Chapter 5 - Applying Network Address Translation

Abstract

Network address translation (NAT) is an effective way to protect the network, while at the same time conserving valuable Internet Protocol (IP) address space. Hosts that are protected by NAT are far less vulnerable to attack or compromise by external threats because they are not directly accessible from the Internet. Firewall (FW)-1 provides two main methods of doing NAT: hide-mode and static-mode. Hide-mode translation is most useful for situations when there is need to translate an entire range of private IP space into one routable address. A common example is an office LAN: multiple office workstations, none of which need to be accessible externally, can be hidden with hide-mode NAT. Static-mode translation, divided into static source and static destination, is suited to cases when the device that is hiding must be accessible from the Internet. In static-mode, there is a one-to-one relationship between internal and external addresses.