Last updated Save as PDF 11 NAT Translation on the MX Security Appliance maps specific public IP address to an internal IP address. This is useful when internal servers need to be accessed by external clients using multiple public IP addresses. This article briefly describes example configurations, considerations, and best practices for 11 NAT translation. Note Though similar, 11 NAT is different from port forwarding. For more information, refer to our documentation on 11 NAT vs. Port forwarding. Basic Configuration A basic but insecure 11 NAT configuration can be set up to forward all traffic to the internal client. This should be configured when a 11 NAT needs to be made on a quick notice, but is not recommended due to security reasons. When all ports are forwarded to a client, attackers using a port scanner can target vulnerable services or gain access to the internal server. Figure 1. Example of insecure 11 NAT configuration Figure 2. Illustrating an insecure 11 NAT configuration Detailed Configuration A more advanced configuration should include multiple rules and utilize a secondary uplink to provide redundancy for the web server. If one of the uplinks goes down, the secondary uplink is still in place to provide remote connectivity to the internal server. 11 NAT rules should also be configured to restrict specific remote IP addresses access to specific services such as RDP. Figure 3. Example of a secure 11 NAT configuration Figure 4. Illustrating an example secure 11 NAT configuration Additional Considerations When a 11 NAT rule is configured for a given LAN IP, that device's outbound traffic will be mapped to the public IP configured in the 11 NAT rule, rather than the primary WAN IP of the MX. Exceptions may occur when the MX is running some content filtering features that involve its web proxy. In this circumstance, outbound web traffic initiated by the 11 NAT LAN device will use the primary uplink as normal. Hairpin Routing Traffic sourced from the LAN of the MX that is destined for the public IP configured in the 11 NAT section will be routed to the private IP address associated with the configured mapping. In this process the MX will accept the packet on the LAN and re-write the IPv4 header. The rewritten header will be sourced from the MX's IP/MAC, or layer 3 interface, in which the destination client resides while also being destined for the private IP/MAC of the client mapped to the 11 NAT. This practice does add complexities and may also be achieved with more ease via static DNS records where applicable. In some cases, 11 NAT translation will not work properly immediately after installing a new MX or when using Link aggregation. Special considerations should be taken when configuring 11 NAT rules with Uplink preferences and multiple public IP addresses.
You are here Home / Cisco Routers / Configuring NAT on Cisco Routers Step-by-Step PAT, Static NAT, Port Redirection The depletion of the public IPv4 address space has forced the internet community to think about alternative ways of addressing networked hosts. Network Address Translation NAT therefore was introduced to overcome these addressing problems that occurred with the rapid expansion of the Internet. Even if NAT was suggested as a temporary solution, it has been adopted by all network hardware manufacturers, and it is considered a very useful technology, not only for IP address conservation, but also for many other purposes including security. Basically NAT allows a single network device a router, firewall etc to act as an agent between a private local area network and a public network such as the Internet. The purpose of this NAT device is to translate the source IP addresses of the internal network hosts into public routable IP addresses in order to communicate with the Internet. Some of the advantages of using NAT in IP networks are the following NAT helps to mitigate the depletion of the global public IP address space Networks can now use the RFC 1918 private address space internally and still have a way to access the Internet using NAT. NAT increases security by hiding the internal network topology and addressing scheme. Cisco IOS routers support different types of NAT as will be explained below. NAT has many forms and can work in several ways, but in this post I will explain the most important types of NAT. For the next 2 scenarios we will be using the following simple network 1. Overloading or Port Address Translation PAT This is the most frequently used form of NAT in IP networks. It uses the concept of “many-to-one” translation where multiple connections from different internal hosts are “multiplexed” into a single registered public IP address using different source port numbers. This type of NAT allows a maximum of 65,536 internal connections to be translated into a single public IP. This type of NAT is very useful in situations where our ISP has assigned us only a single public IP address, as shown on the diagram below. All IP addresses of the LAN network will be translated using the public IP of the router interface FastEthernet0/0 ip address ip nat outside ! interface FastEthernet0/1 ip address ip nat inside ! access-list 1 permit ip nat inside source list 1 interface FastEthernet0/0 overload 2. Static Port Address Translation Port Redirection Assume now that we have only one public IP address which is the one configured on the outside interface of our border router. We want traffic hitting our router’s public IP on port 80 to be