11 - Implementing NAT

Question 1

This is the IP of a host on inside network

Answer 1

inside local

Question 2

This is the address the inside local is translated to.

Answer 2

inside global

Question 3

This is typically a global address of host owner of outside network

Answer 3

outside global

Question 4

This is the address of outside host, on the outside network, typically private address

Answer 4

outside local

Question 5

What are the benefits of NAT?

Answer 5

• Eliminates need to readdress hosts
• Conserves addresses via PAT
• Network security

Question 6

What are some disadvantages of NAT?

Answer 6

• Some applications depend on end-to-end functionality with unmodified packets
• End-to-traceability can be lost
• Complicates tunnelling protocols
• Disrupts servers that require initiation of TCP connections from outside network
• Switching delays because of translation of each address

Question 7

PAT uses unique ___ numbers on the inside global address to distinguish between translations.

Answer 7

source port

Question 8

PAT attempts to preserve the original __ port, if __ port is already allocated, it attempts to find ___ port number

Answer 8

source, source, next available

Question 9

What are the features of a NAT virtual interface?

Answer 9

• Removes requirement to configure inside or outside interfaces
• Different order of operation
• Configure with ip nat enable interface command
• Performs routing operation twice, before and after translation, as opposed to classic NAT which performs routing then translates address from inside to outside or vice versa
• Because of added routing step, packets can flow from and inside interface to an inside interface, whereas classic NAT would fail

Question 10

How is static NAT configured?

Answer 10

Configure the translation
Router(config)#Ip nat inside source static local-ip global-ip
Configure the inside and outside interfaces
Router(config-if)#Ip nat inside
Router(config-if)#Ip nat outside

Question 11

How is dynamic NAT configured?

Answer 11

Configure dynamic NAT address pool
router(config)# ip nat pool pool-name start-ip end-ip {netmask netmask | prefix-length prefix-length}
Configure static ACL to define addresses to be translated
router(config)# access-list access-list-number permit source [source-wildcard]
Configure dynamic NAT translation. Overload enables use of PAT
router(config)# ip nat inside source list access-list-number pool pool-name [overload]
Configure the inside and outside interfaces
Router(config-if)#Ip nat inside
Router(config-if)#Ip nat outside

Question 12

How is PAT configured?

Answer 12

Configure static ACL to define addresses to be translated
router(config)# access-list access-list-number permit source [source-wildcard]
Configure PAT
router(config)# ip nat inside source list access-list-number interface interface overload
Configure the inside and outside interfaces
Router(config-if)#Ip nat inside
Router(config-if)#Ip nat outside

Question 13

How do you verify NAT translations?

Answer 13

show ip nat translations

Question 14

How do you clear dynamic translations?

Answer 14

clear ip nat translation * (does not clear static translations or ones still in use)