Deterministic network address and port translation

• US 9,614,761 B1
• Filed: 11/02/2015
• Issued: 04/04/2017
• Est. Priority Date: 11/04/2011
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Kamisetty, Sarat, Mohan, Rajesh, Vinapamula Venkata, Suresh Kumar, Penno, Reinaldo
• Primary Examiner(s): Nguyen, Angela
• Application Number:
  US14/930,030
• Time in Patent Office: 519 Days
• Field of Search: None
• CPC Class Codes: H04L 45/60 Router architectures
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 61/10 of different types
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2517 using port numbers
• CPC Class Codes: H04L 61/255 Maintenance or indexing of mapping tables
• CPC Class Codes: H04L 61/2553 Binding renewal aspects, e.g. using keep-alive messages
• CPC Class Codes: H04L 61/2557 Translation policies or rules
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 61/503 using an authentication, authorisation and accounting [AAA] protocol, e.g. remote authentication dial-in user service [RADIUS] or Diameter
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

A source network address and port translation (NAPT) mechanism is described that reduces or eliminates the need to log any NAT translations. As described herein, a mapping between a subscriber'"'"'s private address to a public address and port range is determined algorithmically. Given a particular mapping rule, as specified by the service provider, a subscriber is repeatedly and deterministically mapped to the same public network address and a specific port range for that network address. Once the public address and port range for a subscriber are computed, the particular ports for each session for that subscriber are allocated dynamically within the computed NAT port range on per session basis.

Claims

1. A method comprising:

storing, with a network device, a network address translation (NAT) rule that specifies a contiguous range of private network addresses and a contiguous range of public network addresses, wherein the range of public network addresses specified by the NAT rule has a total number of public network addresses that is less than a total number of private network addresses of the range of private network addresses specified by the NAT rule;

receiving, with the network device, an initial packet for a new packet flow from a subscriber, wherein the initial packet includes a private source network address and a source port;

responsive to the initial packet for the new packet flow, deterministically computing, with the network device and using the NAT rule, a public network address and a range of ports for network address translation of packets of the packet flow, wherein deterministically computing the public network address and the range of ports comprises applying operations that repeatably and deterministically compute a corresponding public network address within the contiguous range of public network addresses and a corresponding range of ports for any one of the private network addresses in the contiguous range of private network address specified by the NAT rule by;

(i) computing, based on the private source network address of the initial packet, a first offset representing a position of the private source network address within the private address space specified by the NAT rule, (ii) computing, based the computed position within the private network address space for the private network address of the packet and based on a total number of public network addresses within the public address space specified by the NAT rule, a second offset representing a position within the public address space specified by the NAT rule, and (iii) computing, based on the second offset representing the position within the public network address space, the public network address for performing NAT of the packet;

dynamically selecting, for network address translation of the initial packet of the new packet flow, an unused port from the range of ports;

generating a translated packet from the initial packet, wherein the translated packet includes the computed public network address and the selected unused port from the range of ports in place of the private source address and the source port; and

forwarding the translated packet from the network device to a public network.

2. The method of claim 1, further comprising:

prior to deterministically computing the public network address and the range of ports for network address translation of the packets of the packet flow, logging an activation time period for the NAT rule without maintaining a log file that records network address translation of the private source network address to the public network address.

3. The method of claim 1, wherein deterministically computing a public network address and a range of ports comprises:

computing a port block offset as a function of both the first offset within the private address space and the number of public network addresses within the public address space; and

computing the range of ports for the subscriber as a function of the port block offset and a port block size specified by the NAT rule.

4. The method of claim 1, wherein dynamically selecting the unused port from the range of ports comprises:

maintaining a bitmap for the port range assigned to the private network address, wherein each bit within the bitmap indicates whether the corresponding port is being used for network address translation of a current communication session from the subscriber; and

based on the bitmap, selecting one of the ports within the port range that is not being used for a current communication session from the subscriber.

5. The method of claim 1, further comprising:

when all of the ports within the range of ports assigned to the private network address are currently being used, selecting the public network address and unused port from a fallback pool of public network addresses; and

generating and storing a system log file to record network address translation of the private source network address to the public network address.

6. The method of claim 1, further comprising selecting the NAT rule from a plurality of NAT rules upon matching one or more criteria of the NAT rule to contents of the packet.