redirected to our internal Web Server at IP interface FastEthernet0/0 ip address ip nat outside ! interface FastEthernet0/1 ip address ip nat inside ! ip nat inside source static tcp 80 80 3. Configuring Static NAT NAT can be performed both statically and dynamically. Static NAT simply maps one private IP address to a single public IP address, and this is the flavor of NAT we are discussing in this section. A Cisco router performing NAT divides its universe into the inside and the outside. Typically the inside is a private enterprise, and the outside is the public Internet. In addition to the notion of inside and outside, a Cisco NAT router classifies addresses as either local or global. A local address is an address that is seen by devices on the inside, and a global address is an address that is seen by devices on the outside. Given these four terms, an address may be one of four types Inside local addresses are assigned to inside devices. These addresses are not advertised to the outside. Inside global are addresses by which inside devices are known to the outside. Outside local are addresses by which outside devices are known to the inside. Outside global addresses are assigned to outside devices. These addresses are not advertised to the inside. Let’s jump right into static NAT configuration on a Cisco router as shown in the Figure below R1 is the router performing Network Address Translation NAT and has two interfaces Fa0/0 on the inside and Fa0/1 on the outside. The specific IP addresses involved are NAT Address Type IP Address Inside local Inside global Outside local Outside global Table 1 NAT Addresses for Figure Above You probably know very well how to configure IP addresses on router interfaces, so we skip those configuration steps and move straight to the interesting stuff. First, we have to assign Fa0/0 as NAT inside interface and Fa0/1 as NAT outside interface on R1. This would tell the router that interesting traffic entering or exiting these two interfaces will be subject to address translation. R1conf term Enter configuration commands, one per line. End with CNTL/Z. R1configinterface Fa0/0 R1config-ifip nat inside R1config-ifinterface Fa0/1 R1config-ifip nat outside R1config-ifend Now we would tell the router how to perform address translation and mention which IP addresses source or destination to re-write in packets moving between the inside and outside interfaces. Here we go R1configip nat inside source static Here, we are telling the router to perform NAT on packets coming into the router on the inside interface Fa0/0. More specifically the router would identify which of these packets have a source IP address of and would change it to before forwarding the packet out the outside interface Fa0/1. Similarly, return packets coming in at outside interface Fa0/1 would undergo translation of destination IP address. Let’s now verify if NAT is actually working as it is supposed to work. There are a couple of very useful Cisco IOS commands that can be used to do just that. Command show ip nat statistics displays the number of static and dynamic NAT translations, inside and outside interfaces, and the number of hits and misses. R1show ip nat statistics Total active translations 1 1 static, 0 dynamic; 0 extended Outside interfaces FastEthernet0/1 Inside interfaces FastEthernet0/0 Hits 0 Misses 0 CEF Translated packets 0, CEF Punted packets 0 Expired translations 0 Dynamic mappings Appl doors 0 Normal doors 0 Queued Packets 0 Command show ip nat translations displays the IP addresses for NAT translations. R1show ip nat translations Pro Inside global Inside local Outside local Outside global — — — As you see in the above output, we have one NAT entry configured with Inside global address and Inside local address specified. Outside local and Outside global addresses are blank because our NAT configuration does not change those addresses. Let’s now go to the PC and ping the Server before running the command show ip nat translations again to see if it makes any difference. R1show ip nat statistics Total active translations 2 1 static, 1 dynamic; 1 extended Outside interfaces FastEthernet0/1 Inside interfaces FastEthernet0/0 Hits 10 Misses 0 CEF Translated packets 10, CEF Punted packets 0 Expired translations 0 Dynamic mappings Appl doors 0 Normal doors 0 Queued Packets 0 R1show ip nat translations Pro Inside global Inside local Outside local Outside global icmp — — — As you can see in the above output, NAT is active as manifested by the appearance of an additional dynamic entry for ICMP protocol and some additional hits, corresponding to our ping attempt from PC to Server. We just configured and verified a simple NAT scenario translating only the source or destination not both at the same time IP addresses of packets moving between inside and outside interfaces. This sort of NAT configuration is called static NAT as a single inside local IP address is statically mapped to a single outside local IP address. Another important feature of NAT is static Port Address Translation PAT. Static PAT is designed to allow one-to-one mapping between local and global addresses. A common use of static PAT is to allow Internet users from the public network to access a Web server located in the private network. Let’s assume we intend to host a Web server on the inside on the same PC, that has an IP address The following configuration line would allow us to do just that R1configip nat inside source static tcp 80 80 This