Network Address Translation

[Donny_Dog]

The management has approached me with some info.

We access a system on someone elses network that uses a 172.248.x.x address range (Their network is massive) and we connect into it via a 10mb point to point leased circuit.

Our network is also massive and uses a 192.168.x.x address range. up until now its been pretty straightforward. the relationship is one way E.G we access the resources on their network and they do not access ours.

The info I was told today is that their 172 network is going to be re-i.p'd to the same as ours. :S

We still need to access these systems after they have been re I.P'd and the management has said that I need to provide them with what I need to make it happen.

As it stands we have a cisco 1841 router at the edge of this 10mb circuit and I created a static route to their subnet and then published it within R.I.P so that all our clients from our large internal network can route succesfully. I can't exactly do this in the new world when their internal addresses are the same as ours. So somehow I need to deploy NAT.

I've got plenty of Cisco routers spare (the 1841 version in abundance) and a 3500yl Layer 3 switch should we need it.

My plan is to deploy NAT on the 1841, to NAT our 192 range to (lets say) a 212.148.55.x NAt pool. I'd then tell their network bods of my plan so they could amend their router at the other end of the 10mb circuit to point the range back toward us.
I have no control over their network, so I don't know what is at the other end of this leased connection! all I know, is that it works at the moment.

Is that the most reasonable way of completing this? Does it make sense?!

 

[*JimmyJ*]

thats sounds about right mate what you are going to do, but like must things it might not be that straight forward. Let me know how you get on.

 

[*Badger*]

NAT is the only round it for you. Who's the providor? I ask this as I work for Network Management company!

 

[Adam.]

Can't you just bump your IP's down to 192.167.x.x?

 

[SamP]

Can't you just bump your IP's down to 192.167.x.x?

Easier said than done.

 

[Donny_Dog]

Thanks for the replies. Looks like my idea makes sense then?

thats sounds about right mate what you are going to do, but like must things it might not be that straight forward. Let me know how you get on.

Will do mate.

NAT is the only round it for you. Who's the providor? I ask this as I work for Network Management company!

It’s a government run health care organisation that uses an internal clinical system. It isn’t published extrernally hence the ‘internal’ connection we have at the moment.

Can't you just bump your IP's down to 192.167.x.x?

No mate, our network is massive – that would mean re-i.P’ing everything, changing all our documentation. Windows based domains are not the easiest to change the entire address range(s) whilst still keeping the up time neither, it would be a massive job.

Easier said than done.

This.

 

[PinkoCommie]

Thanks for the replies. Looks like my idea makes sense then?

Yes, but you will probably need to do both source and destination NAT unless you decide to route their new real addresses to the router and then make sure that you don't ever use them internally. For instance, if they are using 192.168.55.x and you are currently not, then as long as you never use that particular /24 subnet then you can just make sure that subnet is router to the router, then no need for destination NAT. Otherwise you will have to choose another unused subnet and route that to the router instead and then do a 1-1 converstion for the subnet.

i.e. if the real addresses are 192.168.55.x and you are already using this, you could use 10.1.1.x as the Destination NATs, so a user would access 10.1.1.24 and this would be un-natted to 192.168.55.24.

Source NATing is much much easier though, as you can just hide all the traffic behind a single address (PAT) (such as the customer facing router interface).

I wouldn't recommend using the 212.148.55.x for your NAT range unless you (or who you are connecting to) actually own that IP subnet.

No mate, our network is massive – that would mean re-i.P’ing everything, changing all our documentation. Windows based domains are not the easiest to change the entire address range(s) whilst still keeping the up time neither, it would be a massive job.

I hear you there. I was recently involved in moving an entire European infrastructure from a 172.16/12 to a 10/8 range. What a fecking nightmare that was. Took about 18 months to complete fully. (about 40 sites across Europe) I would say "never again", but as we are a management company we don't have much of a choice in the matter.

 

[Donny_Dog]

Yes, but you will probably need to do both source and destination NAT unless you decide to route their new real addresses to the router and then make sure that you don't ever use them internally. For instance, if they are using 192.168.55.x and you are currently not, then as long as you never use that particular /24 subnet then you can just make sure that subnet is router to the router, then no need for destination NAT. Otherwise you will have to choose another unused subnet and route that to the router instead and then do a 1-1 converstion for the subnet.

i.e. if the real addresses are 192.168.55.x and you are already using this, you could use 10.1.1.x as the Destination NATs, so a user would access 10.1.1.24 and this would be un-natted to 192.168.55.24.

Source NATing is much much easier though, as you can just hide all the traffic behind a single address (PAT) (such as the customer facing router interface).

I wouldn't recommend using the 212.148.55.x for your NAT range unless you (or who you are connecting to) actually own that IP subnet.




I hear you there. I was recently involved in moving an entire European infrastructure from a 172.16/12 to a 10/8 range. What a fecking nightmare that was. Took about 18 months to complete fully. (about 40 sites across Europe) I would say "never again", but as we are a management company we don't have much of a choice in the matter.

Thanks for your input here mate, much appreciated.

I'd love to say that their system would use a given range, like your example of 192.168.55.x but the truth is, I have no idea what they are going to do or use. Our management want a hard and fast answer to their question "What do you need" in order to sustain connectivity. The only thing I can say to them at the moment is NAT - maybe using an existing router to do it (although I'll press for a Cisco Pix or something anyway!).

I've kinda been thinking about the NAT range or pool to use and as much as I'd like to make it up, I'll need to consult them just in case they route to that address range (unlikely) for something else, which may screw it up. But destination nat'ing looks like the ticket, glad you agree!!! I like to keep things as simple as possible!

 

[dum1983]

Should work done a similar thing a month ago.