| 🏠 Back to Exam Syllabus | 📺 RooCloud on YouTube | 🌐 RooCloud Practice Exams |
CISSP 12.10 - Network Address Translation
This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series unpacks how private networks reach the internet without exposing themselves, part of Domain 4. It explains how translation lets many internal machines share a handful of public addresses while staying hidden, and how reading an address correctly lets you diagnose a network at a glance.
What this episode covers
- The problem NAT solves — hiding internal layout, stretching scarce public addresses, and acting as a basic one-way firewall.
- Port address translation — adding the port number so a single public address serves thousands of sessions at once.
- NAT traversal — the feature that lets translation and IPSec VPNs coexist on one border device.
- Static translation — port forwarding that opens a controlled inbound door, discouraged and limited to screened subnets.
- Translation for the newer IP version — mapping many private version-six addresses onto a smaller public pool, a debated choice.
- Private address ranges — reserved, unroutable blocks in the 10, 172, and 192.168 spaces that public routers drop.
- Stateful translation and special addresses — a mapping table tracks each session, while self-assigned and loopback addresses stay distinct.
Watch the full episode above for the worked examples and detailed explanations of each concept.
Frequently Asked Questions
What problem does network address translation solve?
Network address translation, or NAT, hides your internal layout and stretches scarce public addresses. It swaps the private address of an internal client for the public address on your border device as traffic leaves, so outsiders never learn how your network is arranged. It also lets you run any private addressing without colliding with real internet hosts, and it acts like a simple one-way firewall since replies are only allowed back in when they answer a request that started inside.
How does one public address serve a whole office?
Through a close relative called port address translation, also known as overloaded translation. Plain translation maps one private address to one public address, so one lease equals one simultaneous user. Port translation adds the transport port number to the mix, mapping each internal address-and-port pair to an external one, which lets a single public address juggle thousands of conversations at once. In practice the word NAT usually already means this port-based version.
How does translation coexist with IPSec VPNs?
Traditional translation breaks IPSec VPNs, because rewriting the packet headers looks to IPSec like tampering. The fix is a feature called NAT traversal, designed specifically so IPSec and other tunneling protocols can coexist with translation on the same border device. This lets an organization enjoy both hidden addressing and encrypted tunnels through one interface, like a special envelope that relabels the outside without disturbing the sealed contents inside.
Which private address ranges make translation work?
A set of blocks reserved long ago for private, unrestricted use: one large block starting with ten, a middle set of blocks in the 172 range, and a familiar block starting with 192.168 that you see in homes and offices. Routers on the public internet refuse to carry these addresses, dropping any packet that claims one as its source. That is why they are safe to reuse internally and why pairing them with translation slashes the number of public addresses you must lease.
Why must you not confuse loopback and self-assigned addresses with private ones?
The loopback address is a purely software address a system uses to talk to itself over the network stack; the range beginning with 127 is reserved for it, and it exists to test local networking. Automatic private addressing is a Windows fallback that kicks in when the assignment server does not answer, self-assigning an address that only reaches other stranded machines on the same segment. The exam wants you to keep public, private reserved, and loopback addresses distinct.
📚 Master the ISC2 CISSP Exam!
Ready to test your knowledge? Access chapter-specific Multiple Choice Questions (MCQs) and full-length practice exams for the ISC2 CISSP certification at RooCloud.com. Solve the chapter-wise questions to reinforce this lesson before moving to the next episode.
Reference: This article is based on concepts discussed in CISSP 12.10 - Network Address Translation.