub router is assigned a   globally valid address on the WAN link and the remaining nodes in the   organization have IP addresses that have only local significance.  In   such a case, nodes on the private network could be allowed   simultaneous access to the external network, using the single   registered IP address with the aid of NAPT.  NAPT would allow mapping   of tuples of the type (local IP addresses, local TU port number) to   tuples of the type (registered IP address, assigned TU port number).   This model fits the requirements of most Small Office Home Office   (SOHO) groups to access external network using a single service   provider assigned IP address.  This model could be extended to allow   inbound access by statically mapping a local node per each service TU   port of the registered IP address.   In the example of figure 3 below, stub A internally uses class A   address block 10.0.0.0/8.  The stub router's WAN interface is   assigned an IP address 138.76.28.4 by the service provider.Srisuresh & Egevang          Informational                      [Page 5]RFC 3022                    Traditional NAT                 January 2001                                     \ | /                                   +-----------------------+                                   |Service Provider Router|                                   +-----------------------+                                 WAN |                                     |                 Stub A .............|....                                     |         ^{s=138.76.28.4,sport=1024, |  v{s=138.76.29.7, sport = 23,         ^ d=138.76.29.7,dport=23}   |  v d=138.76.28.4, dport = 1024}                         +------------------+                         |Stub Router w/NAPT|                         +------------------+                           |