SDWAN & NAT

SDWAN & NAT

The NAT environment includes these features:

• NAT allows hosts with private IP addresses in a LAN to communicate with devices in public address spaces, such as the internet.

• Network devices configured with NAT can function as hardware firewalls to prevent unwanted data traffic from passing through a WAN Edge (and to LAN networks in the service side networks connected to the WAN Edge device).

• To enhance the security at branch sites, you can place the WAN Edge router behind a NAT network device or firewall.

• The WAN Edge router can interact with NAT devices configured with the following Session Traversal Utilities for NAT (STUN) methods.

  1. Full-cone NAT

  2. Address-Restricted Cone NAT

  3. Port-Restricted Cone NAT

  4. Symmetric-NAT

By default, all Cisco SD-WAN devices use base port 12346 for establishing the connections that handle control and data traffic in the overlay network. Each device uses this port when establishing connections with other Cisco SD-WAN devices.

Recall that when multiple Cisco SD-WAN devices are installed behind a single NAT device, you can configure different port numbers for each device. That way, the NAT can properly identify each individual device. You do this by configuring a port offset from the base port 12346. The default port offset is 0.

Full-Cone NAT 

A full-cone is one where all packets from the same internal IP address are mapped to the same NAT IP address. This type of address translation is also known as One-to-One. 

Additionally, external hosts can send packets to the internal host, by sending packets to the mapped NAT IP address.

Restricted-Cone NAT

A Restricted-Cone network address translation is also known as Address-Restricted-Cone. It is a network translation technique where all packets from the same internal IP address are mapped to the same NAT IP address. The difference to a Full-Cone is that an external host can send packets to the internal host only if the internal host had previously sent a packet to the IP address of the external destination. It is important to note that once the NAT mapping state is created, the external destination can communicate back to the internal host on any port. 

Port-Restricted-Cone NAT

A Port-Restricted-Cone is similar to the Restricted-Cone address translation, but the restriction includes also port numbers. The difference is that an external destination can send back packets to the internal host only if the internal host had previously sent a packet to this destination on this exact port number. In a typical Cisco IOS/IOS-XE or Cisco ASA configuration, this feature is known as Port Address Translation (PAT).