Now, if there were multiple hosts on the inside network, let's say we've got PC one and PC two.
PC one has an IP address of 10.1 and 1.1.
PC two has an IP address of 10.1, point one or two.
In this example, if we were using 1 to 1 net rather than port address translation or pat, we would
need to create a net entry for each host.
So a host one as an example, would be netted to 1.1.1 or two and host two or PC two would be netted
to 1.1, point one, two and three.
The net entries would look as follows ten 111 is netted to 1112 ten 112 isn't added to 1.1.13 as the
inside global address outside local outside global in this example would be the same.
So the inside local address would be the actual IP address of the host.
The inside global address would be the netted global address as seen on the internet.
The outside, local and outside global addresses in this example would remain the same because we're
not matching the destination IP address.
Only the source IP address will be netted in this example.
The problem with pure network address translation, as shown in this example, is that you would need
a public IP address for every internal host that uses a private RFC 1918 address.
That kind of defeats the whole purpose of network address translation where we want to conserve IP addresses.
In the real world, we tend to use pat or port address translation, which Cisco also call Nat overloading.
Pat allows multiple inside host addresses such as ten 111 and ten 112 to be noted to the same public
IP address.
So in this example, both PCs are annotated to the same inside global address.
It's not a 1 to 1 mapping.
In this example, two private IP addresses are netted to a single public IP address.
In addition, in this example, 1.1.1.1 is the ROUTER'S configured IP address.
That raises another issue how does the router to free initiate traffic that's destined to itself versus
traffic destined to PC one versus traffic destined to PC two.
So when PC one sends traffic onto the Internet to the server and the traffic is returned, how does
the router know that that traffic belongs to PC one rather than PC two if the traffic is going to the
same IP address?
So in other words, how does the router differentiate between different sessions or different flows
if multiple hosts on the inside are talking to the same server on the Internet?
Well, that's where port address translation comes in.
In this example, multiple hosts are sharing the same IP address.
So the way to make the entries unique is to combine an IP address with a port number to differentiate
between the different sessions or different host devices.
And that's where the port address translation term comes in, because multiple hosts are sharing the
same IP address.
The way to get a unique entry in the inside global table is to combine a port and an IP address.
So the combination of port and IP address provides a unique value which allows the router to differentiate
between entries.
So in this example, both PC one and PC two are sharing 1.1, .1.1 as the inside global address.
However, when host one initiates a session to the server, it's going to choose a random or ephemeral
port number to uniquely identify the session on the local PC.
When the traffic hits the router, the router will use that chosen source port number to represent the
net entry in the table.
So the PC chose 1024, and that's the entry used in the inside global net table entry.
If PC two initiated a session to the server and let's say for argument's sake, it chose 1025 as the
source port number.
That's the entry used on the router to uniquely identify the session.
So when traffic is sent from these PCs to the server and it's returned back to the router from the server,
the server is able to differentiate between traffic that's destined to 10.1 to 1.1 versus traffic that's
destined to 10.1 and 1.2 because of the unique IP address and port number combination.
So what happens if both PCs, for whatever reason, randomly choose the same source port number?
So let's assume both.
PC one and PC two chose 1024.
Well, all the router does is it just changes the entry in the inside global table to keep the entry
unique.
So ten 112 chose 1024 is the port number and the router simply changes that to another port number to
keep the values unique in the table.
So when the server sends traffic to the router destined to one point, one point, 1.1 port number 1025,
the router simply changes the address to ten .1.12 to port number 1024.
So if you were sniffing the traffic on this local area network connection, you would see traffic with
a source address of 10.1 1.1 port 1024 going to the server with address 2222 port 80 you would also
see traffic from PC two with IP address ten .1.122 port number 1024 going to the same server 2.2.222
port 80.
However, when the traffic hits the router, the router is going to change those values.
When the traffic is netted by the router before sending the traffic onto the internet, the router will
change the source addresses.
So if you were sniffing the traffic on the internet interface, you would see traffic from PC one.
Now having a source IP address of 1.11.1 port 1024 destination address remains the same.
We are not changing the outside, global and outside local addresses.
You would also see traffic from PC to the source address would now be 1.1.1.1 port 1025 on this interface
with the destination set to the server.
So the router has noted both the IP address and in this case it's also changed the port number to keep
the values unique.
The server in this example believes that it's got two sessions from the same host 1.1 and 1.1, whereas
in actual fact, they are two separate PCs, but the server is unaware of that as it only sees the netted
IP address.
When the server returns traffic to the router, it's going to return traffic to 1.1 and 1.1 port.
1024 Source address would now be 2 to 2 .2.2 port 80 as well as destination address of 1.1 and 1.1 port
1025.
Source address of 2.2.2.2 port 80.
The server once again believes that it's talking to the same host but different sessions.
So same IP address but different port numbers.
The rotten Nats that ingress traffic based on the inside global table.
So traffic destined to 1.1.1.1 put 1024 is changed to ten .1.1.1 port 1024 and forwarded onto the local
segment traffic destined to 1.11.1 port 1025 is translated to 10.1 1.2 port 1024 and forwarded onto
the local segment.
The PCs, as well as the server, are unaware that their traffic has been netted.
They are essentially oblivious to the changes that have been made by the router to the IP addresses
and port numbers.
Traffic is routed correctly, pieces are unaware of what's going on and that's essentially how not overloading
or port address translation or pat works.