For example, we have a Windows NT server running Microsoft Corp. Internet Information Server in our 192.168.0.0 network. This is the reserved Class B address for one of our test networks, which can't be assigned to public devices.

In order for the server to access resources on our public subnet, we have added static routes to those servers directing traffic back to our Cisco 4700 router, which interconnects our test networks with our public subnet. We don't advertise the test network via RIP (Routing Information Protocol), thus making it inaccessible to anyone outside the test environment.

This configuration allows us to reach local resources, but we often need to go directly to the Internet, and our private addresses prevent it (see "Fate of TCP Connections With Private-Source IP Addresses," at right). We set up a NAT pool on the Cisco 4700 to translate packets from the private network to one of the pooled addresses. This enabled our test devices to access any server on the Internet.

Once the NAT address has been assigned from the pool of available addresses, two-way connections can occur--meaning we can make TCP and UDP (User Datagram Protocol) connections to the Internet and outsiders can make TCP and UDP connections back to us, provided they know the necessary public network address.

With this type of configuration, we can overbook our NAT addresses and serve a larger user population with fewer addresses. Static NAT requires a distinct public address for every private address to go through translation.

Keep in mind that when the pool of available addresses is depleted, subsequent connections will fail. Luckily, some NAT routers can be configured to time-out NATs. For example, we set our Cisco 4700 router to delete NAT entries after 15 minutes. In the lab, we've found that individual outbound connections rarely require longer sessions, but your mileage may vary. Since most Internet and intranet connections are brief, shorter time limits may be acceptable.

While pooled NAT provides some flexibility in your network, NAT breaks a number of network services. For example, SNMP managers track devices by their network addresses, but using NAT means those addresses are bound to change over time--today's workstation may be tomorrow's server. A possible workaround assigns a range of NAT addresses to a DHCP pool in the SNMP platform. You can then configure the SNMP manager not to set alarms when the workstation isn't responding, in the event the NAT device fails or the workstation is powered off.

When One Is Many PAT, the alternative to static or pooled NAT, is heavily used by remote-access vendors for consumer-based remote dial-up devices. Instead of translating network addresses traversing public and private networks, PAT uses a single registered network address, and maps TCP/IP and UDP/IP network and port pairs to the NAT device's registered address and an available port number above 1023. PAT can give you approximately 64,500 simultaneous TCP/IP or UDP/IP connections on a single IP address.

However, the actual number of workstations that can be supported is somewhat lower, because many intranet applications, such as HTTP, are actually made up of many smaller connections.