4
Chapter
73
Address Translation
Overview
The
ability
of
the
SEG
to
modify
the
source
or
the
destination
IP
address
of
packets
as
they
traverse
a
security
gateway
is
known
as
Address
Translation
.
The
ability
to
transform
one
IP
address
to
another
can
have
many
benefits.
Two
of
the
most
important
are:
•
Private
IP
addresses
can
be
used
on
a
protected
network
where
protected
hosts
need
to
have
access
to
the
public
Internet.
There
may
also
be
servers
with
private
IP
addresses
that
need
to
be
accessible
from
the
public
Internet.
•
Security
is
increased
by
making
it
more
difficult
for
intruders
to
understand
the
topology
of
the
protected
network.
Address
translation
hides
internal
IP
addresses,
which
means
that
an
attack
coming
from
the
“outside”
is
much
more
difficult.
Types of translation
The
SEG
supports
two
types
of
translation:
•
Dynamic
Network
Address
Translation
(NAT)
•
Static
Address
Translation
(SAT)
Both
types
of
translation
are
policy
‐
based
in
the
SEG,
which
means
that
they
can
be
applied
to
specific
traffic
based
on
the
source
or
destination
network
or
interface,
as
well
as
based
on
the
type
of
protocol
(the
service
).
Two
types
of
SEG
IP
rules,
NAT
rules
and
SAT
rules,
are
used
to
configure
address
translation.
This
section
describes
how
to
configure
NAT
and
SAT
rules
and
provides
examples.
NAT
Dynamic
Network
Address
Translation
(NAT)
provides
a
mechanism
for
translating
original
source
IP
addresses
to
a
different
address
as
packets
traverse
a
network
device.
Outgoing
packets
from
the
device
then
appear
to
come
from
a
different
source
IP
address.
Incoming
packets
returning
to
that
source
address
have
their
IP
address
translated
back
to
the
original
one.
NAT
is
configured
in
the
SEG
by
specifying
the
NATAction
option
in
an
IP
rule
with
an
action
of
Allow
.
NAT
can
have
two
important
benefits:
•
The
IP
addresses
of
individual
clients
and
hosts
can
be
“hidden”
behind
the
security
gateway’s
IP
address.
The
is
sometimes
referred
to
as
topology
hiding
.
•
Only
the
security
gateway
needs
a
public
IP
address
for
public
Internet
access.
Hosts
and
networks
behind
the
security
gateway
can
be
allocated
private
IPv4
addresses
(as
defined
in
RFC1918)
but
can
still
have
access
to
the
public
Internet
through
the
public
IP
address.
