Network Address Translation (NAT)

The network address translation (NAT) feature makes it possible to have a Screen translate one set of addresses to another set. NAT is typically used:

• To hide the internal topology of a network - Here the network's private (unregistered) addresses are translated to a set of public (registered) addresses. All traffic appears to come from this set of public address, rather than from the network's private addresses.

• To use the public addresses assigned to a site efficiently - Many sites have a limited set of registered addresses assigned to them by the Internet service provider (ISP). With NAT you can use those addresses efficiently to support a large internal network. In this case, the addresses of the internal network are translated to the smaller set of registered addresses assigned by the ISP.

• To prevent having to renumber host addresses when changing ISPs - NAT enables you to map your old public addresses to the new set of registered addresses assigned to you by your new ISP.

• To use private or unregistered addresses on your internal network - The Internet Assigned Number Authority (IANA) has reserved the addresses ranges 10.0.0.0 through 10.255.255.255, 172.16.0.0 through 172.31.255.255, and 192.168.0.0 through 192.168.0.255 for use in private networks. NAT enables you to use these addresses in your internal network, yet still communicate with other networks by mapping those addresses into the registered addresses assigned to your site.

NAT works by modifying the address fields in the packet as it passes through the Screen. In addition to the address fields, the checksum and sequence number fields in the packet are modified. Certain protocols (such as FTP) also require that data within the packet containing address information be modified.