1 00:00:00,690 --> 00:00:07,580 So why do we need NAT or network address translation, the major reason is IP version 4 address exhaustion. 2 00:00:08,070 --> 00:00:14,340 For years there's been a worry that IP version 4 addresses would run out and they have essentially 3 00:00:14,340 --> 00:00:14,850 run out 4 00:00:14,850 --> 00:00:22,190 today. There's this drive to move to IP Version 6 because of IP Version 4 addresses exhaustion. 5 00:00:22,680 --> 00:00:28,800 However, it's probably more than likely that you're still using an IP version 4 address 6 00:00:29,250 --> 00:00:35,430 and in a lot of networks today, engineers still need to make the move to IP version 6. 7 00:00:35,940 --> 00:00:40,500 One of the reasons for that is because of RFC 1918. 8 00:00:41,040 --> 00:00:45,320 RFC 1918 was drafted in February 1996. 9 00:00:45,750 --> 00:00:48,430 So in other words, it's been around for a long time. 10 00:00:48,960 --> 00:00:52,500 This discusses the address allocation for private Internets. 11 00:00:53,610 --> 00:00:59,160 I'm not going to bore you going through the entire document, but notice in Section 3, they talk 12 00:00:59,160 --> 00:01:00,600 about private address space. 13 00:01:01,260 --> 00:01:07,590 The Internet assigned numbers authority or IANA, has reserved the following three blocks of IP address 14 00:01:07,590 --> 00:01:14,840 space for private Internets, 10.0.0.0 up to 10.255.255.255. 15 00:01:15,510 --> 00:01:24,520 In other words, a 10/8 prefect's, 172.16.0.0 up to 172. 31.255.255. 16 00:01:25,650 --> 00:01:33,930 This is a 172.16/12 prefects, and then we have 192.168.0.0 up to 192.168.255. 17 00:01:33,930 --> 00:01:35,590 255, 255. 18 00:01:36,180 --> 00:01:39,480 This is a 192.168/16 prefects. 19 00:01:40,650 --> 00:01:48,810 In my example here, I'm using a 192.168.189 address internally. 20 00:01:48,810 --> 00:01:49,290 PC? 21 00:01:51,890 --> 00:01:59,000 More than likely, if you're at home using one of these IP version four dresses in companies as mentioned, 22 00:01:59,000 --> 00:02:03,590 such as Apple or HP, you may be using a public IP address. 23 00:02:04,460 --> 00:02:08,990 So RFC1918 was drafted to try and conserve IP addresses. 24 00:02:09,530 --> 00:02:16,190 The idea here is that rather than allocating public IP addresses to every device in the Internet. 25 00:02:17,170 --> 00:02:24,940 Devices within companies could be allocated these addresses and they could be NATTED or translated 26 00:02:24,940 --> 00:02:29,090 when they needed to access the Internet with port address, translation or PAT. 27 00:02:29,620 --> 00:02:35,460 The idea is, is that you overloading an IP address, hence the term that Cisco uses. 28 00:02:36,040 --> 00:02:41,560 We could have one public IP address used by 500 internal devices. 29 00:02:42,010 --> 00:02:43,450 These RFC 30 00:02:43,480 --> 00:02:47,030 1918 addresses are non-routable on the Internet. 31 00:02:47,530 --> 00:02:55,330 In other words, Internet service providers will block or drop traffic going to or coming from these 32 00:02:55,330 --> 00:02:56,350 address ranges. 33 00:02:56,860 --> 00:03:02,950 Well, that's assuming that they've configured their routers correctly, but they should have access 34 00:03:02,950 --> 00:03:07,780 lists blocking those addresses so that they are non-routable on the Internet. 35 00:03:08,470 --> 00:03:16,090 These RFC 1918 addresses are used internally within organizations and hence we have the term private 36 00:03:16,090 --> 00:03:23,530 addresses used within private networks and public addresses used on the global or public Internet. 37 00:03:24,450 --> 00:03:30,040 Now, technically, there's nothing stopping private IP addresses from being routed across the Internet. 38 00:03:30,600 --> 00:03:36,770 The reason they're non-routable is because ISPs are blocking traffic to or from those address ranges. 39 00:03:37,440 --> 00:03:42,870 So the issue is if private IP addresses are non-routable, how do we get onto the Internet? 