IPX Address Mapping Gateway

Using the IPX Address Mapping Gateway (IAMG) offers the following three advantages:

• Your hosts can connect to a backbone network even when your local network numbers are not compatible with the backbone addressing scheme.
• If the routing protocol in the backbone does not support route aggregation (such as earlier implementations of NLSP), the routing protocol probably cannot manage the number of network addresses from every customer. Even if the routing protocol could handle route aggregation, network numbers might be assigned in a way that does not lend itself to aggregation. IAMG enables the summarization of routes in a manner transparent to the routing protocol by mapping many network numbers to a single number outside the local network. This capability greatly reduces the number of networks that must be advertised throughout the global internetwork.
• The security of the local intranet is enhanced because local networks are not advertised throughout the global internetwork.

In Figure 7 , any packets generated from the client on the customer network for the backbone have their source IPX network number converted to the 01014000 gateway address. In addition to mapping a client network address to an address compatible with the backbone, IAMG converts the IPX node address to a unique value based on characteristics of the original node number. Services on the customer network, such as file servers with Novell Directory Services (NDS) that advertise their network addresses through SAP and that must be visible in the backbone, are not translated. To be visible in the backbone network, the services must use a registered backbone address. All registered source addresses are left untranslated.

Figure 7
IAMG Implementation

The IAMG allows multiple gateways to be connected between the customer network and backbone network in parallel. All such gateways on a customer's network share a single gateway address. If a gateway receives a packet from the backbone network with an unknown mapping on the gateway network, the packet is forwarded to all other IAMGs advertising the same gateway address. If necessary, the packet is split into multiple segments using the IPX fragmentation module so that the packet can be forwarded with a new header attached.

If not all gateways support the IPX fragmentation specification, the IAMG is designed to allow the gateways to run in parallel. In this automatic mode of operation, some packets might be lost during the learn cycle. When the gateway that created the mapping receives the forwarded data packets from the backbone, an update reporting the mapping is returned to the gateway that initially received the packet. Because more packets probably will follow, the gateway learns the new mapping.

The IAMG discards any packet destined for the gateway that has the broadcast node address so that outside clients cannot cause an excessive number of broadcasts within a network. NetBIOS broadcasts (packet type 20) cannot be used on a network attached to an interface that has the IAMG enabled. Broadcasts to networks other than the gateway address are allowed.

When the IAMG is configured, care must be taken to avoid address conflicts. We recommend using the following configuration guidelines:

• Conflicts might occur when token ring and Ethernet interfaces are used on the same network. For instance, when the NetWare Mobile IPX^TM software and NetWare remote access software assign node addresses, they set the IEEE Local bit and clear the IEEE Multicast bit. Because token ring networks use a different bit order (canonical instead of noncanonical) within the node address, incorrect interpretations can be made, and locally assigned addresses might conflict with IEEE token ring addresses. It is also possible for IEEE Ethernet node addresses to conflict with IEEE token ring addresses, even though the IEEE assigned addresses are different. You can avoid conflicts by taking the following precautions:
  • Use command line switches to load the LAN drivers on the conflicting segments with the opposite canonical order for the MAC addresses.
  • Use a different LAN card.
  • Because detected conflicts are echoed to the system console, resolve conflicts by manually reconfiguring the address of the offending workstation.

• If a router supporting IPX WAN client dial-in connections is configured to use node addresses that use the upper 34 bits of the node address, node address conflicts can occur. To avoid conflicts, the IPX WAN client router must have a registered network address for the WAN clients that is not translated, or it must use a low node address (less than 14 bits) on that network.