Carrier-grade NAT
Carrier-grade NAT(CGNorCGNAT), also known aslarge-scale NAT(LSN), is a type ofnetwork address translation(NAT) used by ISPs inIPv4network design. With CGNAT, end sites, in particular residential networks, are configured withprivate networkaddresses that are translated topublic IPv4 addressesbymiddleboxnetwork address translatordevices embedded in the network operator's network, permitting the sharing of small pools of public addresses among many end users. This essentially repeats the traditional customer-premise NAT function at the ISP level.
Carrier-grade NAT is often used for mitigatingIPv4 address exhaustion.[1]
One use scenario of CGN has been labeled asNAT444,[2]because some customer connections to Internet services on the public Internet would pass through three different IPv4 addressing domains: the customer's own private network, the carrier's private network and the public Internet.
Another CGN scenario isDual-Stack Lite,in which the carrier's network usesIPv6and thus only two IPv4 addressing domains are needed.
CGNAT techniques were first used in 2000[citation needed]to accommodate the immediate need for large numbers of IPv4 addresses inGeneral Packet Radio Service(GPRS) deployments of mobile networks. Estimated CGNAT deployments increased from 1,200 in 2014 to 3,400 in 2016, with 28.85% of the studied deployments appearing to be in mobile operator networks.[3]
Shared address space
[edit]If an ISP deploys a CGN, and usesRFC1918address space to number customer gateways, the risk of address collision, and therefore routing failures, arises when the customer network already uses anRFC1918address space.
This prompted some ISPs to develop a policy within theAmerican Registry for Internet Numbers(ARIN) to allocate new private address space for CGNs, but ARIN deferred to theIETFbefore implementing the policy indicating that the matter was not a typical allocation issue but a reservation of addresses for technical purposes (per RFC 2860).
IETF publishedRFC6598,detailing a shared address space for use in ISP CGN deployments that can handle the same network prefixes occurring both on inbound and outbound interfaces. ARIN returned address space to theInternet Assigned Numbers Authority(IANA) for this allocation.[4]The allocated address block is 100.64.0.0/10, i.e. IP addresses from 100.64.0.0 to 100.127.255.255.[5]
Devices evaluating whether an IPv4 address is public must be updated to recognize the new address space. Allocating more private IPv4 address space for NAT devices might prolong the transition to IPv6.
Advantages
[edit]- Maximises use of limited public IPv4 address space.
- May provide additional security for customers against attacks targeting their public IP address.
Disadvantages
[edit]Critics of carrier-grade NAT argue the following aspects:
- Like any form of NAT, it breaks theend-to-end principle.[6]
- It has significant security andreliabilityproblems[clarification needed],by virtue of beingstateful.
- It does not solve theIPv4 address exhaustion problemwhen a public IP address is needed, such as in Web hosting.
- It may create a performance bottleneck that limitsscalability.
- Carrier-grade NAT usually prevents the ISP customers from usingport forwarding,because thenetwork address translation(NAT) is usually implemented by mapping ports of the NAT devices in the network to otherportsin the external interface. This is done so therouterwill be able to map the responses to the correct device; in carrier-grade NAT networks, even though the router at the consumer end might be configured for port forwarding, the "master router" of the ISP, which runs the CGN, will block this port forwarding because the actual port would not be the port configured by the consumer.[7]In order to overcome the former disadvantage, thePort Control Protocol(PCP) has been standardized in the RFC 6887.
- In cases of banning traffic based on IP addresses, a system mightblockthe traffic of a spamming user by banning the user's IP address. If that user happens to be behind carrier-grade NAT, other userssharing the same public addresswith the spammer will be inadvertently blocked.[7]This can create problems for forum and wiki administrators attempting to address disruptive actions of a single malicious user sharing an IP address with legitimate users.
See also
[edit]References
[edit]- ^S. Jiang; D. Guo; B. Carpenter (June 2011),An Incremental Carrier-Grade NAT (CGN) for IPv6 Transition,ISSN2070-1721,RFC6264
- ^Chris Grundemann (2011-02-14)."NAT444 (CGN/LSN) and What it Breaks".
- ^Livadariu, Ioana; Benson, Karyn; Elmokashfi, Ahmed; Dhamdhere, Amogh; Dainotti, Alberto (2018).Inferring Carrier-Grade NAT Deployment in the Wild(PDF).IEEE INFOCOM 2018 - IEEE Conference on Computer Communications.Honolulu, HI, USA. pp. 2249–2257.doi:10.1109/INFOCOM.2018.8486223.Retrieved22 July2021.
- ^"Re: shared address space... a reality!".Archivedfrom the original on 2012-06-07.Retrieved13 September2012.
- ^Chris Grundemann (2012-03-13)."100.64.0.0/10 – Shared Transition Space".
- ^RFC7021- Assessing the Impact of Carrier-Grade NAT on Network Applications
- ^ab"MC/159 Report on the Implications of Carrier Grade Network Address Translators Final Report".Ofcom.2013-04-15.Retrieved2023-10-17.
External links
[edit]- RFC6888:Common Requirements for Carrier-Grade NATs (CGNs)
- A Multi-perspective Analysis of Carrier-Grade NAT Deployment(May 2016)
- CGN:: Observations & Recommendations(April 2012)
- Understanding Carrier Grade NAT(September 2009)