Network address translation in a distributed switch

1 . A method, comprising:

receiving, by a first network device in a distributed switch, information indicating allocation of a public Internet Protocol (IP) address and a subset of NAT ports available for a network address translation (NAT) instance deployed in the distributed switch, wherein the distributed switch comprises a plurality of network devices operating as a single switch, and wherein the subset of the NAT ports corresponds to a number of NAT sessions associated with the first network device;

maintaining, by the first network device, a first set of address mappings of the public IP address and the subset of the NAT ports, wherein a respective network device of the distributed switch maintains address mappings of a corresponding subset of the NAT ports;

generating a first mapping between a first private IP address of a user device and a first protocol port and the public IP address and a first NAT port from the subset of the NAT ports, wherein the first mapping is in the first set of address mappings;

receiving, by the first network device, a packet destined to the public IP address and the first NAT port from a second network device of the distributed switch based on a forwarding rule indicating that the subset of the NAT ports is allocated to the first network device;

replacing, using the NAT instance, the public IP address with the first private IP address and the first NAT port with the first protocol port in the packet based on the first mapping; and

forwarding the packet to the user device based on the first private IP address.

2 . The method of claim 1 , further comprising:

determining that a number of allocated NAT ports from the subset of the NAT ports has reached a threshold; and

receiving, by the first network device, information indicating allocation of an updated subset of the NAT ports, wherein the updated subset corresponds to an updated number of NAT sessions associated with the first network device.

3 . The method of claim 1 , wherein the user device is coupled to a multi-chassis link aggregation group (MC-LAG) comprising the first network device and a peer network device in the distributed switch.

4 . The method of claim 3 , further comprising receiving the second packet at the first network device while bypassing load balancing associated with the MC-LAG.

5 . The method of claim 3 , further comprising synchronizing the first mapping with the peer network device for storing the first mapping in a memory of the peer network device.

6 . The method of claim 5 , further comprising:

detecting unavailability of the first network device;

allocating the subset of the NAT ports to the peer network device; and

programming the first mapping in forwarding hardware of the peer network device.

7 . The method of claim 6 , wherein the forwarding rule specifies the peer network device as a standby device associated with the subset of the NAT ports; and

wherein, subsequent to detecting the unavailability of the first network device, the method further comprises updating the forwarding rule to indicate that the subset of the NAT ports is allocated to the peer network device.

8 . The method of claim 3 , further comprising:

detecting unavailability of a link of the MC-LAG coupling the first network device;

receiving a third packet destined to the public IP address and the first NAT port from the second network device based on the forwarding rule; and

forwarding the third packet to the peer network device for forwarding via the MC-LAG.

9 . The method of claim 1 , wherein generating the first mapping further comprises:

receiving an initial packet from the user device with the first private IP address as a source address; and

allocating the first NAT port from the subset of the NAT ports to the first private IP address.

10 . A non-transitory computer-readable storage medium storing instructions to:

receive, by a first network device in a distributed switch, information indicating allocation of a public Internet Protocol (IP) address and a subset of NAT ports available for a network address translation (NAT) instance deployed in the distributed switch, wherein the distributed switch comprises a plurality of network devices operating as a single switch, and wherein the subset of the NAT ports corresponds to a number of NAT sessions associated with the first network device;

maintain, by the first network device, a first set of address mappings of the public IP address and the subset of the NAT ports, wherein a respective network device of the distributed switch maintains address mappings of a corresponding subset of the NAT ports;

generate a first mapping between a first private IP address of a user device and a first protocol port and the public IP address and a first NAT port from the subset of the NAT ports, wherein the first mapping is in the first set of address mappings;

receive, by the first network device, a packet destined to the public IP address and the first NAT port from a second network device of the distributed switch based on a forwarding rule indicating that the subset of the NAT ports is allocated to the first network device;

replace, using the NAT instance, the public IP address with the first private IP address and the first NAT port with the first protocol port in the packet based on the first mapping; and

forward the packet to the user device based on the first private IP address.

11 . The non-transitory computer-readable storage medium of claim 10 , wherein the instructions are further to:

determine that a number of allocated NAT ports from the subset of the NAT ports has reached a threshold; and

receive, by the first network device, information indicating allocation of an updated subset of the NAT ports, wherein the updated subset corresponds to an updated number of NAT sessions associated with the first network device.

12 . The non-transitory computer-readable storage medium of claim 10 , wherein the user device is coupled to a multi-chassis link aggregation group (MC-LAG) comprising the first network device and a peer network device in the distributed switch.

13 . The non-transitory computer-readable storage medium of claim 12 , wherein the instructions are further to receive the second packet at the first network device while bypassing load balancing associated with the MC-LAG.

14 . The non-transitory computer-readable storage medium of claim 12 , wherein the instructions are further to synchronize the first mapping with the peer network device for storing the first mapping in a memory of the peer network device.

15 . The non-transitory computer-readable storage medium of claim 14 , wherein the instructions are further to:

detect unavailability of the first network device;

allocate the subset of the NAT ports to the peer network device; and

program the first mapping in forwarding hardware of the peer network device.

16 . The non-transitory computer-readable storage medium of claim 15 , wherein the forwarding rule specifies the peer network device as a standby device associated with the subset of the NAT ports; and

wherein, subsequent to detecting the unavailability of the first network device, the instructions are further to update the forwarding rule to indicate that the subset of the NAT ports is allocated to the peer network device.

17 . The non-transitory computer-readable storage medium of claim 12 , wherein the instructions are further to:

detect unavailability of a link of the MC-LAG coupling the first network device;

receive a third packet destined to the public IP address and the first NAT port from the second network device based on the forwarding rule; and

forward the third packet to the peer network device for forwarding via the MC-LAG.

18 . The non-transitory computer-readable storage medium of claim 10 , wherein, to generate the first mapping, the instructions are further to

receive an initial packet from the user device with the first private IP address as a source address; and

allocate the first NAT port from the subset of the NAT ports to the first private IP address.

19 . A computer system, comprising:

one or more processing resources; and

a non-transitory computer-readable storage medium storing instructions that when executed by the one or more processing resources cause the computer system to:

receive information indicating allocation of a public Internet Protocol (IP) address and a subset of NAT ports available for a network address translation (NAT) instance deployed in a distributed switch, wherein the distributed switch comprises a plurality of devices, which includes the computer system, operating as a single switch, and wherein the subset of the NAT ports corresponds to a number of NAT sessions associated with the computer system;

maintain a first set of address mappings of the public IP address and the subset of the NAT ports, wherein a respective device of the distributed switch maintains address mappings of a corresponding subset of the NAT ports;

generate a first mapping between a first private IP address of a user device and a first protocol port and the public IP address and a first NAT port from the subset of the NAT ports, wherein the first mapping is in the first set of address mappings;

receive a packet destined to the public IP address and the first NAT port from a second computer system of the distributed switch based on a forwarding rule indicating that the subset of the NAT ports is allocated to the computer system;

replace, using the NAT instance, the public IP address with the first private IP address and the first NAT port with the first protocol port in the packet based on the first mapping; and

forward the packet to the user device based on the first private IP address.

20 . The computer system of claim 19 , wherein the instructions when executed by the one or more processing resources cause the computer system to:

determine that a number of allocated NAT ports from the subset of the NAT ports has reached a threshold; and

receive information indicating allocation of an updated subset of the NAT ports, wherein the updated subset corresponds to an updated number of NAT sessions associated with the computer system.