100-105 Real Exam Prep DEMO

Question 24: Under which circumstance should a network administrator implement one-way NAT?
A. when traffic that originates outside the network must be routed to internal hosts
B. when the network has few public IP addresses and many private IP addresses require outside
access
C. when the network must route UDP traffic
D. when traffic that originates inside the network must be routed to internal hosts
Correct Answer: A
Explanation:
NAT operation is typically transparent to both the internal and external hosts. Typically the internal
host is aware of the true IP address and TCP or UDP port of the external host. Typically the NAT
device may function as the default gateway for the internal host. However the external host is only
aware of the public IP address for the NAT device and the particular port being used to communicate
on behalf of a specific internal host.
NAT and TCP/UDP
"Pure NAT", operating on IP alone, may or may not correctly parse protocols that are totally
concerned with IP information, such as ICMP, depending on whether the payload is interpreted by a
host on the "inside" or "outside" of translation. As soon as the protocol stack is traversed, even with
such basic protocols as TCP and UDP, the protocols will break unless NAT takes action beyond the
network layer. IP packets have a checksum in each packet header, which provides error detection
only for the header. IP datagrams may become fragmented and it is necessary for a NAT to
reassemble these fragments to allow correct recalculation of higher-level checksums and correct
tracking of which packets belong to which connection. The major transport layer protocols, TCP and
UDP, have a checksum that covers all the data they carry, as well as the TCP/UDP header, plus a
"pseudo-header" that contains the source and destination IP addresses of the packet carrying the
TCP/UDP header. For an originating NAT to pass TCP or UDP successfully, it must recompute the
TCP/UDP header checksum based on the translated IP addresses, not the original ones, and put that
checksum into the TCP/UDP header of the first packet of the fragmented set of packets. The receiving
NAT must recompute the IP checksum on every packet it passes to the destination host, and also
recognize and recompute the TCP/UDP header using the retranslated addresses and pseudo-header.
This is not a completely solved problem. One solution is for the receiving NAT to reassemble the
entire segment and then recompute a checksum calculated across all packets.
The originating host may perform Maximum transmission unit (MTU) path discovery to determine
the packet size that can be transmitted without fragmentation, and then set the don't fragment (DF)
bit in the appropriate packet header field. Of course, this is only a one- way solution, because the
responding host can send packets of any size, which may be fragmented before reaching the NAT.