Re: Large edu's doing NAT campus wide?

[Randy Marchany <marchany () CANDI2 CIRT VT EDU>]

Doing NAT campus-wide?

You need to ask yourself the following questions:

1. What is the purpose of using NAT?
        a. To hide IP addresses?
                -Wireless makes it easy to determine the address
        b. To address running out of IP address space?
                - could be a good solution
        c. Protect your systems?
                - Does NAT really add to protecting a host? Personal FW +
                  border controls seem to be enough. Again, wireless
                  forces you to consider its impact on this strategy.

Using NAT for security purposes doesn't really add anything to your defense
posture IMHO. Wireless is the weakness. However, using it for extending IP
address space might be better but there are probably better solutions around.

Just my .02.

        -Randy Marchany
        VA Tech IT Security Office/Lab