Management of NAT-based private networks

Management of NAT-based private networks from a centralized site, especially in the managed service provider (MSP) environment, has been a difficult problem to solve. Proposed solutions involve unacceptable constraints like static one-on-one mappings for all devices to be managed, and implementing complex application level gateways (ALGs) that translate addresses in protocol-specific traffic traversing the NAT device. This paper describes a domain-based routing approach used in conjunction with tunneling that solves the NAT management problem regardless of the type of NAT deployed and obviates the need for implementing any ALGs. We describe our implementation experience with a prototype and present some performance measurements. We believe that the domain-based approach to dealing with private networks has applicability that goes beyond management.