1 / 16

NAT-PT (Network Address Translation-Protocol Translation)

NAT-PT (Network Address Translation-Protocol Translation). Speaker: 林洹緯 Date: 2010/7/29. Outline. Introduction to NAT-PT NAT-PT flavors Application Level Gateway(ALG) Protocol Translation(PT) NAT-PT Operation NAPT-PT Operation. Introduction to NAT-PT.

amaya-diaz
Télécharger la présentation

NAT-PT (Network Address Translation-Protocol Translation)

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. NAT-PT(Network Address Translation-Protocol Translation) Speaker: 林洹緯 Date: 2010/7/29

  2. Outline • Introduction to NAT-PT • NAT-PT flavors • Application Level Gateway(ALG) • Protocol Translation(PT) • NAT-PT Operation • NAPT-PT Operation

  3. Introduction to NAT-PT • 由於IPv4和IPv6需要共存，NAT-PT因應此轉換的需求而產生 • 類似IPv4中NAT的作法 • 使用SIIT來處理不同通訊協定間的標頭轉換 • IPv4 to IPv6位址轉換格式為 PREFIX::<IPv4 address>，其中PREFIX長度為48bit

  4. NAT-PT flavors • Traditional NAT-PT • 只能由IPv6往IPv4單向建立連線 • 又分為Basic-NAT-PT 和 NAPT-PT(Network Address Port Translation-Protocol Translation)，兩者差別在於使用IPv4位址的多寡以及對應關係的不同 • Bi-Directional-NAT-PT • 可雙向建立連線，但需DNS_ALG的支援才可達成

  5. Application Level Gateway(ALG) • ALG 是對應於特定應用程式的代理人，有些應用程式會把網路位址存在封包的payload中，NAT-PT 本身並無法得知 payload 裡存的是什麼，ALG 可以協助NAT-PT 來達到這個功能 • 假設有一個由IPv4端送出的SIP封包 Header如下，經過NAT-PT Server時，NAT-PT Server會將封包的Source address 和Destination address 修改為IPv6的格式，而NAT-PTServer中處理SIP的ALG負責的就是SIPHeader中IPv4位址的轉換 INVITE sip:bob@220.132.0.100 SIP/2.0 Via: SIP/2.0/UDP 163.22.21.82:5060 From: Alice sip:alice@163.22.21.82 To: Bob sip:bob@220.132.0.100 Call-ID: 1234@163.22.21.82 CSeq: 1 INVITE Subject: meeting Contact: sip:alice@163.22.21.82 Content-Type: application/sdp Content-Length: 147

  6. Protocol Translation(PT) • PT指的是能夠將IPv4和IPv6的封包之間做對等的轉換，在RFC 2765(SIIT)中有詳細的描述

  7. NAT-PT Operation - 1 • Traditional NAT-PT(v6-to-v4), without DNS_ALG • IPv6 Host 發出v6封包，SRC=2001:6840:e10::b1，DST=PREFIX::163.22.21.82 • NAT-PT 接收到封包後查看該封包的SRC並未在 address mapping table內，於是從v4 address pool中挑選出一個尚未使用的address，將v6封包轉換成v4封包格式，並將其address對應關係記錄在mapping table中。 • 假設所分配到的IPv4 address為220.132.0.100，該mapping table為( 2001:6840:e10::b1 – 220.132.0.100，在此可能還包含其他狀態資訊) • 接著傳送v4封包 SRC=220.132.0.100， DST=163.22.21.82

  8. NAT-PT Operation - 2 • Traditional NAT-PT(v6-to-v4), without DNS_ALG • IPv4 Host 接收到封包之後回傳v4封包SRC=163.22.21.82，DST=220.132.0.100 • NAT-PT 收到回傳的封包後查詢相關資訊並將v4封包轉換為v6封包，SRC=PREFIX::163.22.21.82，DST=2001:6840:e10::b1 • 上述的方式只適用於v6-to-v4單向聯通，若要完成雙向聯通則需透過DNS_ALG來完成。在此NAT-PT上萬一IPv4 address用完時，則當有其他v6 node欲與v4 node聯通時則無多餘的IPv4 address來完成，為解決該IPv4 address的不足則可利用之後會介紹到的NAPT-PT

  9. NAT-PT Operation - 3 • Bi-Directional-NAT-PT(v6-to-v4), with DNS_ALG • 建立連線前IPv6Host無法得知與IPv4 Host 相對應的IPv6address，於是送出DNSrequest到IPv6 DNSServer • 由於在IPv6 DNSServer中查詢不到該筆IPv4 Host的紀錄，IPv6 DNSServer轉而將此request送至NAT-PT Server處理 • NAT-PTServer中的DNS_ALG收到這個request後，將所request的紀錄格式由AAAA改為A再送至IPv4 DNSServer，IPv4 DNSServer收到request後傳回IPv4 Host的address為163.22.21.82

