Cisco ASR 5000 Series, Обзор продукта

Страница: 824 / 992

Network Address Translation Overview
▀ NAT Feature Overview
▄ Cisco ASR 5000 Series Product Overview
OL-22938-02
When configuring a NAT IP pool group, note that only those NAT IP pools that have similar characteristics can be
grouped together. The similarity is determined by the NAT IP pool Type (One-to-One / Many-to-One), users configured
per NAT IP address (applicable only to many-to-one NAT IP pools), NAT IP Address Allocation Mode (On-
demand/Not-on-demand), and Port Chunk Size (applicable only to many-to-one NAT IP pools) parameters. Dissimilar
NAT IP pools cannot be grouped together.
It is recommended that all the NAT IP pools in a NAT IP pool group be configured with the same values for the other
parameters, so that the NAT behavior is predictable across all NAT IP pools in that NAT IP pool group.
The NAT IP pool from which a NAT IP address is assigned will determine the actual values to use for all parameters.
It is recommended that in a Firewall-and-NAT policy all the realms configured either be NAT IP pools or NAT IP pool
groups. If both NAT IP pool(s) and NAT IP pool group(s) are configured, ensure that none of the NAT IP pool(s) are
also included in the NAT IP pool group.
NAT IP Address Allocation and Deallocation
Cisco System‘s implementation of NAPT is Endpoint-independent Mapping, wherein NAT reuses the same NAT source
port mapping for subsequent packets sent from the same private IP address and port, and with the same protocol to any
public destination host IP address and port.
That is, all flows coming from the subscriber for the current session with the same protocol and same source IP address
and source port (X:x) would get the same NAT IP address and NAT port (X:x) irrespective of the destination IP address
and port. NAT will not allow any inbound packets to the NAT IP address and NAT port (X:x) from an external host IP
address and host port (Y:y), unless the internal host (MS) had previously sent a packet of the same protocol type to that
external IP address and Port (Y:y). However, this behavior changes if NAT ALG is enabled. The ALG creates pin holes
/ dynamic routes in the NAT and allows downlink packets that match the pin holes / dynamic routes towards the internal
host (MS) given that there was already a parent connection from MS towards the external host.
The advantage of endpoint-independent mapping is that applications are unaffected by NAT translations.
Inbound connection to the NAT IP address can be allowed in one-to-one pools based on configuration.
NAT IP Address Allocation
The NAT IP address is allocated based on the following parameters:
Maximum Users per NAT IP Address: The maximum number of subscribers sharing a NAT IP address. Once
the number of active subscribers using a NAT IP address reaches this limit, that NAT IP address will not be
allocated to new subscribers.
Port-chunk Thresholds: The threshold is configured in percentage of total number of port-chunks. If the number
of port-chunks already allocated from a given NAT IP address is less than the configured threshold limit of
port-chunks, then the NAT IP address can be chosen for a new subscriber provided the ―Maximum Users per
NAT IP Address‖ is not reached. But if the number of chunks allocated is greater than or equal to the threshold
limit of port-chunks, then the NAT IP address will not be chosen for a new subscriber. The remaining free port-
chunks will be used for existing subscribers using the NAT IP address.