40 00:03:43,410 --> 00:03:49,590 Well, that's where network address, translation or NAT comes in, NAT allows us to translate a private 41 00:03:49,590 --> 00:03:52,080 IP address to a public IP address. 42 00:03:52,740 --> 00:03:58,650 Your Internet service provider or ISP will allocate you an IP address or range of IP addresses. 43 00:03:59,130 --> 00:04:06,990 A router or another type of device will translate your internal private IP addresses to that globally 44 00:04:06,990 --> 00:04:09,150 routable public IP address. 45 00:04:09,990 --> 00:04:17,010 Now the terminology that Cisco use can be confusing and it's something that people often struggle with. 46 00:04:17,579 --> 00:04:25,200 Cisco use the terms inside local address, inside global address, outside local address and outside 47 00:04:25,200 --> 00:04:26,010 global address. 48 00:04:26,640 --> 00:04:30,280 Now the terms used in network address translation can be very confusing. 49 00:04:30,930 --> 00:04:37,050 This is probably one of the hardest things to understand with NAT Cisco use these terms inside local 50 00:04:37,050 --> 00:04:43,590 address, inside global address, outside local address and outside global address, to try and help you 51 00:04:43,590 --> 00:04:45,290 remember these terms. 52 00:04:45,300 --> 00:04:46,920 Think of the following analogy. 53 00:04:47,490 --> 00:04:55,800 The PC in this topology, PC 1 is an insider in your organization, insiders in your organization, 54 00:04:55,830 --> 00:05:03,840 or people who work for your company or who have access to the inside network or local area network. 55 00:05:04,410 --> 00:05:08,100 So this PC is an inside host or insider. 56 00:05:08,640 --> 00:05:11,070 The server, on the other hand, is an outsider. 57 00:05:11,640 --> 00:05:14,100 It doesn't belong to your organization. 58 00:05:14,370 --> 00:05:16,280 It's on the global Internet. 59 00:05:16,710 --> 00:05:18,570 It is an outside host. 60 00:05:19,230 --> 00:05:22,860 The network that the PC is connected to is the local area network. 61 00:05:23,790 --> 00:05:27,510 This is a local LAN or local network. 62 00:05:27,870 --> 00:05:34,620 If you ran Wireshark on this network and captured packets, they would be deemed to be local addresses 63 00:05:34,620 --> 00:05:37,470 because they are on the local LAN. 64 00:05:38,040 --> 00:05:41,100 The Internet, on the other hand, once again is global. 65 00:05:41,760 --> 00:05:48,290 Think of addresses in the Internet as global addresses because they are on the global internet. 66 00:05:49,230 --> 00:05:51,990 So in other words, think of addresses as follows. 67 00:05:52,530 --> 00:05:59,340 Inside a local is the IP address of this inside host on the local LAN. 68 00:05:59,880 --> 00:06:09,420 Inside Global is the IP address of this local PC, PC 1 as seen on the global Internet. 69 00:06:10,050 --> 00:06:17,790 If you sniffed traffic on this local LAN, you would see the inside local address of this PC. 70 00:06:18,420 --> 00:06:25,080 If you sniffed traffic using Wireshark on the Internet, you would see the inside global address of 71 00:06:25,080 --> 00:06:30,780 this PC outside local is the IP address of this outside server. 72 00:06:31,140 --> 00:06:40,450 When seen on the local area network outside Global is the IP address of this server on the global Internet. 73 00:06:41,040 --> 00:06:47,250 So in summary, this is an inside host, so we have an inside local address and inside global address. 74 00:06:47,850 --> 00:06:53,730 The Inside Hosts IP address on the local area network is an inside local address. 75 00:06:54,240 --> 00:07:01,110 This inside hosts IP address, when seen on the global internet is the inside global address. 76 00:07:01,620 --> 00:07:09,180 Inside host on local network, inside host on global Internet, this outside PCs IP address when 77 00:07:09,180 --> 00:07:12,990 seen on the global Internet users the outside global address. 78 00:07:13,290 --> 00:07:18,630 But when seen on the local area network is the outside local address. 79 00:07:19,290 --> 00:07:20,970 I hope that helps you remember the terms.