Demonstrate the use of Network
Address Translation through the use of static translation.
Equipment Requirements:
Two routers One switch Two
workstations
Background:
A small company has been using the
private address 10.10.10.0/24 for their network. Until recently they
did not need access outside of their own network. Since they now
need Internet access they have been issued the class C address
202.206.154.0 by ARIN. Currently the company does not require the
full number of addresses in a Class C network; however, they will
require the addresses as the company grows. For a variety of reasons
including security reasons, the company wishes to hide the internal
network from the outside. Presently only a few users need to be able
to connect to the outside. These users need to have unlimited access
to the outside.
Preliminary:
Before programming the routers, make
sure that the IOS version on the router supports Network address
translation. Load a new IOS version if necessary. Construct the
above network section, using IGRP or RIP as your routing protocol.
Do not advertise the private network. Use the network address
200.200.200.16/28 on the serial link from the stub network router
(Router-B) and the Internet/main network router (Router-A).
The router ip configurations are as follows:
Note: The interfaces described below
might vary according to what type of router being used.
Router-A
Router-B
Fa
0/0=10.10.10.1/24
S0/0=200.200.200.17/28
S0/0=200.200.200.18/28
When construction of the network is
complete, verify that routers can communicate and are sharing their
routing tables for network 200.200.200.16/28. Also verify that the
workstations are configured correctly for the network in which they
reside. For verification use the show
ip route command, show
interfaces command, show
running-configuration
command, ping,
telnet,
and any other relevant command(s).
For this Lab we will be using
Router-B as the stub network router where we will configure the
network address translation. The router will be translating the
inside local addresses to inside global addresses, in other words,
converting the internal fake addresses into real addresses for use
on the Internet.
From the "Router-B"
console:
Step
1
Enter the EXEC mode.
Step
2
Enter the configuration mode by
entering configure
terminal command at the
router prompt.
Step
3
Establish static translation between
an inside local address and an inside global address.
Enter ip
nat inside source static 10.10.10.2 202.206.154.2
Enter ip
nat inside source static 10.10.10.3 202.206.154.3
If we needed a static translation
for workstation 10.10.10.4, how would we enter the configuration
information into the router?
Step
4
Specify the inside interface.
Enter interface
fa 0/0 (or correct inside
interface for router used)
Step
5
Mark the interface as connected to
the inside.
Enter
ip nat inside
Step
6
Specify the outside interface.
Enter interface
serial 0/0 (or correct
outside interface for router used)
Step
7
Mark the interface as connected to
the outside.
Enter ip
nat outside
Step
8
Save configuration information.
Enter
CTRL-Z
Enter copy
run start
Step
9
Monitoring NAT
Enter show
ip nat translations
What information did the router
respond with?
Enter show
ip nat statistics
What information did the router
respond with?
Record Hits:
and Misses:
Enter show
ip nat translations verbose
What information did the router
respond with?
Record Create:
and Use:
From a workstation on the inside
network ping an address on the outside
Were you successful?
From the router console:
Enter show
ip nat translations verbose
What additional information did the
router respond with?
Record Create:
and Use:
Enter show
ip nat statistics
What information did the router
respond with?
Record Hits:
and Misses:
From Router-A ping 202.206.154.2
(which is a statically assigned global address for 10.10.10.2 in
our internal network)
Were you successful?
Explain why you got that result?
Hint: Check Router A's routing
table Since we are on a stub network and the internal IP addresses
are hidden from the rest of the Internet/Network, we need to add a
static route to that network. On router-A (Internet router) add a
static route to network 202.206.154.0/24. Try to ping
202.206.154.2 from Router-A.
Were you successful this time?
Why did our stub router not share
information about network 202.206.154.0 with the other routers?
What is NAT?
Why is NAT useful?
What would happen if we incorrectly
marked the interfaces ( marked the fast Ethernet port as outside
and the Serial as inside)?