Choosing NAT Addresses

In all NAT situations, one of the addresses in a NAT translation is virtual. It does not really exist and must be simulated by the Screen and other systems in the network. The virtual address is:

• If Source and Translated Source addresses are different, then Translated Source address is virtual.

• If Destination and Translated Destination addresses are different, the "Destination" address is virtual.

Because virtual addresses do not physically exist, how these address are selected and who simulates them is restricted. Simulating a virtual address means providing the functions of APRing and routing.

In routing mode (not needed in stealth mode), the Screen must respond to APR requests for the public addresses (R2 through R8) because it will be translating public addresses to private addresses. Add an arp entry (using the command arp -s IP_address ether_address pub) for them. Either add this entry each time that you reboot the Screen or add it to a startup script that runs at boot time. If you are administering the Screen in routing mode remotely, either go to the Screen to add this entry, or have a rule in your policy that allows logging in (rlogin) to the Screen remotely.

In stealth mode, the Screen automatically responds to the APR requests from public address.