Manual Chapter :
Deploying a Carrier Grade NAT
Applies To:
Show Versions
BIG-IP LTM
- 14.1.0, 14.0.0
Deploying a Carrier Grade NAT
Overview: The carrier-grade NAT (CGNAT) module
The carrier-grade network address translation (CGNAT) module on the BIG-IP system supports large groups of translation addresses using large-scale NAT (LSN)
pools and grouping of address-translation-related options in an ALG profile, which can be
assigned to multiple virtual servers. It also has the ability to match virtual servers based on
client address to destination addresses and ports. Other characteristics of the CGNAT module are
listed here.
CGNAT is NAT only. If you want
deploy DNS services, you need a BIG-IP DNS license.
Translation address persistence
The CGNAT module can assign the same external (translation) address to all connections
originated by the same internal client. For example, providing endpoint-independent address
mapping.
Automatic external inbound connection handling
CGNAT can accept inbound external connections to active translation address/port combinations
to facilitate endpoint-independent filtering as described in section 5 of
RFC 4787
.
This is also known as a full-cone NAT.More efficient logging
CGNAT supports log messages that map external addresses and ports back to internal clients for
both troubleshooting and compliance with law enforcement/legal constraints.
Network address and port translation
Network address and port translation (NAPT) mode provides standard address and port
translation allowing multiple clients in a private network to access remote networks using the
single IP address assigned to their router.
Deterministic assignment of translation addresses
Deterministic mode is an option used to assign translation address, and is port-based on the
client address/port and destination address/port. It uses reversible mapping to reduce logging,
while maintaining the ability for translated IP address to be discovered for troubleshooting and
compliance with regulations. Deterministic mode also provides an option to configure
backup-members.
Port block allocation of translation addresses
Port block allocation (PBA) mode is an option that reduces logging, by logging only the
allocation and release of a block of ports. When a subscriber sends a translation request, the
BIG-IP system services the request from a block of ports that is assigned to a single IP
address, and only logs the allocation and release of that block of ports. The BIG-IP system
applies subsequent requests from the service provider to that block of ports until all ports are
used.
Licensing
Designed for service providers, the CGNAT module is offered as a stand-alone license or as an
add-on license for Local Traffic Manager (LTM) and
Policy Enforcement Manager™ (PEM).
Task summary
About ALG
Profiles
Application Layer Gateway (ALG) profiles provide the CGNAT with protocol and
service functionality that modifies the necessary application protocol header and payload, thus
allowing these protocols to seamlessly traverse the NAT. FTP, RTSP, SIP, and PPTP profiles that
are supported with ALG profiles, and added to the CGNAT configuration as needed.
An FTP, RTSP, or SIP profile can use an Automap, NAPT, DNAT, or PBA address
translation mode when providing necessary logging.
About CGNAT
translation address persistence and inbound connections
The BIG-IP system enables you to
manage RFC-defined behavior for translation address persistence and inbound connections.
Translation Address
Persistence
When you configure an LSN pool, the CGNAT Persistence Mode setting assigns
translation endpoints in accordance with the selected configuration mode: NAPT, Deterministic
NAT (DNAT), or Port Block Allocation (PBA). It is important to note that this CGNAT translation
address persistence is different from the persistence used in the BIG-IP Local Traffic Manager (LTM)
load balancing.
CGNAT translation address persistence
uses a
selected translation address, or endpoint, across multiple connections from the same subscriber
address, or endpoint.The BIG-IP system provides three Persistence Mode settings (
None
, Address
, and Address Port
) for each configuration mode.Persistence Mode | Description |
|---|---|
None | Translation addresses are not preserved for the subscriber.
Each outbound connection might receive a different translation address. This setting
provides the lowest overhead and highest performance. |
Address | CGNAT preserves the translation address for the subscriber.
When a connection is established, CGNAT determines if this subscriber already has a
translation address. If the subscriber already has a translation address, then CGNAT uses
the translation address stored in the persistence record, and locates a port for that
connection. If no port is available, then CGNAT selects a different address. This setting
provides greater overhead on each connection and less performance. DNAT reserves both
addresses and ports for a subscriber; however, persistence might still be of value when a
subscriber's deterministic mappings span two translation addresses. In this instance,
persistence prefers the same address each time. |
Address
Port | CGNAT preserves the translation address and port of the
subscriber's connection, so that the endpoint can be reused on subsequent connections. This
setting provides Endpoint Independent Mapping (EIM) behavior. Additionally, like the
Address setting for Persistence Mode , this setting provides
greater overhead on each connection and less performance. |
Inbound
Connections
The Inbound Connections setting determines whether the
Large Scale NAT (LSN) allows connections to be established inbound to the LSN subscriber or
client. This setting provides greater overhead, including a lookup on inbound entries for each
connection to prevent endpoint overloading, and a reduction in the use of the translation space.
When you disable inbound connections, the BIG-IP system provides greater
efficiency in address space utilization by allowing endpoint overloading, where two different
subscribers can use the same translation address and port, as long as each subscriber connects
to a different host.
When you enable inbound connections, the BIG-IP system restricts the use of
a translation address and port to a single subscriber, and ensures that only one subscriber
address and port uses a translation endpoint.
Because
DNAT reserves addresses and ports for a subscriber, no endpoint overloading between subscribers
occurs, but a single subscriber's traffic can leverage overloading. Inbound connections restrict
this behavior. For DNAT, increased restriction from inbound connections might occur when fewer
ports per subscriber are available. With inbound connections enabled, the ratio of subscriber
ports to translation endpoints for a subscriber is 1:1.