7. The method of claim 1, further comprising selecting the NAT rule from a plurality of NAT rules upon matching one or more criteria of the NAT rule to the subscriber.

8. The method of claim 1, wherein the network device comprises a router or a mobile gateway.

9. The method of claim 3, further comprising:

computing the private address space for the NAT rule by identifying a set of private address prefixes designated by the NAT rule and computing a total number of private addresses for the set of private address prefixes;

computing the public address space for the NAT rule by identifying a NAT pool designated by the NAT rule and computing a total number of public addresses for a set of public address prefixes of the NAT pool;

computing a number of the total number of private addresses for the NAT rule to be assigned to each of the public network addresses of the specified NAT pool based on the number of the total number of public addresses for the NAT rule and the total number of private addresses for the NAT rule;

computing the port block size per each of the private addresses based on a number of ports available for each of the public addresses for the NAT pool and the total number of private addresses to be assigned to each of the public network address.

10. A method comprising:

receiving, with a network device, a network address translation (NAT) rule that specifies;

(i) a contiguous range of private network addresses, (ii) a contiguous range of public network addresses having a total number of public network addresses that is less than a total number of private network addresses of the range of private network addresses specified by the NAT rule, and (iii) a port block size;

prior to receiving an initial packet for a new packet flow, programming NAT information within a forwarding component of the network device, wherein the NAT information comprises the total number of private addresses for the NAT rule, the total number of public network addresses for the NAT rule and the port block size for the NAT rule;

receiving, with the forwarding component of the network device, the initial packet for the new packet flow from a subscriber, wherein the packet includes a private source network address and a source port; and

responsive to the initial packet for the new packet flow, deterministically computing, with the forwarding component of the network device and using the programmed NAT information, a public network address and a range of ports for network address translation of packets of the packet flow, wherein deterministically computing the public network address and the range of ports comprises applying operations that repeatably and deterministically compute a corresponding public network address within the contiguous range of public network addresses and a corresponding range of ports for any one of the private network addresses in the contiguous range of private network address specified by the NAT rule.

11. A network device comprising:

a plurality of interfaces configured to send and receive packets for subscribers of a service provider network;

a control unit that provides a user interface for configuring at least one network address translation (NAT) rule for performing NAT on the packets of the subscribers, wherein the NAT rule that specifies a contiguous range of private addresses and a contiguous range of public network addresses, and wherein range of the public network addresses specified by the NAT rule has a total number of public network addresses that is less than a total number of private network addresses of the range of private network addresses specified by the NAT rule;

a NAT controller that, upon receiving an initial packet for a new subscriber session, deterministically computes a public network address and a range of ports and selects an unused port from the range of ports for network address translation of packets of the new subscriber session, wherein deterministically computing the public network address and range of ports comprises applying one or more operations that repeatably and deterministically compute corresponding public network addresses within the contiguous range of public network addresses and range of ports for any respective one of the private network addresses in the contiguous range of private network address specified by the NAT rule by;

(i) computing, based on the private source network address of the initial packet, a first offset representing a position of the private source network address within the private address space specified by the NAT rule, (ii) computing, based the computed position within the private network address space for the private network address of the initial packet and based on a total number of public network addresses within the public address space specified by the NAT rule, a second offset representing a position within the public address space specified by the NAT rule, and (iii) computing, based on the second offset representing the position within the public network address space, the public network address for performing NAT of the initial packet; and

a forwarding component to output a translated packet that includes the computed public network address and the selected unused port in place of the private source address and a source port of the initial packet.

12. The network device of claim 11,

wherein the NAT controller pre-computes NAT information for the NAT rule, the NAT information comprising a total number of private network addresses for the subscribers of the service provider network serviced by the NAT rule, a total number of public network addresses for a NAT pool associated with the NAT rule, and a port block size per each of the subscribers, and

wherein, upon receiving the initial packet for the new subscriber session, the NAT controller applies the one or more operations to deterministically compute the public network address and the range of ports assigned to a private network address of the packet based on the pre-computed NAT information.

13. The network device of claim 11, wherein the NAT controller computes a port block offset as a function of both the first offset within the private address space and the number of public network addresses within the public address space, and computes the range of ports for the subscriber as a function of the port block offset and a port block size specified by the NAT rule.

