Lab 2.6.1 Network Address Translation -- Configuring Static Translation

Objective:

Demonstrate the use of Network Address Translation through the use of static translation.

Equipment Requirements:

Two routers One switch Two workstations

Background:

A small company has been using the private address 10.10.10.0/24 for their network. Until recently they did not need access outside of their own network. Since they now need Internet access they have been issued the class C address 202.206.154.0 by ARIN. Currently the company does not require the full number of addresses in a Class C network; however, they will require the addresses as the company grows. For a variety of reasons including security reasons, the company wishes to hide the internal network from the outside. Presently only a few users need to be able to connect to the outside. These users need to have unlimited access to the outside.

Preliminary:

Before programming the routers, make sure that the IOS version on the router supports Network address translation. Load a new IOS version if necessary. Construct the above network section, using IGRP or RIP as your routing protocol. Do not advertise the private network. Use the network address 200.200.200.16/28 on the serial link from the stub network router (Router-B) and the Internet/main network router (Router-A). The router ip configurations are as follows:

Note: The interfaces described below might vary according to what type of router being used.

Router-A Router-B
  Fa 0/0=10.10.10.1/24
S0/0=200.200.200.17/28 S0/0=200.200.200.18/28

When construction of the network is complete, verify that routers can communicate and are sharing their routing tables for network 200.200.200.16/28. Also verify that the workstations are configured correctly for the network in which they reside. For verification use the show ip route command, show interfaces command, show running-configuration command, ping, telnet, and any other relevant command(s).

For this Lab we will be using Router-B as the stub network router where we will configure the network address translation. The router will be translating the inside local addresses to inside global addresses, in other words, converting the internal fake addresses into real addresses for use on the Internet.

From the "Router-B" console:

Step 1

  • Enter the EXEC mode.

Step 2

  • Enter the configuration mode by entering configure terminal command at the router prompt.

Step 3

Establish static translation between an inside local address and an inside global address.

  • Enter ip nat inside source static 10.10.10.2 202.206.154.2
  • Enter ip nat inside source static 10.10.10.3 202.206.154.3

If we needed a static translation for workstation 10.10.10.4, how would we enter the configuration information into the router?

Step 4

Specify the inside interface.

  • Enter interface fa 0/0 (or correct inside interface for router used)

Step 5

Mark the interface as connected to the inside.

  • Enter ip nat inside

Step 6

Specify the outside interface.

  • Enter interface serial 0/0 (or correct outside interface for router used)

Step 7

Mark the interface as connected to the outside.

  • Enter ip nat outside

Step 8

Save configuration information.

  • Enter CTRL-Z
  • Enter copy run start

Step 9

Monitoring NAT

  • Enter show ip nat translations

What information did the router respond with?

  • Enter show ip nat statistics

What information did the router respond with?

Record Hits:

and Misses:

  • Enter show ip nat translations verbose

What information did the router respond with?

Record Create:

and Use:

  • From a workstation on the inside network ping an address on the outside

Were you successful?

From the router console:

  • Enter show ip nat translations verbose

What additional information did the router respond with?

Record Create:

and Use:

  • Enter show ip nat statistics

What information did the router respond with?

Record Hits:

and Misses:

  • From Router-A ping 202.206.154.2 (which is a statically assigned global address for 10.10.10.2 in our internal network)

Were you successful?

Explain why you got that result?

Hint: Check Router A's routing table Since we are on a stub network and the internal IP addresses are hidden from the rest of the Internet/Network, we need to add a static route to that network. On router-A (Internet router) add a static route to network 202.206.154.0/24. Try to ping 202.206.154.2 from Router-A.

Were you successful this time?

Why did our stub router not share information about network 202.206.154.0 with the other routers?

What is NAT?

Why is NAT useful?

What would happen if we incorrectly marked the interfaces ( marked the fast Ethernet port as outside and the Serial as inside)?