Demonstrate the use of Network
Address Translation through the use of dynamic address translation.
Equipment Requirements:
Two routers One switch Two
workstations
Background:
A small company has been using the
private address 10.10.10.0/24 for their network. Until recently they
did not need access outside of their own network. Since they now
need Internet access they have been issued the class C address
202.206.154.0 by ARIN. Currently the company does not require the
full number of addresses in a Class C network; however, they will
require the addresses as the company grows. For a variety of reasons
including security reasons, the company wishes to hide the internal
network from the outside. Currently most of the users need to be
able to connect to the outside. These users need to have unlimited
access to the outside.
Preliminary: Before programming the
routers, make sure that the IOS version on the router supports
Network address translation. Load a new IOS version if necessary.
Construct the above network, using IGRP or RIP as your routing
protocol. Do not advertise the private network. Use the network
address 200.200.200.16/28 on the serial link from the stub network
router(Router-B) and the Internet/Network router(Router-A).
The router IP configurations are as
follows:
Router-A
Router-B
Fa 0/0=10.10.10.1
S0/0=200.200.200.17/28
S0/0=200.200.200.18/28
Note: actual interfaces used might
vary depending on what type of router used.
When construction of the network is
complete, verify that routers can communicate and are sharing their
routing tables for network 200.200.200.16/28. Also verify that the
workstations are configured correctly for the network in which they
reside. For verification use the show
ip route command, show
interfaces command, show
running-configuration
command, ping,
telnet,
and any other relevant command(s).
For this Lab we will be using
Router-B as the stub network router where we will configure the
network address translation. The router will be translating the
inside local addresses to inside global addresses, in other words,
converting the internal fake addresses into real addresses for use
on the Internet.
From the "Router-B"
console:
Step
1
Enter the EXEC mode.
Step
2
Enter the configuration mode by
entering configure
terminal command at the
router prompt.
Step
3
Define a pool of global addresses to
be allocated as needed.
Enter
ip nat pool net-10 202.206.154.2 202.206.154.17 netmask
255.255.255.0
Why is it important to include the
netmask information?
Step
4
Define a standard access list
permitting those addresses that are to be translated.
Enter
access-list 2 permit 10.10.10.0 0.0.0.255
Step
5
Establish dynamic source translation,
specifying the access list defined in the prior step.
Enter ip
nat inside source list 2 pool net-10
Step
6
Specify the inside interface.
Enter
interface fa 0/0 (or
correct inside interface for router used)
Step
7
Mark the interface as connected to
the inside.
Enter ip
nat inside
Why do we only want to permit those
addresses that are going to be translated?
Step
8
Specify the outside interface.
Enter
interface serial 0/0 (or
correct outside interface for router used)
Step
9
Mark the interface as connected to
the outside.
Enter ip
nat outside
Step
10
Save configuration information.
Enter CTRL-Z
Enter copy
run start
Step
11
Change default NAT timeout value (if
required) to 120 seconds From global configuration mode
Enter
ip nat translation timeout 120
The default timeout value is 24
hours, what is one reason we might want to reduce this amount that
the entry is held in memory?
Step
12
Monitoring NAT
Enter show
ip nat translations
What information did the router
respond with?
Enter
show ip nat statistics
What information did the router
respond with?
Don't forget to add a static route
to your global network on the outside router (Router-A)
From a workstation on the inside
network ping an address on the outside
From the router console
Enter show
ip nat translations
What information did the router
respond with?
Enter
show ip nat translations verbose
What additional information did the
router respond with?
Enter show
ip nat statistics
What information did the router
respond with?
Change the IP address on the
workstation on network 10.10.10.0 to 10.10.10.45, reboot the
computer. After the computer boots ping an address on the
outside.
Enter show
ip nat translations
What new piece of information did
the router respond with?
Could we use static translation and
dynamic translation at the same time on the same router?