NAT & PAT

Network Address Translation

Port Address Translation

Why use NAT?

Ability to use private addresses

internally and still access the Internet

RFC1918 addresses are not globally

unique

Ability to connect overlapping IP

address space
Not a security cure

NAT Characteristics

Converts internal private address to

configured public address that is
routable
Performed statically or dynamically
Creates state table on connection
Delete state table entry on disconnect
With use of ACLs to prevent routing,
can add to security profile, control
traffic

NAT Applications

Hardware and software firewalls

Routers
Proxy servers

RAS server that is a simple

router/firewall

NAT Configuration

NAT(config)#access-list 1 permit 192.168.1.0

0.0.0.255
NAT(config)#ip nat pool public-1 200.200.100.129
200.200.100.250 netmask 255.255.255.128
NAT(config)#ip nat inside source list 1 pool
public-1
NAT(config)#interface fa 0/0
NAT(config-if)#ip nat inside
NAT(config-if)#interface s 0/0
NAT(config-if)#ip nat outside

NAT

Show IP nat translations

Pro Inside global

Inside local
global
--- 200.200.100.129 192.168.1.5
--- 200.200.100.252 192.168.1.2

Show IP nat statistics

Outside local
-----

Outside
-----

PAT

Ip nat pool net-1 207.139.221.10 255.255.255.0

Access-list 1 permit ip 192.168.1.0 0.0.0.255
ip nat inside source list 1 pool net-1 overload
Int f0/0

Ip nat inside

Int s0/0

Ip nat outside

NAT#show ip nat translations

Pro
Tcp
tcp
tcp
tcp

Inside global
200.200.100.1:80
200.200.100.1:80
200.200.100.1:80
200.200.100.1:80

Inside local
192.168.1.5:80
192.168.1.5:80
192.168.1.5:80
192.168.1.5:80

Outside local
Outside global
200.200.50.2:4806 200.200.50.2:4806
200.200.50.2:4809 200.200.50.2:4809
200.200.50.2:4814 200.200.50.2:4814
-----

Your NAT configuration

X = the second digit of your loopback IP address

(config)#access-list 1 permit 1x.0.0.0 0.0.0.255
(config)#ip nat pool public-1 21x.200.100.129
21x.200.100.250 netmask 255.255.255.128
(config)#ip nat inside source list 1 pool public-1

(config)#interface fa 0/0
(config-if)#ip nat inside
(config-if)#interface s 0/0
(config-if)#ip nat outside

Testing NAT

Extended ping from your loopback to

a serial interface of your neighbor
When ping works

Show ip nat translations