Cone NAT Introduction_HQ.pptVIP

Cone NAT Introduction PeterSu SW2 What is Cone NAT RFC 3489 A strict restriction for the mapping of internal IP address / port, external IP address / port, and destination IP address / port Cone NAT Type Full Cone All requests from the same internal IP address and port are mapped to the same external IP address and port. Furthermore, any external host can send a packet to the internal host, by sending a packet to the mapped external address. (IP) Restricted Cone All requests from the same internal IP address and port are mapped to the same external IP address and port. Unlike a full cone NAT, an external host (with IP address X) can send a packet to the internal host only if the internal host had previously sent a packet to IP address X Port Restricted Cone Like a restricted cone NAT, but the restriction includes port numbers. Specifically, an external host can send a packet, with source IP address X and source port P, to the internal host only if the internal host had previously sent a packet to IP address X and port P Symmetric All requests from the same internal IP address and port, to a specific destination IP address and port, are mapped to the same external IP address and port. If the same host sends a packet with the same source address and port, but to a different destination, a different mapping is used. Furthermore, only the external host that receives a packet can send a UDP packet back to the internal host Full Cone Restricted Cone Port Restricted Cone Symmetric What Cone NAT can do? Support P2P application Some applications no need ALG ? Compatible with current NAT Nortel Cone NAT requirement A restricted Cone NAT is RECOMMENDED. Symmetric NAT MUST NOT be used. A Full Cone NAT is NOT recommended. Hairpining support UDP binding SHOULD not expire in less than 2 minutes, and a default of 5 minutes is recommended. Verifying Cone NAT STUN – /projects/stun Natcheck – C221 SUA with firewall on C221 SUA with firewall off ZyXEL Confidential NAT ClientIP: