3D Connexion 17621 - Manual (Page 5)

CONFIGURATION SECTION. In Example One this is the Ethernet 0 IP interface.
The IP Interface which is communicating with the External Network or Internet must
be the only interface which has NatMap = On. It is important that one, and only one,
IP interface on a NAT Router have its NatMap variable set to On.
3.
Point C is probably the most important, and least obvious, configuration requirement. In
Example One, Ethernet 0 and Ethernet 1 both seem to be participating in Network Address
Translation. The user could assume that NatMap could be set to On in both IP ports. THIS IS
NOT THE CASE! Only Ethernet 0 should have NatMap = On. Compatible Systems NAT
software will not function between two IP ports which both have NatMap = On.
Again, in Compatible Systems routers with the [NAT Global] variable Enabled=On, the
single IP interface which has NatMap = On is called the External NAT Port. The IP interface
connected to the "private" IP addresses is called the Internal NAT Port. In Example One,
Ethernet 0 is the External NAT Port and Ethernet 1 is the Internal NAT Port.
NAT only translates the address of the workstations/routers in the NAT Network. It does not
need to adjust the address of the location on the External Network. The MicroRouter 2220R
NAT Router just makes the workstations/routers in the NAT Network appear to be at the
Internet IP addresses of 198.41.9.194 or 198.41.9.219 and accessible through the IP interface
of Ethernet 0 on this router. The sub−interface makes the Internet address assignment based
on logic in the software. These translations are done using Translation Sessions (also called
NAT Sessions) in the NAT software. One NAT Session is created for each IP
Communication Session that is established through the NAT Router.
Since NAT can be viewed and is often used as a type of firewall, Point B makes sense. The
previous paragraph also helps explain the reason for Point B. NAT must modify packets
destined for, and coming from, the External Network/Internet. The NAT Router IP interface
which most directly communicates with the Internet must be the one doing Network Address
Translation (NatMap = On).
Except for one special condition, which will be explained shortly, IP sessions can only be
established between the Internet and the NAT Network through the NAT Router by locations
on the NAT Network (only from the inside to the outside).
Note: NAT functionality is available on Compatible Systems router IP interfaces with one
important exception. A WAN interface can be used as the External NAT Port only if its IP
address is assigned in the Router's configuration. NAT cannot function on WAN interfaces
that have their IP address assigned by a dial−up, PPP negotiation.
AN EXAMPLE NAT SESSION (CONDITION 1)
The Mac at internal address 10.5.3.10 is going to ping the Internet location 128.138.240.11.
The Mac sends its IP packets (ICMP Echo Requests) to its Gateway IP address of 10.5.3.1.
This is the address of the Internal NAT Port on the NAT Router (Ethernet 1) which is
connected to the NAT Network. At this point the NAT Router begins to create a NAT Session
for this IP session. This NAT Session contains information about:
the NAT Network location (Internal NAT) source IP address {10.5.3.10}
♦
the Internet location (Remote) IP destination address {128.138.240.11}
♦
the External, translated NAT (External NAT) IP source address it will use in
translating the packet {198.41.9.219}
♦
and the Application Protocol being transmitted by the IP packets (ICMP).
♦
On outbound packets, all Internal NAT source IP address entries {10.5.3.10} in the packet are
changed to the External NAT IP address {198.41.9.219}.