configuration line performs the static address translation for the Web server. With this configuration line, users that try to reach port 80 www are automatically redirected to port 80 www. In our case, is the IP address of the PC which is also the Web server. This configuration can be verified using the same two NAT verification commands show ip nat translations and show ip nat statistics. Notice that the address with port number 80 HTTP translates to port 80, and vice versa. Therefore, Internet users can browse the Web server even though the Web server is on a private network with a private IP address. Related Posts Comparison of Static vs Dynamic Routing in TCP/IP Networks Cisco OSPF DR-BDR Election in Broadcast Networks – Configuration Example How to Configure Port Forwarding on Cisco Router With Examples Adjusting MSS and MTU on Cisco 800 routers for PPPoE over DSL The Most Important Cisco Show Commands You Must Know Cheat Sheet
Tomap it with IP address we will use following command. Router (config)#ip nat inside source static 10.0.0.10 50.0.0.10. In second step we have to define which interface is connected with local the network. On both routers interface Fa0/0 is connected with the local network which need IP translation.
Network Address Translation or NAT is a mechanism of mapping local address on the inside interface of a router with global address on the outside interface. For outgoing packets, router will translate the source local address to a global address. Reversely, router will forward incoming packets for a global address to its local address. This is usually the scenario to enable hosts on LAN to communicate with the internet. In Cisco device, there are several methods to configure NAT. One of the methods will be explained in this article is to configure static NAT in Cisco IOS router. Static NAT is a manual mapping of local and global address as defined by the network administrator. The way to configure static NAT in Cisco IOS router consists of two steps that will be explained using example scenario with given topology as below 1. Define the inside and outside interface Defining the inside and outside interface correctly is the key to make NAT mapping works. Simply go to the interface configuration mode and then use command ip nat inside to make the interface as an inside interface. In a similar way, use command ip nat outside to make the interface as an outside interface. For the above scenario, the way to make f0/0 on R1 as the inside interface and f0/1 as the outside interface is shown below assuming the IP address for each interface and default route to internet has been configured before R1configinterface f0/0 R1config-ifip nat inside R1config-ifexit R1configinterface f0/1 R1config-ifip nat outside R1config-ifexit 2. Configure the static NAT mapping The command to configure static NAT mapping is ip nat inside source static [local address] [global address]. The command can be repeated many times as required but note that in Cisco IOS router one local address can only be mapped to one global address and vice-versa. Additionally, note that the global address must be in range of the subnet on the outside interface. In real practice, the global address usually provided by the internet service provider. For the above scenario, the command to map Server1 IP address to one of the available global IP address R1configip nat inside source static Verifying the NAT sessions To see if static NAT works as expected, try to do a ping from Server1 to address on the internet. Before static NAT is applied, ping from Server1 to will not work because R1 will forward the packet with source address of and it is not known on the internet in this case. Server> ping icmp_seq=1 timeout After NAT is applied, the source address of is masked by and it is an address that is known on the internet in this case. Therefore, ping from Server1 is success. Server> ping 84 bytes from icmp_seq=1 ttl=252 time= ms Use command show ip nat translations on the router to see the NAT session. See this example output for the above scenario R1sh ip nat trans Pro Inside global Inside local Outside local Outside global icmp - - - The output above shows the active sessions between local address and global address on the inside and outside interface complete with the protocol and port information. The inside global and outside global shows the IP address and ports as result of translation while the inside local and outside local shows the address and ports before the translation. From the output above we can see that static NAT mapping between local address of and global address on the inside interface has working successfully. One cool thing about static NAT is that it also works for incoming packets. To confirm this, do ping from the internet to Server1 global address. Internet>ping 84 bytes from icmp_seq=1 ttl=252 time= ms On R1, run command show ip nat translations again to see the session R1sh ip nat trans Pro Inside global Inside local Outside local Outside global icmp - - - And that’s how you configure static NAT in Cisco IOS Router. The following two tabs change content Posts I am IT practitioner in real life with specialization in network and server infrastructure. I have years of experience in design, analysis, operation, and optimization of infrastructure solutions for enterprise-scaled network. You can send me a message on LinkedIn or email to for further inquiry regarding stuffs that I wrote or opportunity to collaborate in a project.
