37. Configure Dynamic NAT
Network Address Translation
*Private Network:
Class A = 10.0.0.0/8
Class B = 172.16.16.0/16 - 172.16.31.0/16
Class C = 192.168.0.0/24 - 192.168.255.0/24
*Public IP Address
any address not included in the Private IP range
except Resevered IP Addresses by IANA
= when going to internet, devices will use the Public IP, otherwise Private IP when internal traffic
*Two Major Type of NAT
1. Static NAT
refers to 1:1 translation
One private IP to one public IP NAT
example: 172.16.16.1 (private IP) translate to 50.0.0.1 (public IP) when going to internet
2.Dynamic NAT
uses PAT (Port Address Translation)
"overload" command to enforrce PAT
also known as "NAT with Overload"
*One private IP to many public IP NAT
example: 172.16.16.1 (private IP) translate to 50.0.0.1 - 50.0.0.5 (public IPs) when going to internet
*Many private IP to one public IP NAT
example: 172.16.16.0/24 (private IP) translate to 50.0.0.1 (public IP) when going to internet
*Many private IP to many public IP NAT
example: 172.16.16.0/24 (private IP) translate to 50.0.0.1 - 50.0.0.5 (public IPs) when going to internet
----------------------------------------------------------------------------------------------------------------------
Many Private IP to Many Public IP NAT
Scenario:
Public Network Address: 185.32.50.80/29
Usable IP Address Range: 185.32.50.81 - 185.32.50.86/29
Private Network: 172.16.16.0/24 ======== ACL#: 10
Public Address: 185.32.50.81/29 - 185.32.50.84/29 ======= pool1
Private Network: 172.16.18.0/24 ======== ACL#: 20
Public Address: 185.32.50.85/29 - 185.32.50.86/29 ======= pool2
Step 1: Create a pool of Public IP Addresses to be leased out ....
Pool = container
Syntax:
conf t
ip nat poll (pollname) (lower ip limit) (upper ip limit) netmask (subnet mask)
answer:
R3:
conf t
ip nat pool pool1 185.32.50.81 185.32.50.84 netmask 255.255.255.248
ip nat pool pool2 185.32.50.85 185.32.50.86 netmask 255.255.255.248
Step 2: Create an ACL permitting the private network that will borrow the public IP addresses
Syntax:
conf t
access-list (acl#) permit (source ip/net addrs) (wildcard mask)
answer:
R3:
conf t
access-list 10 permit 172.16.16.0 0.0.0.255
access-list 20 permit 172.16.18.0 0.0.0.255
Step 3: Link the pool and the ACL together
synatx:
conf t
ip nat inside source list (acl#) pool (poolname) overload
answer:
R3:
conf t
ip nat inside source list 10 pool pool1 overload
ip nat inside source list 20 pool pool2 overload
Step 4: Configure inside and outside NAT interfaces
*inside interface = interface of the router where the private network is connected that will borrow public IP addresses. Could be multiple
inside interfaces.
= in our scenario, the inside interface are the following: int loopback 0; int loopback 2
answer:
R3:
conf t
int loopback 0
ip nat inside
exit
int loopback 2
ip nat inside
exit
*outside interface = interface of thr router connected to the internet. Interface where translation happens.
= in our scenarion it is int se 0/1/1 of R3.
answer:
R3:
conf t
int se 0/1/1
ip nat outside
exit
TESTING:
1. Do an extended ping from R3
source: 172.16.16.1
destination: 201.52.60.1 (R2)
verify: show ip nat translations
source: 172.16.18.1
destination: 201.52.60.1 (R2)
verify: show ip nat translations
to have a ping on the above test, we will configure static route on R2 informing that the network
185.32.50.80/29 public IP is in R3.
R2:
conf t
ip route 185.32.50.80 255.255.255.248 se 0/1/1
exit