About IPv6
prefixes
IPv6 128-bit addresses include a network prefix in the leftmost fields, and
subnet in the remaining fields. For example, an IPv6 address of
2001:0db8:0000:0000:0000:0000:0000:0000
with a
32-bit prefix equates to a network of 2001:0db8
, written as 2001:db8::/32
. A network written as 2001:db8::/32
omits leading zeros in four-digit groups, uses ::
to indicate collapsed zero groups, and uses
/32
to indicate the 32-bit prefix.About IPv4 prefixes
IPv4 32-bit addresses include a network prefix in the leftmost fields, and a host identifier in
the remaining fields. For example, an address of
192.168.1.0/24
includes
the prefix of the IPv4 network starting at the given address, having 24 bits allocated for the
network prefix, and the remaining 8 bits reserved for host addressing.Creating an LSN pool
The carrier-grade NAT (CGNAT) module must be enabled with the appropriate settings before you can create large-scale NAT (LSN) pools.
LSN pools are used by the CGNAT module to allow efficient configuration of translation prefixes and parameters.
- On the Main tab, click .The LSN Pool List screen opens.
- ClickCreate.
- In theNamefield, type a unique name.
- In the Configuration area, for thePersistence Modesetting, selectAddressorAddress Port.
- For theMember Listsetting, type an address and a prefix length in theAddress/Prefix Lengthfield, and clickAdd.If your pool uses deterministic mode, ensure that any address ranges you enter as a member do not overlap another member's prefix address ranges. For example, the address and prefix10.10.10.0/24overlaps10.10.10.0/23.
- ClickFinished.
Configuring an ALG
profile
An ALG profile provides the CGNAT module with
protocol and service information to make specified packet modifications to the IP and
TCP/UDP headers, as well as the payload during translation.
Edit only
copies of the included ALG profiles to avoid unwanted propagation of settings to
other profiles that use the included profiles as parents.
- On the Main tab, click .
- In the ALG Profiles menu, click an ALG profile.
- ClickCreate.The New Profile screen opens.
- Type a name for the new profile.
- From theParent Profilelist, ensure that the correct parent profile is selected as the new profile.
- Select theCustomcheck box on the right.
- Configure the profile settings.
- ClickFinishedto save the new ALG profile.
You now have an ALG profile for use by CGNAT.
Configuring a CGNAT
iRule
You create iRules to automate traffic forwarding
for XML content-based routing. When a match occurs, an iRule event is triggered, and the
iRule directs the individual request to an LSN pool, a node, or virtual
server.
- On the Main tab, click .The iRule List screen opens.
- ClickCreate.
- In theNamefield, type a 1 to 31 character name, such ascgn_https_redirect_iRule.
- In theDefinitionfield, type the syntax for the iRule using Tool Command Language (Tcl) syntax.For complete and detailed information about iRules syntax, see the F5 Networks DevCentral web site (http://devcentral.f5.com).
- ClickFinished.
You now have an iRule to use with a CGNAT virtual server.
Creating a virtual server for an LSN pool
Virtual servers are matched based on source (client) addresses. Define a virtual
server that references the CGNAT profile and the LSN pool.
- On the Main tab, click .The Virtual Server List screen opens.
- ClickCreate.The New Virtual Server screen opens.
- In theNamefield, type a unique name for the virtual server.
- From theTypelist, selectPerformance (Layer 4).
- For a network, in theDestination Address/Maskfield, type an IPv4 or IPv6 address in CIDR format to allow all traffic to be translated.The supported format is address/prefix, where the prefix length is in bits. For example, an IPv4 address/prefix is0.0.0.0/0, and an IPv6 address/prefix is::/0.
- In theService Portfield, type*or select* All Portsfrom the list.
- From theVLAN and Tunnel Trafficlist, selectEnabled on. Then, for theVLANs and Tunnelssetting, move the VLAN or VLANs on which you want to allow the virtual servers to share traffic from theAvailablelist to theSelectedlist.
- For theLSN Poolsetting, select the pool that this server will draw on for translation addresses.
- In the Resources area of the screen, for theiRulessetting, select the name of the iRule that you want to assign and using the Move button, move the name from theAvailablelist to theEnabledlist.
- ClickFinished.
The custom CGNAT virtual server now appears in the CGNAT Virtual Servers
list.
Creating a CGNAT
tunnel
Many translations use tunneling to move TCP/UDP
traffic where the payload is other IP traffic. You can create and configure a tunnel for
use with an LSN pool.
- On the Main tab, click .The Tunnels screen opens.
- ClickCreate.The New Tunnel screen opens.
- In theNamefield, type a unique name for the tunnel.
- In theLocal Addressfield, type the IP address of the BIG-IP system.
- From theRemote Addresslist, retain the default selection,Any.This entry means that you do not have to specify the IP address of the remote end of the tunnel, which allows multiple devices to use the same tunnel.
- ClickFinished.
Your CGNAT tunnel is ready to use as an egress interface in an LSN Pool.
Configuring a NAT Stats profile
You can configure a NAT Stats profile to
provide statistics to help with troubleshooting, proactive monitoring, and future
planning.
- On the Main tab, click .
- ClickCreate.The New Nat Stats Profile screen opens.
- In theNamefield, type a unique name.
- From theParent Profilelist, select a parent profile.
- In theDescriptionfield, type a description.
- In the Settings area, from theStats Tracking Levellist, retain the default,Disabled, or select a level of reporting.SettingDescriptionHighIncludes the roll-up-level of a translation-address, the metric persistence-entries for a roll-up-level of an lsn-pool, and afw-nat-source-translation-object.MediumIncludes the metrics for active-subscribers, cumulative-subscribers, and peak-subscribers.LowIncludes all other statistics.
- ClickFinishedto save the new NAT Stats Profile.
