[Approaching NE(8)] A Packet‘s Adventures on Huawei Routers - Other Processing o Highlighted

NAT Basic Principles

NAT converts IP addresses in IP datagram headers between private and public networks. Hosts in a LAN can use private addresses for internal communication. If they need to access the public network, their source addresses (private IP addresses) are translated into public IP addresses). For the return traffic to reach the hosts, the public IP addresses are translated back to the private IP addresses. In this way, all hosts in the LAN can use limited public IP addresses (even one) to access the Internet.

NAT has multiple implementation modes, among which Huawei high-end routers implement network address port translation (NAPT). In NAPT mode, a NAT device translates different source IP addresses carried in received packets into the same public IP address, and port numbers into different port numbers. This mode allows a large number of hosts to access the public network using only one public IP address.

In the preceding figure, packets 1 and 2 carry the same source private IP address but different port numbers. Packets 1 and 3 carry different source private IP addresses but the same port number. The NAT device translates the source IP addresses in packets 1, 2, and 3 into the same public IP address, and port numbers into different port numbers. Packets 1, 2, and 3 can be identified by their new port numbers. After receiving the return traffic from the public network, the NAT device identifies the destination hosts based on the destination IP address and port numbers.

NAPT is based on a NAT address pool which contains multiple public IP addresses. When a user needs to access the public network, the user's packets are sent to the NAT device. The NAT device selects one public IP address from the NAT address pool, maps it to the source IP address, and performs NAT accordingly. If the NAT device fails to receive any packets from the user within a period, it reclaims the public IP address previously used by the user.

NAT Address Pool Route Advertisement

After users on a private network access the Internet, the return traffic from the Internet carry the public IP addresses of the NAT address pool as destination IP addresses, and devices on the Internet need to search their routing tables for routes to the public IP addresses to forward the traffic. To ensure the forwarding, the NAT device needs to advertise NAT address pool routes to the Internet. However, these public IP addresses in the address pool are dynamically allocated by the NAT device. How can the routes to these public IP addresses be advertised?

In fact, after a NAT public address pool is created on a Huawei high-end router, NAT public address pool user network routes (UNRs) are generated. For example, if the network segment of a NAT public address pool is 10.0.0.0/22, the following UNR is generated:

Destination/Mask    Proto   Pre  Cost      Flags NextHop      Interface

     100.0.0.0/22   Unr     64   65535       D   127.0.0.1    InLoopBack0

If you want routes in the NAT address pool to be advertised to the public network, import the UNR to a dynamic routing protocol using the import-route unr command.

NAT Implementation

On Huawei high-end routers, the NAT service board is responsible for NAT. The service process is as follows: An uplink LPU distributes traffic to the NAT service board which performs NAT and sends the traffic to a downlink LPU. Finally, the downlink LPU forwards the traffic. The detailed process is as follows:

• Outgoing traffic forwarding process (from a private network to the public network)

  

  The process is similar to that of other service flows except for the following differences:

  1. The packet forwarding engine (PFE) on the uplink LPU uses multi-field (MF) classification for traffic diversion to the NAT service board.
  2. The SFU sends packets to the NAT service board.
  3. The NAT service board first performs NAT. After NAT, the private source IP addresses of the packets are translated into public IP addresses, and port numbers are also translated.
  4. Then, the NAT service board searches the public forwarding table for the destination LPU and outbound interface information. Note that the NAT service board has the same forwarding table as LPUs.
  5. The SFU switches the packets to a downlink LPU. The rest of the process is the same as that of other service flows.

• Incoming traffic forwarding process (from the public network to a private network)

  

  The process is similar to that of other service flows except for the following differences:

  1. When the PFE on the uplink LPU searches the public routing table, it obtains the NAT address pool UNR, with the NAT service board as the destination LPU. In a centralized NAT scenario, the UNR carries destination LPU and interface information. In a distributed NAT scenario, the uplink LPU sends the packets to the CPU for processing to obtain the destination LPU and interface information.
  2. The SFU sends packets to the NAT service board.
  3. The NAT service board translates the public destination IP addresses of the packets into private IP addresses and also translates port numbers.
  4. Then, the NAT service board searches the VPN forwarding table for the destination LPU and outbound interface information.
  5. The SFU switches the packets to a downlink LPU. The rest of the process is the same as that of other service flows.