Étapespour configurer le NAT dynamique à l'aide de CLI. Connectez-vous à l'appareil à l'aide de SSH / TELNET et passez en mode activation. Passez en mode config. Router# configure
Sep 25, 2018 Last Updated Sep 25, 2018 CCNA 200-125 Which technology allows a large number of private IP addresses to be represented by a smaller number of public IP addresses?A. NAT*B. NTPC. RFC 1631D. RFC 1918What is the effect of the overload keyword in a static NAT translation configuration?A. It enables port address translation.*B. It enables the use of a secondary pool of IP addresses when the first pool is It enables the inside interface to receive It enables the outside interface to forward Hide Explanation/ReferenceBy adding the keyword “overload” at the end of a NAT statement, NAT becomes PAT Port Address Translation. This is also a kind of dynamic NAT that maps multiple private IP addresses to a single public IP address many-to-one by using different ports. Static NAT and Dynamic NAT both require a one-to-one mapping from the inside local to the inside global address. By using PAT, you can have thousands of users connect to the Internet using only one real global IP address. PAT is the technology that helps us not run out of public IP address on the Internet. This is the most popular type of two types of NAT addresses are used in a Cisco NAT device? Choose twoA. inside local*B. inside global*C. inside privateD. outside privateE. external globalF. external localShow Hide Explanation/ReferenceNAT use four types of addresses* Inside local address – The IP address assigned to a host on the inside network. The address is usually not an IP address assigned by the Internet Network Information Center InterNIC or service provider. This address is likely to be an RFC 1918 private address.* Inside global address – A legitimate IP address assigned by the InterNIC or service provider that represents one or more inside local IP addresses to the outside world.* Outside local address – The IP address of an outside host as it is known to the hosts on the inside network.* Outside global address – The IP address assigned to a host on the outside network. The owner of the host assigns this is the danger of the “permit any” entry in a NAT access list?A. It can lead to overloaded resources on the router.*B. It can cause too many addresses to be assigned to the same It can disable the overload It prevents the correct translation of IP addresses on the inside type of address is the public IP address of a NAT device?A. outside globalB. outside localC. inside global*D. inside localE. outside publicF. inside publicShow Hide Explanation/ReferenceNAT use four types of addresses* Inside local address – The IP address assigned to a host on the inside network. The address is usually not an IP address assigned by the Internet Network Information Center InterNIC or service provider. This address is likely to be an RFC 1918 private address.* Inside global address – A legitimate IP address assigned by the InterNIC or service provider that represents one or more inside local IP addresses to the outside world.* Outside local address – The IP address of an outside host as it is known to the hosts on the inside network.* Outside global address – The IP address assigned to a host on the outside network. The owner of the host assigns this command can you enter to display the hits counter for NAT traffic?A. show ip nat statistics*B. debug ip natC. show ip debug natD. clear ip nat statisticsShow Hide Explanation/ReferenceAn example of the output of the “show ip nat statistics” is shown below. As we can see, the “Hits” counter is NAT function can map multiple inside addresses to a single outside address?A. PAT*B. SFTPC. RARPD. ARPE. TFTPShow Hide Explanation/ReferenceBy adding the keyword “overload” at the end of a NAT statement, NAT becomes PAT Port Address Translation. This is also a kind of dynamic NAT that maps multiple private IP addresses to a single public IP address many-to-one by using different is the first step in the NAT configuration process?A. Define inside and outside interfaces.*B. Define public and private IP Define IP address Define global and local Hide Explanation/ReferenceIn NAT configuration we should specify the inside and outside interfaces first with the command “ip nat inside” and “ip nat outside” under interface which circumstance should a network administrator implement one-way NAT?A. when the network must route UDP trafficB. when traffic that originates outside the network must be routed to internal hosts *C. when traffic that originates inside the network must be routed to internal hostsD. when the network has few public IP addresses and many private IP addresses require outside accessWhich statement about the inside interface configuration in a NAT deployment is true?A. It is defined globallyB. It identifies the location of source addresses for outgoing packets to be translated using access or route maps.