General Guidelines for Deployment of Network Address Translation (NAT) in CUHK Campus Network

Network Address Translation (NAT) is usually composed of two steps: the process by which a public IP address is translated into a mapped private IP address and the process to undo translation for returning traffic. Private IP addresses used in inside networks are not routable on Internet. NAT can provide flexibility for mapping multiple internal private IP addresses to one fixed public IP address for Internet access in order to save public IPv4 addresses used due to IPv4 address depletion globally.

It is NOT recommended to use only NAT for security protection. Rather, Firewalls should be used for such purpose while they can also provide NAT functions.

There is no urgency for departments to return public IPv4 addresses, which were assigned to them before, back to ITSC. However, departments are still recommended to start enabling NAT functions on their Firewalls when they implement new Firewalls for the future because absolutely no additional IPv4 addresses can be assigned to departments by ITSC anymore. Therefore, departments should make good use of the IPv4 addresses already assigned to them.

1. NAT should be applied to IPv4 only because of IPv4 address depletion globally. There is no need to do NAT for IPv6.
2. It is recommended to use NAT for client machines/devices for them to access Internet.
3. It is NOT recommended to use NAT for servers. Servers inside Internet-accessible DMZ should use static public IP addresses while servers not Internet-accessible should use static private IP addresses so as to save public IP addresses.
4. If NAT is enabled on Firewalls, the Firewalls should be in routed mode instead of transparent mode.
5. All private IP address blocks used in inside networks should be unique within CUHK and be recorded with ITSC for better management. (Although the same private IP address blocks can be reused in multiple inside networks, additional trouble-shooting effort may be required when problems arise.)
6. When using NAT, it is recommended to mapping the client machines used by staff and by students into different public IP addresses for better security control and management when necessary. Using Static DHCP (allocating an IP address based on a preconfigured mapping to each client’s MAC address) in inside networks is recommended wherever possible which is also for better control and management.
7. For accessing the inside networks behind NAT from other parts of CUHK Campus Network, port mapping along with restricted access control lists (deny-all, allow-by-exception) can be used in order not to compromise the security.