4
Address Translation
74
Many-to-one IP address translation
NAT
provides
many
‐
to
‐
one
translation
.
This
means
that
each
NAT
rule
in
the
IP
rule
set
will
translate
between
several
source
IP
addresses
and
a
single
source
IP
address.
To
maintain
session
state
information,
each
NAT
flow
is
translated
to
a
unique
combination
of
port
number
and
IP
address
for
the
source.
The
SEG
then
performs
automatic
translation
of
the
source
port
number
as
well
as
the
IP
address
for
returning
packets.
In
other
words,
the
actual
source
IP
addresses
for
flows
are
all
translated
to
the
same
IP
address
and
the
flows
are
distinguished
from
one
another
by
the
allocation
of
a
unique
port
number
to
each.
The
diagram
below
illustrates
the
concept
of
NAT.
Figure 2. NAT IP address translation
In
the
illustration
above,
three
flows
from
IP
addresses
A
,
B
and
C
are
dynamically
translated
through
a
single
source
IP
address
N
.
The
original
port
numbers
are
also
changed.
The
next
source
port
number
allocated
for
a
new
NAT
flow
will
be
the
first
free
port
selected
randomly
by
the
SEG.
Ports
are
allocated
randomly
to
increase
security
from
external
attack.
Limitations on the number of flows
There
is
a
limitation
of
approximately
64,500
simultaneous
NAT
flows
where
each
flow
consists
of
a
unique
pair
of
IP
addresses.
The
term
IP
pair
means
one
IP
address
on
an
SEG
interface
and
the
IP
address
of
some
external
host
to
which
a
flow
is
being
made.
If
two
different
IP
addresses
on
an
external
host
are
being
connected
to
from
the
same
NAT
address
on
the
security
gateway,
this
will
constitute
two,
unique
IP
pairs.
The
64,500
figure
is
therefore
not
a
limitation
for
the
entire
SEG.
