Configure and verify IPv4 Network Address Translation (NAT)

Exam: Cisco 200-301 - Cisco Certified Network Associate (CCNA)

Have you ever thought, there are billions of devices around the globe and do all of them have a unique public IP address to access the Internet? The answer is "No". Routers block private IP addresses and allow only the public IP addresses to reach the Internet. With the huge number of devices used today, we would have exhausted all the available IPv4 public addresses but, using the Network Address Translation (NAT) technique we preserve a considerable number of IPv4 public addresses for the future use.

The NAT is a networking technique that enables a device or host that is assigned with a private IP address to communicate with other devices through the Internet. A router configured with NAT and a unique public IP address make this technique operational.

The different types of NAT techniques are:

Static NAT
Dynamic NAT
Port Address Translation (PAT) or NAT Overloading

Static NAT

Static NAT maps a single private IP address to a single public or registered IP address. This technique requires a unique public IP address for every device (one-to-one) on your network.

A home network connected to the Internet with a single PC or computer is an example for Static NAT. In this network, the private IP address of the device gets mapped to the public IP address of the Internet Service Provider (ISP) to route to the Internet.

Configuring Static NAT

Consider a home network with a private IP address 192.168.1.4 connecting to the Internet using a public IP address 121.13.4.1.

To configure Static NAT:

1. Configure the fast ethernet interface (f0/0) of the home router with the source IP address 192.168.1.4:

Home-router# configure terminal

Home-router(config)# int f0/0

Home-router(config-if)# ip address 192.168.1.4 255.255.255.0

Home-router(config-if)# no shutdown

Home-router(config-if)# ipnat inside

2. Configure the fast ethernet interface (f0/1) with the outgoing static NAT address 121.13.4.1:

Home-router(config-if)# int f0/1

Home-router(config-if)# ip address 121.13.4.1 255.255.255.0

Home-router(config-if)# no shutdown

Home-router(config-if)# ipnat outside

Home-router(config-if)# exit

3. Configure the home router to translate the private IP 192.168.1.4 to public IP 121.13.4.1 for the home network to get access to the Internet:

Home-router(config)# ipnat inside source static 192.168.1.4 121.13.4.1

The ISP router connecting to your home router will have a configuration similar to this to facilitate Internet connectivity:

ISP-Router# config terminal

ISP-Router(config)# int f0/0

ISP-Router(config-if)# ip address 121.13.4.1 255.255.255.0

ISP-Router(config-if)# no shutdown

Verifying Static NAT Configuration

1. Run the command show ipnat translationson your home router. The output is similar to this:

Home-router#showipnat translations

Pro	Inside global	Inside local	Outside local	Ouside global
---	121.13.4.1	192.168.1.4	---	---

2. (Optional) Ping the Public IP address and the ISP IP address to verify Static NAT configuration and connectivity.

Dynamic NAT

Dynamic NAT allows you to map a single private IP address to a single public or registered IP address from a pool of public IP addresses. This technique does not require a static configuration on your router. You can configure more number of private IP addresses in your network to map to the pool of public IP addresses. The router dynamically allocates public IP addresses from the pool.

A small or medium enterprise network that has 300 employees and a pool of 30 public IP address is an example for Dynamic NAT.

Configuring Dynamic NAT

Consider a small enterprise network that has 50 employees with private addresses in 192.168.1.0/24 network. The ISP provides 12 public IP addresses (121.13.4.1 to 121.13.4.12) for the employers to connect to the Internet.

To configure dynamic NAT:

1. Configure a pool of public IP addresses:

Router(config)# ipnat pool pool-name first-ip last-ip { netmasknetmask | prefix-length prefix-length }

Example:

Acme-Router(config)# ipnat pool NAT-Pool 121.13.4.1 121.13.4.12 netmask 255.255.255.0

2. Configure a standard access control list to define which internal traffic is allowed to reach the Internet:

Router(config)#access-list access-list-number permit source [wildcard-mask]

Example:

Acme-Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255

3. Map the access list to the NAT pool:

Router(config)#ipnat inside source list access-list-number pool pool_name

Example:

Acme-Router(config)# ipnat inside source list 1 pool NAT-Pool

4. Configure the NAT inside and outside interfaces:

Router(config)# interface interface-name

Router(config-if)# ipnat inside

Router(config-if)# interface interface-name

Router(config-if)#ipnat outside

Example:

Acme-Router(config)# interface f0/0

Acme-Router(config-if)# ipnat inside

Acme-Router(config-if)# interface f0/1

Acme-Router(config-if)#ipnat outside

Verifying Dynamic NAT Configuration

1. Run the command show ipnat translations command on your home router. The output is similar to this:

Acme-router# show ipnat translations

Pro	Inside global	Inside local	Outside local	Ouside global
---	121.13.4.1	192.168.1.4	---	---
---	121.13.4.2	192.168.1.5	---	---
---	121.13.4.3	192.168.1.7	---	---

2. (Optional) Ping the Public IP addresses and the ISP IP address to verify Dynamic NAT configuration and connectivity.

Port Address Translation (PAT)

Port Address Translation (PAT) or NAT Overload uses different port numbers to map multiple devices on a local area network (LAN) to a single public IP address. The router maintains unique source port numbers on the inside global IP address to distinguish between translations.

The PAT is the most popular technique of NAT that allows hundreds of devices with private IP addresses to connect to the Internet using one unique public IP address. The PAT prevents IP address exhaustion and saves IPv4 address space for future use.

Configuring PAT

Consider Acme enterprise having 200 employees in one of its branch using the internal network 192.168.1.0/24. The company uses PAT with a single public IP address 121.13.4.1 for the employees to route to the Internet.

1. Configure inside and outside NAT interfaces:

RouterA(config-if)# interface internal-interface

RouterA(config-if)# ipnat inside

RouterA(config)# interface exit-interface

RouterA(config-if)# ipnat outside

Example:

Acme-Router(config-if)# interface fa0/0

Acme-Router(config-if)# ipnat inside

Acme-Router(config)# interface fa0/1

Acme-Router(config-if)# ipnat outside

2. Configure a standard access control list to define which internal traffic is allowed to reach the Internet:

Router(config)#access-list access-list-number permit source [wildcard-mask]

Example:

Acme-Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255

3 Map the access list to the interface that is used for PAT:

Router(config)# ipnat inside source list access-list-number interface interface-name overload

Example:

Acme-Router(config)# ipnat inside source list 1 interface fa0/1 overload

Verifying PAT

1. Run the command show ipnat translations command on your router. The output is similar to this:

Acme-router# show ipnat translations

Pro	Inside global	Inside local	Outside local	Ouside global
---	121.13.4.1:46389	192.168.1.4	---	---
---	121.13.4.1:46390	192.168.1.5	---	---
---	121.13.4.1:46391	192.168.1.7	---	---

Exam Question

Which NAT type preserves more public IP address?

Static NAT
Dynamic NAT
PAT
Inside Global address

Answer: C: PAT

The PAT is the most efficient NAT technique to preserve public IP address.

Related IT Guides