NAT, NAT64, NPTv6

Question 1

What is source NAT?

Answer 1

When the source address is translated to another address as part of the initial translation.

Question 2

What is Destination NAT?

Answer 2

When the destination address is translated to another address as part of the initial translation.

Question 3

What is Static NAT?

Answer 3

A hard coded translation of one address to another in the router

Question 4

What is Dynamic NAT?

Answer 4

When a range of addresses is translated on the fly by the router for a pre-defined pool of available translation addresses.

Question 5

What are the differences between inside local, inside global, outside local, and outside global addresses?

Answer 5

Inside local: The actual private IP address assigned to a device on the inside network(s).

Inside global: The public IP address that represents one or more inside local IP addresses to the outside.

Outside local: The IP address of an outside host as it appears to the inside network. The IP address does not have to be reachable by the outside but is considered private and must be reachable by the inside network.

Outside global: The public IP address assigned to a host on the outside network. This IP address must be reachable by the outside network.

Question 6

What is PAT?

Answer 6

Port Address Translation aka NAT overload. When many addresses are translated to a single address. This uses the private address and the port number to map to the global address with a port number in the translation table.

Question 7

When configuring a destination NAT (from the outside to the inside), what option might you need to add to ensure the router creates a 32 bit entry in the routing table?

Answer 7

add-route

example ip nat outside source tcp 199.10.10.1 80 10.1.1.10 6777 add-route

Question 8

Command to set an interface to be an inside or outside for NAT?

Answer 8

R1(config-if)# ip nat {inside | outside}

Question 9

Command to set a static NAT

Answer 9

R1(config)# ip nat {inside | outide} source static {source-address} {dest-address}

Question 10

Command to create a pool of NAT addresses

Answer 10

R1(config)# ip nat pool NAME {start-address} {end-address*} prefix-length 24

Question 11

Command to create an ACL to use for NAT

Answer 11

R1(config)# ip access-list standard {network-prefix} {wildcard-mask}

OR

R1(config)# ip access-list extended NAME
R1(config-ext-acl)# permit ip {network-prefix} {wildcard-mask} any

Question 12

Command to set a pooled NAT

Answer 12

R1(config)# ip nat {inside | outside} source list ACL_NAME pool POOL_NAME

Question 13

Command to set a dynamic PAT

Answer 13

R1(config)# ip nat inside source list ACL_NAME interface {outside-int} overload

OR

R1(config)# ip nat inside source list ACL_NAME pool POOL_NAME overload

Question 14

Command to set a static PAT

Answer 14

R1(config)# ip nat {inside | outside} source static tcp {address} {port} {address} {port}

Question 15

Command to display NAT translations

Answer 15

R1# show ip nat translations [brief]

Question 16

What is NAT66?

Answer 16

Network Address Translation for IPv6 - Translates IPv6 to IPv6 addresses just like standard NAT for IPv4. This is a stateful protocol meaning that it keeps track of sessions and port numbers.

Question 17

What is NPTv6?

Answer 17

Network Prefix Translation for IPv6 - Translates IPv6 to IPv6 addresses much like NAT66. However, it only translates prefixes, and it cannot be “overloaded”. It’s a 1:1 translation only. It is also stateless, meaning that it does not track port numbers and sessions which makes it more scalable.

Question 18

What are the basic commands to set up NPTv6 (NAT66) on a Cisco device? (5 commands)

Answer 18

R1(config)# int {int-id}
R1(config-if)# nat66 inside
R1(config)# int {int-id}
R1(config-if)# nat66 outside
R1(config)# nat66 prefix inside {ipv6-prefix} outside {ipv6-prefix}

Question 19

What command will verify NPTv6 (NAT66) on a Cisco device?

Answer 19

show nat66 [prefix]

Question 20

When configuring NTPv6, what is the requirements for the address prefixes?

Answer 20

Both the inside and outside address prefixes must use the same mask (i.e. /64 etc)

Question 21

What is NAT64 and what are the two types of NAT64?

Answer 21

Network Address Translation of IPv6 to IPv4 addresses. Two types are stateful and stateless?

Question 22

What are the differences between the two types of NAT64?

Answer 22

Stateful - 1-to-1 translation; does not conserve IPv4 addresses; no bindings created; requires DHCPv6; end-to-end transparency.

Stateless : 1-to-many translation (overload); conserves IPv4 addresses; lacks end-to-end transparency; no requirements on IPv6 address assignments

Question 23

What are the steps to configure NAT64 on a router?

Answer 23

• enable NAT64 on the IPv6 and the IPv4 interfaces
• create an ipv6 access list to match the traffic to translate
• from global config mode “nat64 prefix stateless {ipv6-prefix}
• from global config mode “nat64 v4 pool NAME {start-ipv4} {end-ipv4}
• from global config mode