*C. It must be configured if static NAT is usedD. It identifies the public IP address that traffic will use to reach the Hide Explanation/ReferenceWhen we specify a NAT “inside” interface via the “ip nat inside” command under interface mode, we are specifying the source IP addresses. Later in the “ip nat” command under global configuration mode, we will specify the access or route map for these source example the commandRouterconfig ip nat inside source list 1 pool PoolforNATafter the keyword “source” we need to specify one of the three keywords+ list specify access list describing local addresses but this command does not require an “inside” interface to be configured+ route-map specify route-map+ static specify static local -> global mappingWhich NAT type is used to translate a single inside address to a single outside address?A. dynamic NATB. NAT overloadC. PATD. static NAT*Show Hide Explanation/ReferenceThere are two types of NAT translation dynamic and NAT Designed to allow one-to-one mapping between local and global addresses. This flavor requires you to have one real Internet IP address for every host on your networkDynamic NAT Designed to map an unregistered IP address to a registered IP address from a pool of registered IP addresses. You don’t have to statically configure your router to map an inside to an outside address as in static NAT, but you do have to have enough real IP addresses for everyone who wants to send packets through the Internet. With dynamic NAT, you can configure the NAT router with more IP addresses in the inside local address list than in the inside global address pool. When being defined in the inside global address pool, the router allocates registered public IP addresses from the pool until all are allocated. If all the public IP addresses are already allocated, the router discards the packet that requires a public IP this question we only want to translate a single inside address to a single outside address so static NAT should be are two benefits of using NAT? choose twoA. NAT protects network security because private networks are not advertised.*B. NAT accelerates the routing process because no modifications are made on the Dynamic NAT facilitates connections from the outside of the NAT facilitates end-to-end communication when IPsec is NAT eliminates the need to re-address all host that require external access.*F. NAT conserves addresses through host MAC-level Hide Explanation/ReferenceBy not reveal the internal IP addresses, NAT adds some security to the inside network -> A is has to modify the source IP addresses in the packets -> B is not from the outside to a network through “NAT” is more difficult than a normal network because IP addresses of inside hosts are hidden -> C is not order for IPsec to work with NAT we need to allow additional protocols, including Internet Key Exchange IKE, Encapsulating Security Payload ESP and Authentication Header AH -> more complex -> D is not allocating specific public IP addresses to inside hosts, NAT eliminates the need to re-address the inside hosts -> E is does conserve addresses but not through host MAC-level multiplexing. It conserves addresses by allowing many private IP addresses to use the same public IP address to go to the Internet -> F is not command can you enter to create a NAT pool of 6 addresses?A. Routerconfigip nat pool test prefix-length 24*B. Routerconfigip nat pool test prefix-length 16C. Routerconfigip nat pool test prefix-length 8D. Routerconfigip nat pool test prefix-length 8Show Hide Explanation/ReferenceThe syntax to create a NAT pool isRouterconfigip nat pool pool_name start_ip end_ip { netmask netmask prefix-length prefix-length }Therefore answer A is surely correct. Answer B is not correct as it creates many addresses from to then to C and D are not correct as we cannot use prefix-length of 8 /8 for a class B does NAT overloading provide one-to-many address translation?A. It uses a pool of addressesB. It converts IPV4 addresses to unused IPv6 AddressesC. It assigns a unique TCP/UDP port to each session*D. It uses virtual MAC Address and Virtual IP AddressesShow Hide Explanation/ReferenceBy adding the keyword “overload” at the end of a NAT statement, NAT becomes PAT Port Address Translation. This is also a kind of dynamic NAT that maps multiple private IP addresses to a single public IP address many-to-one by using different is the danger of the permit any entry in a NAT access list?A. It can lead to overloaded resources on the router.