NAT Flashcards
NAT Types: Static
Permanent 1:1 mapping usually between public/private IP
Used for servers which must accept incoming connections
NAT Types: Dynamic
Uses a pool of public addresses which are given out on an as needed first come first served basis
Usually used for internal hosts which need to connect to the internet but do not accept incoming connections
NAT Types: PAT
Port Address Translation:
Allows the same public IP address to be reused
Command: Configure Static NAT (F0/0 = Outside | F1/0 = Inside)
Inside Address: 10.0.1.10
Outside Address: 203.0.113.3
interface f0/0
ip nat outside
interface f1/0
ip nat inside
(From global config):
ip nat inside source static 10.0.1.10 203.0.113.3
Command: Verify NAT Translations
show ip nat translation
Inside Local
The IP address actually configured on the inside host’s OS
Inside Global
The NAT’d address of the inside host as it will be reached by the outside network
Outside Local
The IP address of the outside host as it appears to the inside network
Outside Global
The IP address assigned to the host on the outside network by the host’s owner
Outside Local vs. Outside Global
For one way NAT, the Outside Local & Global addresses will be reported as being the same
Command: Configure Dynamic NAT (F0/0 = Outside | F2/0 = Inside)
Pool Range: 203.0.113.4 to 203.0.113.14 in a /28 network
Internal IPs to Translate: 10.0.2.0/24
Int f0/0
Ip nat outside
Int f2/0
Ip nat inside
Ip nat pool Flackbox 203.0.113.4 203.0.113.14 netmask 255.255.255.240
–Configure the pool of global addresses
Access-list 1 permit 10.0.2.0 0.0.0.255
–Create an ACL which references the internal IPs we want to translate
Ip nat inside source list 1 pool Flackbox
–Associate the access list with the NAT pool to complete the configuration
Command: Clear NAT Translations
clear ip nat translation *
Command: Show how many addresses that have been translated
show ip nat statistics
Command: Show live NAT changes
debug ip nat
PAT Overview
PAT is an extension to NAT that permits multiple devices to be mapped to a single IP
With PAT you don’t need a public IP for every single host
The router tracks translations by IP & port number
