Firewall NAT Technologies · Topic 1 of 3
Overview of NAT and Source NAT
Learn why NAT exists and the USG source NAT types: NAT No-PAT, NAPT, Easy IP, Smart NAT and triplet NAT, with address pools and blackhole routes.
- 6 min
- Includes a diagram
- Source NAT translates the source address of traffic sent out, usually from Trust to Untrust.
- NAT No-PAT translates addresses only, NAPT translates addresses and ports, and Easy IP is NAPT with the outbound interface address.
- On a USG firewall, source NAT is configured as a
nat-policyrule whose action issource-nat address-grouporsource-nat easy-ip.
What it is
NAT (Network Address Translation) rewrites the IP addresses, and often the ports, in packets as they pass the firewall. It was created because public IPv4 addresses ran out, so many hosts with private addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, defined in RFC 1918) must share a few public ones.
Source NAT translates the source address of traffic that inside users send out, usually from the Trust zone to the Untrust zone. It is the most common NAT on a USG firewall.
How it works
Why NAT, and what it costs
| Benefit | Drawback |
|---|---|
| Saves public IPv4 addresses | Breaks true end to end addressing |
| Hides the internal address plan | Protocols that carry addresses in the payload need NAT ALG |
| Lets internal addressing change without telling the ISP | Translation adds processing and makes tracing harder |
The firewall records every translation in its session table. The reply packet matches the session, and the firewall translates the destination back to the original private address.
The source NAT types
| Type | Translates | Address source | Mapping |
|---|---|---|---|
| NAT No-PAT | Address only | Address pool | One private address to one public address at a time |
| NAPT | Address and port | Address pool | Many private addresses share each public address |
| Easy IP | Address and port | Outbound interface address | Many private addresses share the interface address |
| Smart NAT | Address, then address and port | Address pool with one reserved address | No-PAT first, NAPT on the reserved address when the pool runs out |
| Triplet NAT | Address and port | Address pool | Keeps a fixed public address and port per private address and port |
NAT No-PAT does not save addresses for simultaneous users, because each active inside host holds a whole public address. It suits protocols that cannot tolerate port changes.
NAPT (Network Address and Port Translation) gives each flow a new source port as well, so a small pool serves many hosts. Easy IP is NAPT that uses the address of the outbound interface, ideal when that address comes from DHCP or PPPoE.
Smart NAT reserves one pool address for NAPT. When the other addresses are all in use by No-PAT, new users are translated with NAPT on the reserved address.
Triplet NAT keeps the same public address and port for a private address and port for a while, and lets outside hosts start connections to that public pair. It is used for P2P applications such as file sharing, voice and gaming.
Address pools and NAT policies
On a USG firewall, source NAT is a NAT policy. A rule matches traffic by zone and address, and its action names an address pool or Easy IP.
nat address-group addr1
mode pat
section 0 202.1.1.10 202.1.1.12
#
nat-policy
rule name policy_nat1
source-zone trust
destination-zone untrust
source-address 192.168.1.0 24
action source-nat address-group addr1mode pat gives NAPT, and mode no-pat gives NAT No-PAT. For Easy IP the rule uses action source-nat easy-ip and needs no pool.
A security policy must still permit the traffic, Trust to Untrust here. Source NAT happens after the security policy check, so the policy matches the private source address 192.168.1.0/24.
Blackhole routes for pool addresses
When pool addresses are not configured on any interface, configure a blackhole route for them, such as ip route-static 202.1.1.10 255.255.255.255 NULL0 for each address or a covering prefix.
Without it, a packet from the internet to an unused pool address has no session. The firewall follows its default route back to the ISP router, which sends it back again, so a routing loop forms until the TTL expires. The blackhole route discards such packets and also gives the firewall a route to advertise for the pool.
A worked example
A company has 200 users in the Trust zone at 192.168.1.0/24 and three public addresses, 202.1.1.10 to 202.1.1.12. The engineer creates pool addr1 with mode pat, a NAT policy from Trust to Untrust that uses it, a security policy permitting 192.168.1.0/24 to Untrust, and a blackhole route for the three addresses.
A host 192.168.1.20 opens a web page. The session table records the private source with its translated public address and port, and all 200 users share the three addresses.
How the exam asks about this
- "Which source NAT type translates addresses and ports using the outbound interface address?" -> Easy IP.
- "Which source NAT type maps one private address to one public address without changing ports?" -> NAT No-PAT.
- "Why should a blackhole route be configured for NAT address pool addresses?" -> To prevent routing loops for traffic sent to unused pool addresses.
What to remember for the exam
- Source NAT translates the source address of traffic sent out, usually from Trust to Untrust.
- NAT No-PAT translates addresses only, NAPT translates addresses and ports, and Easy IP is NAPT with the outbound interface address.
- On a USG firewall, source NAT is configured as a
nat-policyrule whose action issource-nat address-grouporsource-nat easy-ip. - Source NAT runs after the security policy check, so the security policy uses the private source address.
- Configure blackhole routes to NULL0 for pool addresses to prevent routing loops.
A NAT policy only translates. Traffic still needs a security policy that permits it, or the first packet is dropped by the default deny policy before any translation happens.
Common mistakes
Writing the public address in the security policy for source NAT. The security policy is checked before source NAT, so it must match the original private source address.
Thinking NAT No-PAT saves addresses. Each inside host that is online at the same time still needs its own public address. Only NAPT and Easy IP let many hosts share one address.
Skipping the blackhole route. NAT still works for users without it, but traffic to unused pool addresses can loop between the firewall and the ISP router.
Check yourself
Which NAT policy action makes the firewall use the address of its outbound interface?
action source-nat easy-ip, which translates many private addresses to the interface address with different ports.What does
mode no-patchange in a NAT address pool?Ports are not translated, so each private address takes a whole public address from the pool (NAT No-PAT).
Does the security policy for source NAT match the private or the public source address?
The private address, because the firewall checks the security policy before it performs source NAT.
Topic 1 of 3 in Firewall NAT Technologies
Test yourself on Firewall NAT Technologies
The full Huawei HCIA-Security H12-711 question bank has 600 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Huawei. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.