*B. It can cause too many addresses to be assigned to the same It can disable the overload It prevents the correct translation of IP addresses on the inside Hide Explanation/ReferenceUsing permit any can result in NAT consuming too many router resources, which can cause network problems. You should only limit the NAT access list to a specific range of IP configuration can be used with PAT to allow multiple inside address to be translated to a single outside address?A. Dynamic RoutingB. DNSC. PreemptD. Overload*
Configuring dynamic NAT in Cisco devices This article will help you through the steps to configure dynamic NAT on Cisco devices. You will be able to create the corresponding Configlet commands using Network Configuration Manager application. This will help you perform the same operation on multiple devices simultaneously. With dynamic NAT, you specify two sets of addresses on your Cisco router Inside addresses that will be translated. A pool of global addresses. Unlike with static NAT, where you had to manually define a static mapping between a private and a public address, with dynamic NAT the mapping of a local address to a global address happens dynamically. This means that the router dynamically picks an address from the global address pool that is not currently assigned. It can be any address from the pool of global addresses. The dynamic entry stays in the NAT translations table as long as the traffic is exchanged. The entry times out after a period of inactivity and the global IP address can be used for new translations. If you don't have NCM installed, please click here to download and install the application. To configure dynamic NAT, the following steps are required Configure the router’s inside interface using the ip nat inside command Configure the router’s outside interface using the ip nat outside command Configure an ACL that has a list of the inside source addresses that will be translated Configure the pool of global IP addresses using the ip nat pool NAME FIRST_IP_ADDRESS LAST_IP_ADDRESS netmask SUBNET_MASK command Enable dynamic NAT with the ip nat inside source list ACL_NUMBER pool NAME global configuration command Steps to configure dynamic NAT using CLI. Login to the device using SSH / TELNET and go to enable mode. Go into the config mode. Routerconfigure terminal Enter configuration commands, one per line. End with CNTL/Z. Routerconfig Configure the router's inside interface Routerconfiginterface fa0/0 Routerconfig-ifip nat inside Routerconfig-ifexit Configure the router's outside interface Routerconfiginterface eth0/0/0 Routerconfig-ifip nat outside Routerconfig-ifexit Configure an ACL that has a list of the inside source addresses that will be translated. Routerconfigaccess-list 1 permit NOTEThe access list configured above matches all hosts from the subnet. Configure the pool of global IP addresses Routerconfigip nat pool MY_POOL netmask NOTE The pool configured above consists of 5 addresses and Enable dynamic NAT Routerconfigip nat inside source list 1 pool MY_POOL NOTE The command above instructs the router to translate all addresses specified in the access list 1 to the pool of global addresses called MY_POOL. Exit config mode Routerconfigexit Router Execute show ip nat translations command to view the NAT configuration. Copy the running configuration into startup configuration using below command Routerwrite memory Building configuration... [OK] Router The corresponding configlet can be created in NCM application as shown in below screenshot. Also you can click the below button to download the Configlet as XML and import it into NCM application using file import option. Configlet Name Configure Dynamic NAT - Cisco Description This configlet is used to configure dynamic NAT on cisco devices Execution Mode Script Execution Mode Configlet Content configure terminal interface $INSIDE_INTF ip nat inside exit interface $OUTSIDE_INTF ip nat outside exit access-list $ACL_ID permit $SOURCE_ADDRESS $SUBNET_MASK ip nat pool $POOL_NAME $POOL_START_ADDRESS $POOL_END_ADDRESS netmask $NETMASK ip nat inside source list $ACL_ID pool $POOL_NAME exit show ip nat translations write memory
zxQKo.
