11.3 Configuring NAT
11.3.2 Dynamic NAT configuration

At a minimum, IP routing and appropriate IP addresses must be configured on the router. To enable dynamic local IP address translation, perform the following steps:

  1. Define a standard IP access-list for the inside network by using the access-list access-list-number {permit | deny} local-ip-address command.

  2. Define an IP NAT pool for the inside network by using the ip nat pool pool-name start-ip end-ip {netmask netmask | prefix-length prefix-length} [type rotary] command, which is explained in Table .

  3. Map the access-list to the IP NAT pool by using the 
    ip nat inside source list access-list-number pool name command.

  4. Enable NAT on at least one inside and one outside interface with the ip nat {inside | outside} command.

Only packets moving between inside and outside interfaces are translated. For example, if a packet is received on an inside interface but is not destined for an outside interface, it will not be translated.

Example shows a sample dynamic NAT configuration.

Lab Activity    
  Our small company has recently been assigned the network number 206.222.222.0 by ARIN. Previously the company was using a private IP address on the internal network. Now that the company is going to be connected to the Internet, we need to either go to each and every workstation and configure it with a new IP address, or to use some kind of IP address translation at the router. For security reasons our company does not want the computers to be directly on the Internet, using real IP addresses. Since our company has a large number of computers it would be too time consuming to enter all of the static address translations into the router. Our alternative is dynamic network address translation. It is our job to configure the ISDN connection and implement the address translation.