Lab 2.6.3 Network Address Translation -- Configuring Overloading Translation

Objective:

Demonstrate the use of Network Address Translation through the use of overloading address translation.

Equipment Requirements:

Two routers One switch Two workstations

Background:

A small company has been using the private address 10.10.10.0/24 for their network. Until recently they did not need access outside of their own network. Since they now need Internet access they have been issued the class C address 202.206.154.0 by ARIN. Currently the company needs more than the number of addresses in a Class C network. For a variety of reasons including security reasons, the company wishes to hide the internal network from the outside. All of the users need to be able to connect to the outside. These users need to have unlimited access to the outside.

Preliminary:

Before programming the routers, make sure that the IOS version on the router supports Network address translation. Load a new IOS version if necessary. Construct the above network section, using IGRP or RIP as your routing protocol. Do not advertise the private network. Use the network address 200.200.200.16/28 on the serial link from the stub network router (Router-B) and the Internet/Network router (Router-A).

The router IP configurations are as follows: 

Router-A Router-B
  Fa 0/0=10.10.10.1/24
S0/0=200.200.200.17/28 S0/0=200.200.200.18/28

Note: actual interfaces used might vary depending on what type of router used.

When construction of the network is complete, verify that routers can communicate and are sharing their routing tables for network 200.200.200.16/28. Also verify that the workstations are configured correctly for the network in which they reside. For verification use the show ip route command, show interfaces command, show running-configuration command, ping, telnet, and any other relevant command(s).

For this Lab we will be using Router-B as the stub network router where we will configure the network address translation. The router will be translating the inside local addresses to inside global addresses, in other words, converting the internal fake addresses into real addresses for use on the Internet.

From the "Router-B" console:

Step 1

  • Enter the EXEC mode.

Step 2

  • Enter the configuration mode by entering configure terminal command at the router prompt.

Step 3

Define a pool of global addresses to be allocated as needed.

  • Enter ip nat pool net-11 202.206.154.2 202.206.154.17 netmask 255.255.255.0

Step 4

Define a standard access list.

  • Enter access-list 3 permit 10.10.10.0 0.0.0.255

What is the purpose of the access list?

Step 5

Establish dynamic source translation, identifying the access list defined in the prior step.

  • Enter ip nat inside source list 3 pool net-11 overload

What does the word "overload" at the end of the command mean?

Step 6

Specify the inside interface.

  • Enter interface fa 0/0 (or correct inside interface for router used)

Step 7

Mark the interface as connected to the inside.

  • Enter ip nat inside

Step 8

Specify the outside interface.

  • Enter interface serial 1 (or correct outside interface for router used)

Step 9

Mark the interface as connected to the outside.

  • Enter ip nat outside

Step 10

Save configuration information.

  • Enter CTRL-Z
  • Enter copy run start

Step 11

Configure timeout values if required.

  • Enter ip nat translation udp-timeout 120
  • Enter ip nat translation dns-timeout 60
  • Enter ip nat translation tcp-timeout 120

Name a reason when you might want to give more time than the Cisco default timeout.

Step 12

Monitoring NAT

  • Enter show ip nat translations

What information did the router respond with?

  • Enter show ip nat translations verbose

What additional information did the router respond with?

  • Enter show ip nat statistics

What information did the router respond with?

Did you remember to add the static route on router A?

From a workstation on the inside network ping an address on the outside

From the router console

  • Enter show ip nat translations

What information did the router respond with?

  • Enter show ip nat statistics

What information did the router respond with?

  • From Router-A ping an address which has a nat listing on the translations table.

Were you successful?

  • Now from Router-A ping an address that is not currently in the routers translation table.

Were you successful?

Explain the results of the previous questions.

What is meant by NAT "overloading"?

When configuring for overloading what is the maximum number of translations that can be made with one inside global IP address?