  10. NAT-PT Operation - 4 • Bi-Directional-NAT-PT(v6-to-v4), with DNS_ALG • DNS_ALG收到address訊息後，向NAT-PT要PREFIX，並把此address加上PREFIX變成IPv6 address=PREFIX::163.22.21.82，並且將此紀錄由A改為AAAA並傳回IPv6 DNSServer， IPv6 DNS Server再將紀錄轉傳回IPv6 Host • 接下來流程和Traditional NAT-PT相同，也就是NAT-PT由IPv4 address pool中挑出一個沒有使用的address當作與IPv6 Host相對應的IPv4address進行連線

  11. NAT-PT Operation - 5 • Bi-Directional-NAT-PT(v4-to-v6), with DNS_ALG • 建立連線前IPv4Host無法得知與IPv6 Host 相對應的IPv4位址，於是送出DNSrequest到IPv4 DNSServer • 由於在IPv4 DNSServer中查詢不到該筆IPv6 Host的紀錄，IPv4 DNSServer轉而將此request送至NAT-PT Server處理 • NAT-PTServer中的DNS_ALG收到這個request後，將所request的紀錄格式由A改為AAAA再送至IPv6 DNS伺服器，IPv6 DNS伺服器收到request後傳回IPv6 Host的位址為2001:6840:e10::b1

  12. NAT-PT Operation - 6 • Bi-Directional-NAT-PT(v4-to-v6), with DNS_ALG • NAT-PT Server收到address訊息後，從IPv4 address pool中挑出一個尚未用到的address 220.132.0.101，將紀錄格式由AAAA轉換成A送回IPv4 DNS Server，並將其address對應關係記錄在mapping table中，mapping table為(2001:6840:e10::b1 – 220.132.0.101) • IPv4 DNS Server 再將此紀錄送回IPv4 Host • IPv4Host 得知與IPv6 Host相對應的IPv4 address 後即可進行連線

  13. NAPT-PT Operation - 1 • NAPT-PT(v6-to-v4) • NAPT-PT Server 只有一個IPv4 address為220.132.0.102 • IPv6 Host A 和IPv6 Host B 都要跟IPv4 Host 建立通訊，兩者SA(Source address)資訊分別為[2001:6840:e10:b1]:1025和[2001:6840:e10:b2]:1025，都使用port 1025對外連線，DA(Destination address)則為[PREFIX::163.22.21.82]:23 • NAPT-PT Server 收到這兩個IPv6 Host的封包之後，使用隨機的port分別將兩個封包的SA轉換為220.132.0.102:123和220.132.0.102:456並儲存對應關係，轉換為v4封包後，使用同一個IPv4 address但是不同的port 與IPv4 Host 連線

  14. NAPT-PT Operation - 2 • NAPT-PT(v6-to-v4) • IPv4 Host 收到封包後分別回應到220.132.0.102:123及220.132.0.102:456，封包 SA=163.22.21.82:23，DA=220.132.0.102:123以及220.132.0.102:456 • NAPT-PT Server 收到這兩個封包之後根據對應關係，將DA=220.132.0.102:123的封包轉換成v6封包，DA修改為[2001:6840:e10:b1]:1025DA=220.132.0.102:456的封包轉換成v6封包，DA修改為[2001:6840:e10:b2]:1025 Mapping table 220.132.0.102:123 - [2001:6840:e10:b1]:1025 220.132.0.102:456 - [2001:6840:e10:b2]:1025

  15. NAPT-PT Operation - 3 • NAPT-PT – static port mapping • 除了隨機的port對應之外，NAPT-PT還可以使用static port mapping，也就是直接指定NAPT-PT Server 的IPv4 port 對應到IPv6 Host 的port • 舉例來說，IPv6網路中有一台HTTP Server，設定NAPT-PT Server的port 80對應到該Server的port 80，則所有從NAPT-PT Server port 80 進入的連線都會被轉到IPv6網路中的HTTP Server，也就是說NAPT-PT Server 底下的IPv6 網路只允許有一台HTTP Server的存在，除非其他HTTP Server 使用非預設的port 連線

  16. Reference • NAT-PT (RFC 2766) • SIIT (RFC 2765) • Cisco IOS NAT-PT for IPv6

More Related