Lab 2.6.2 Network Address Translation -- Configuring Dynamic Translation

Objective:

Demonstrate the use of Network Address Translation through the use of dynamic address translation.

Equipment Requirements:

Two routers One switch Two workstations

Background:

A small company has been using the private address 10.10.10.0/24 for their network. Until recently they did not need access outside of their own network. Since they now need Internet access they have been issued the class C address 202.206.154.0 by ARIN. Currently the company does not require the full number of addresses in a Class C network; however, they will require the addresses as the company grows. For a variety of reasons including security reasons, the company wishes to hide the internal network from the outside. Currently most of the users need to be able to connect to the outside. These users need to have unlimited access to the outside.

Preliminary: Before programming the routers, make sure that the IOS version on the router supports Network address translation. Load a new IOS version if necessary. Construct the above network, using IGRP or RIP as your routing protocol. Do not advertise the private network. Use the network address 200.200.200.16/28 on the serial link from the stub network router(Router-B) and the Internet/Network router(Router-A).

The router IP configurations are as follows: 

Router-A Router-B
  Fa 0/0=10.10.10.1
S0/0=200.200.200.17/28 S0/0=200.200.200.18/28

Note: actual interfaces used might vary depending on what type of router used.

When construction of the network is complete, verify that routers can communicate and are sharing their routing tables for network 200.200.200.16/28. Also verify that the workstations are configured correctly for the network in which they reside. For verification use the show ip route command, show interfaces command, show running-configuration command, ping, telnet, and any other relevant command(s).

For this Lab we will be using Router-B as the stub network router where we will configure the network address translation. The router will be translating the inside local addresses to inside global addresses, in other words, converting the internal fake addresses into real addresses for use on the Internet.

From the "Router-B" console:

Step 1

  • Enter the EXEC mode.

Step 2

  • Enter the configuration mode by entering configure terminal command at the router prompt.

Step 3

Define a pool of global addresses to be allocated as needed.

  • Enter ip nat pool net-10 202.206.154.2 202.206.154.17 netmask 255.255.255.0

Why is it important to include the netmask information?

Step 4

Define a standard access list permitting those addresses that are to be translated.

  • Enter access-list 2 permit 10.10.10.0 0.0.0.255

Step 5

Establish dynamic source translation, specifying the access list defined in the prior step.

  • Enter ip nat inside source list 2 pool net-10

Step 6

Specify the inside interface.

  • Enter interface fa 0/0 (or correct inside interface for router used)

Step 7

Mark the interface as connected to the inside.

  • Enter ip nat inside

Why do we only want to permit those addresses that are going to be translated?

Step 8

Specify the outside interface.

  • Enter interface serial 0/0 (or correct outside interface for router used)

Step 9

Mark the interface as connected to the outside.

  • Enter ip nat outside

Step 10

Save configuration information.

  • Enter CTRL-Z
  • Enter copy run start

Step 11

Change default NAT timeout value (if required) to 120 seconds From global configuration mode

  • Enter ip nat translation timeout 120

The default timeout value is 24 hours, what is one reason we might want to reduce this amount that the entry is held in memory?

Step 12

Monitoring NAT

  • Enter show ip nat translations

What information did the router respond with?

  • Enter show ip nat statistics

What information did the router respond with?

Don't forget to add a static route to your global network on the outside router (Router-A)

From a workstation on the inside network ping an address on the outside

From the router console

  • Enter show ip nat translations

What information did the router respond with?

  • Enter show ip nat translations verbose

What additional information did the router respond with?

  • Enter show ip nat statistics

What information did the router respond with?

  • Change the IP address on the workstation on network 10.10.10.0 to 10.10.10.45, reboot the computer. After the computer boots ping an address on the outside.

  • Enter show ip nat translations

What new piece of information did the router respond with?

Could we use static translation and dynamic translation at the same time on the same router?

Can Cisco IOS NAT be applied to subinterfaces?