NAT Static

I wont talk about what NATing does in this article. However, I will show you some basic configuration of NAT to clarify everyone understanding.


Configuration example

Configuration

R2

interface FastEthernet0/0

 ip address 192.168.1.2 255.255.255.0

 ip nat inside

 ip virtual-reassembly

 duplex auto

 speed auto

!

interface FastEthernet0/1

 ip address 192.168.2.1 255.255.255.0

 ip nat outside

 ip virtual-reassembly

 duplex auto

 speed auto

!

router ospf 1

 log-adjacency-changes

 network 192.168.1.2 0.0.0.0 area 0

 network 192.168.2.1 0.0.0.0 area 0

!

ip http server

no ip http secure-server

!

ip route 2.2.2.0 255.255.255.0 192.168.2.2

// from inside to outside : route before translate

!

ip nat inside source static 1.1.1.1 172.16.1.1

ip nat outside source static 3.3.3.3 2.2.2.2

!

Providing route for R1 and R3 to pass the traffic through R2 to translate

R1

ip route 2.2.2.2 255.255.255.255 192.168.1.2

R2

ip route 172.16.1.0 255.255.255.0 192.168.2.1

Verify Configuration

R1#ping 2.2.2.2 source 1.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:

Packet sent with a source address of 1.1.1.1

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 12/66/176 ms

R1#

R3#ping 172.16.1.1 source 3.3.3.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:

Packet sent with a source address of 3.3.3.3

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 24/71/144 ms

R3#

R2#show ip nat translations

Pro Inside global      Inside local       Outside local      Outside global

--- ---                ---                2.2.2.2            3.3.3.3

icmp 172.16.1.1:2      1.1.1.1:2          2.2.2.2:2          3.3.3.3:2

icmp 172.16.1.1:8      1.1.1.1:8          2.2.2.2:8          3.3.3.3:8

--- 172.16.1.1         1.1.1.1            ---                ---

R2#

R2 debug ip nat

Mar  1 00:32:18.007: NAT*: s=3.3.3.3->2.2.2.2, d=172.16.1.1 [41]

*Mar  1 00:32:18.007: NAT*: s=2.2.2.2, d=172.16.1.1->1.1.1.1 [41]

*Mar  1 00:32:18.035: NAT*: s=1.1.1.1->172.16.1.1, d=2.2.2.2 [42]

*Mar  1 00:32:18.035: NAT*: s=172.16.1.1, d=2.2.2.2->3.3.3.3 [42]

*Mar  1 00:32:18.051: NAT*: s=3.3.3.3->2.2.2.2, d=172.16.1.1 [42]

*Mar  1 00:32:18.051: NAT*: s=2.2.2.2, d=172.16.1.1->1.1.1.1 [42]

*Mar  1 00:32:18.063: NAT*: s=1.1.1.1->172.16.1.1, d=2.2.2.2 [43]

*Mar  1 00:32:18.063: NAT*: s=172.16.1.1, d=2.2.2.2->3.3.3.3 [43]

Nat Extendable option

From http://www.cisco.com/en/US/technologies/tk648/tk361/tk438/technologies_white_paper09186a0080091cb9.html


The extendable keyword allows the user to configure several ambiguous static translations, where an ambiguous translations are translations with the same local or global address.


ip nat inside source static <localaddr> <globaladdr> extendable


Example

Telnet and SSH traffic will be redirected to 192.10.112 port 22 and 23 respectively.

192.10.1.0/24  = inside

204.12.1.0/24  = outside

54.1.8.0/24     =  outside

Because we have more than 1 outside interface, it might have some ambiguous translation. Therefore, we need option "extendable" in the NAT commands.

ip nat inside source static tcp 192.10.1.112 22 54.1.8.6 22 extendable 

ip nat inside source static tcp 192.10.1.112 23 54.1.8.6 23 extendable 

ip nat inside source static tcp 192.10.1.112 22 204.12.1.6 22  extendable 

ip nat inside source static tcp 192.10.1.112 23 204.12.1.6 23 extendable 

NAT Load Balancing

NAT can be used for load balancing purpose as well. We do a translation from the destination IP address of the outside packet to multiple inside IP addresses which are load-balance. 

The command which serves this purpose is below

ip nat inside destination list <access-list of global IP address> pool <pool of internal IP address range>

ip nat pool <name> <IP address start> <IP address stop> type rotary

Configuration Example

Task:

• R3 is in nat outside network trying to connect to servers inside. 
• R3 uses 172.16.1.10 to connect to the servers.
• R2 and R4, in this example, are served as servers inside the nat network
• R2 and R4 are required to load balancing with each other
• Configure only on R1.

Configuration

R1
!
interface FastEthernet0/0
 ip address 172.16.1.1 255.255.255.0
 ip nat outside
!
interface FastEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
ip nat pool net-192 192.168.1.2 192.168.1.3 prefix-length 24 type rotary
ip nat inside destination list 1 pool net-192
!
access-list 1 permit 172.16.1.10
!

Verify Configuration

R1#sh ip nat translations

Pro Inside global      Inside local       Outside local      Outside global

tcp 172.16.1.10:23     192.168.1.2:23     172.16.1.2:43480   172.16.1.2:43480

tcp 172.16.1.10:23     192.168.1.3:23     172.16.1.2:48533   172.16.1.2:48533

We see from the translation table that 172.16.1.10 was translated in to 2 ip addresses which are 192.168.1.2 and 192.168.1.3. Now we will test the configuration by trying to telnet to 172.16.1.10 from R3. The correct result will be R3 telnet to R2 and then telnet to R4 when create another session.

R3#
R3#telnet 172.16.1.10
Trying 172.16.1.10 ... Open


User Access Verification

Password:
R2>exit

[Connection to 172.16.1.10 closed by foreign host]
R3#
R3#
R3#telnet 172.16.1.10
Trying 172.16.1.10 ... Open

User Access Verification

Password:
R4>