Lab 11.3.2: Configuring Static NAT with ISDN

Objectives:

  • To configure an ISDN connection between our Office router and the ISP's router, and configure dynamic Network Address Translation on the Office router.

Scenario:

Our small company has recently been assigned the network number 206.222.222.0 by ARIN. Previously the company was using a private IP address on the internal network. Now that the company is going to be connected to the Internet, we need to either go to each and every workstation and configure it with a new IP address, or to use some kind of IP address translation at the router. For security reasons our company does not want the computers to be directly on the Internet, using real IP addresses. Since our company has a large number of computers it would be too time consuming to enter all of the static address translations into the router. Our alternative is dynamic network address translation. It is our job to configure the ISDN connection and implement the address translation.

Notes: 

Lab Tasks:

  1. Cable the lab as shown in the diagram.
  2. Check to make sure that the correct Cisco IOS is loaded on the Office router. It should support network address translation. Preferably IOS version 12.0.5T or later.
  3. The next task is to set up the routers and ISDN connection as in previous labs:
    • Configure IGRP routing with the AS# 123. Ensure that no routing updates will be sent out of interface BRI 0.
    • Configure the enable secret password to be cisco.
    • Configure the correct IP addresses on each of the routers.
    • Configure the correct ISDN switch type. (National ISDN-1)
    • Configure the correct usernames and passwords of the router to be dialed.
    • Configure the dialer list to permit IP traffic.
    • Set up the correct static or default routes.
    • Set up the correct SPIDs on each of the routers.
    • Make sure that the encapsulation type is PPP.
    • For security reasons, our Internet service provider has requested that we configure the authentication type to CHAP.
    • Configure the correct timeout values, and dialer map addresses.

    Don't forget the no shutdown command on the interfaces.

  4. Before configuring network address translation on the Office router, test your configurations by pinging the other router. This way you are insuring that your basic configuration is correct before changing it.
  5. The first step in configuring dynamic network address translation is to define a pool of inside global addresses (real IP addresses) to be allocated as needed. Enter the global configuration prompt on the Office router and enter the following commands:

    Office(config)#ip nat pool net-10 206.222.222.1 206.222.222.254 netmask
    255.255.255.0

    Why is it important to include the netmask information?

  6. Now we need to define a standard access list permitting those addresses that are to be translated from the inside network.

    Office(config)#access-list 2 permit 10.30.30.0 0.0.0.255
  7. Next we need to enter a command which will dynamically link our pool of real addresses with our list of inside addresses for translation.

    Office(config)#ip nat inside source list 2 pool net-10

    What does "pool net-10" mean in the preceding command?

  8. The final part of the configuration is to tell the router which interface is the inside interface and which is the outside interface. The inside interface is the one that connects to our internal network and the outside interface is the one that typically connects to the Internet.

    Office(config)#interface bri 0
    Office(config-if)#ip nat outside

    Office(config)#interface ethernet 0
    Office(config-if)#ip nat inside

  9. Finally it is time to verify that NAT is operating correctly on our Office router.

    Office#show ip nat translations

    What information did the router respond with?

    Office#show ip nat statistics

    What information did the router respond with?

  10. Now for testing NAT. Don't forget to add a static route back to your global network on the ISP router. From a workstation on the inside network, ping an address on the outside (workstation on the network off of the ISP router).

    Office#show ip nat translations

    What information did the router respond with?

    Office#show ip nat translations verbose

    What information did the router respond with?

    Office#show ip nat statistics

    What information did the router respond with?

  11. Now change the IP address on the workstation on network 10.30.30.0 to 10.30.30.30, and reboot the computer. After the computer reboots ping an address on the outside.

Office#show ip nat translations

What new piece of information did the router respond with?

Could we use static translation and dynamic translation at the same time on the same router?

Can Cisco IOS NAT be applied to subinterfaces?