14. The network device of claim 11, wherein the NAT controller is configured to generate a system log file to store an activation time period for the NAT rule without recording network address translation of the private source network address to the public network address.

15. The network device of claim 11, further comprising a bitmap for the port range assigned to the private network address, wherein each bit within the bitmap indicates whether the corresponding port is being used for network address translation of a current communication session from the subscriber,

wherein, based on the bitmap, the NAT controller selects one of the ports within the port range that is not being used for a current communication session from the subscriber.

16. The network device of claim 11, further comprising:

a fallback pool of public network addresses,

wherein, when all of the ports within the range of ports assigned to the private network address are currently being used, the NAT controller selects the public network address and unused port from a fallback pool of public network addresses, and

wherein the NAT controller generates and stores a system log file to record network address translation of the private source network address to the public network address.

17. The network device of claim 11, wherein the NAT controller selects the NAT rule from a plurality of NAT rules upon matching one or more criteria of the NAT rule to contents of the packet.

18. The network device of claim 11, wherein the network device comprises a router or a mobile gateway.

19. The network device of claim 13, wherein the NAT controller pre-computes the NAT information by:

computing the private address space for the NAT rule by identifying a set of private address prefixes designated by the NAT rule and computing a total number of private addresses for the set of private address prefixes;

computing the public address space for the NAT rule by identifying a NAT pool designated by the NAT rule and computing a total number of public addresses for a set of public address prefixes of the NAT pool;

computing a number of the total number of private addresses for the NAT rule to be assigned to each of the public network addresses of the specified NAT pool based on the number of the total number of public addresses for the NAT rule and the total number of private addresses for the NAT rule; and

computing the port block size per each of the private addresses based on a number of ports available for each of the public addresses for the NAT pool and the total number of private addresses to be assigned to each of the public network address.

20. A network router comprising:

a plurality of interfaces configured to send and receive packets for subscribers of a service provider network;

a routing engine comprising a control unit that executes a routing protocol to maintain routing information specifying routes through a network, wherein the control unit provides a user interface for configuring at least one network address translation (NAT) rule that specifies a contiguous range of private addresses and a contiguous range of public network addresses;

a forwarding component configured by the routing engine to select next hops for the packets in accordance with the routing information, the forwarding component comprising a switch fabric to forward the packets to the interfaces based on the selected next hops; and

a NAT controller of the network router that, when processing initial packets for new packet flows from the subscribers, assigns a corresponding one of the public network addresses specified by the NAT rule and a corresponding range of ports for network address translation of the respective new packet flow,

wherein, when processing the initial packets and assigning the public network addresses and port ranges for network address translation of the new packet flows, the NAT controller applies operations to source private network addresses within the new packet flows to repeatably and deterministically compute, for each new packet flow, the corresponding public network address within the contiguous range of public network address and the corresponding range of ports to be used for network address translation by;

(i) computing a first offset representing a position of a private source network address within a private address space specified by the NAT rule, (ii) computing, based the first offset and based on a total number of public network addresses within a public address space specified by the NAT rule, a second offset representing a position within the public address space specified by the NAT rule, and (iii) computing, based on the second offset, the public network address for performing NAT on packets of the new packet flow.

21. The network router of claim 20,

wherein the NAT controller pre-computes NAT information for the NAT rule prior to receiving the packet for the new packet flows from the subscribers, the NAT information comprising a total number of private network addresses for the subscribers of the service provider network serviced by the NAT rule, a total number of public network addresses for a NAT pool associated with the NAT rule, and a port block size per each of the subscribers, and

wherein, upon receiving the initial packets for the new packet flows from the subscribers, the NAT controller deterministically computes, for each new packet flow, the corresponding public network address and the range of ports assigned to a private network address of the packet flow based on the pre-computed NAT information.

22. The network router of claim 20, wherein the forwarding component includes a flow control module that, upon receiving the packets for the new subscriber session, directs the packets to the NAT controller.

23. The network router of claim 20, wherein the NAT controller executes on a removable service card of the network router.

24. The network router of claim 20,

wherein the user interface supports a syntax by which a user specifies the NAT rule and a fallback pool of public network addresses, and

wherein, when all of the ports within the range of ports assigned to the private network address are currently being used for a give one of the subscribers, the NAT controller selects the public network address and unused port from a fallback pool of public network addresses and generates a system log file to record network address translation of the private source network address to the public network address.