Chapter 9: Configuring Network Address Translation (NAT)

How do devices on private networks access the internet? Network address translation (NAT) is what connects the magic between the private and public networks. In this chapter, you will learn about the various types of NAT and how to implement static NAT, dynamic NAT, and port address translation (PAT) on a Cisco network. You will also learn how to implement NAT to ensure that you have internet connectivity on an enterprise network.

In this chapter, we will cover the following topics:

• The challenge of using IPv4 on the internet
• Understanding NAT
• Types of NAT
• Configuring PAT
• Configuring static NAT with port forwarding
• Implementing dynamic NAT

Technical requirements

To follow along with the exercises in this chapter, please ensure that you have met the following hardware and software requirement:

• Cisco Packet Tracer: https://www.netacad.com

The code files for this chapter are available at https://github.com/PacktPublishing/Implementing-and-Administering-Cisco-Solutions/tree/master/Chapter%2009.

Check out the following video to see the Code in Action: https://bit.ly/3clR4Qr

The challenge of using IPv4 on the internet

One of the many issues we face is that there aren't enough public IPv4 addresses to assign to each unique device on the internet. As you learned in Chapter 3, IP Addressing and Subnetting, each device that is directly connected to the internet must be assigned a unique IP address. Furthermore, there are 232 public IPv4 addresses, which means that there are approximately 4,294,967,296 public IPv4 addresses that are routable on the internet. This number seems huge, but the reality is that most internet-connected devices have already been assigned a public IPv4 address and the rest of the public IPv4 pool is reserved by various organizations for special use.

In the world today, there are more than 4 billion devices connected to the internet. How is it possible to have more devices online than the number of available public IPv4 addresses? RFC 1918 defines three classes of IPv4 addresses that are assignable on private networks and are...

Understanding NAT

A device that is assigned a private IPv4 address is not able to simply communicate with devices on the internet on its own—it needs some assistance. For example, your computer or smart device is mostly likely assigned a private IPv4 address on your network, but it's able to connect to devices on the internet. This is because of something called NAT. NAT makes our lives in networking that bit easier as it allows a router to translate a private address into a public address. Let's take a look at the following diagram to get a clear idea of how NAT really works:

Figure 9.2 – NAT topology

In the preceding figure, there are two networks—a corporate network and the internet—and in between both is a NAT router. Let's imagine that there is a device on the corporate network, PC 1, with an IP address of 192.168.1.10. PC 1 wants to send a message to a device on the internet, let's say a Cisco web server...

Types of NAT

There are many types of NAT translations. Each type has its own advantages, disadvantages, and real-world use. In this section, you will learn about their characteristics and operations, and how to configure each type of NAT on a Cisco IOS router.

Static NAT

Static NAT uses a one-to-one mapping of the inside local address with the inside global address. This type of NAT mapping does not change—as the name implies, the mapping remains constant. This type of NAT is very useful when you want to allow external users on the internet to access a device such as a web server that sits on your internal private network in your organization.

Let's imagine that your organization has a web server located on a private network and you are tasked to allow users from the internet access to the server. To complete this task, you can create a one-to-one static mapping between the web server's private IP address (inside local) and the public IP address on the router...

Lab – implementing NAT overload (PAT)

In this hands-on lab, you will learn how to implement PAT. The following network topology shows an organization's network to the left of the ISP that is connected to the internet. For this lab, we'll be using Cisco Packet Tracer to build our lab and complete the exercise:

Figure 9.10 – NAT overload topology

The objective of this lab is to configure the HQ router with NAT overload to all devices on the corporate network, such as the PC 1 private IP address (10.1.2.10/24), to be translated to a public IP address when it's attempting to connect to the Public Web Server (209.65.1.3/28).

Please use the following guidelines when creating this lab:

• Assign the IP addresses to each device accordingly, as shown in Figure 9.10.
• Use only Cisco 2911 models. Ensure that each interface is configured as shown in the topology.
• Configure each end device with the corresponding IP address, subnet...

Lab – implementing static NAT with port forwarding

In this lab, you will learn how to implement static NAT on an organization router to forward traffic that is originating from the internet to an internal private server. This exercise is an extension of the previous lab. We'll be using the following topology and the same guidelines as before:

Figure 9.14 – Static NAT with port

The objective of this lab is to allow users (Public PC) on the internet to access the internal web server on the private corporate network via NAT. Therefore, when the Public PC enters the public IP address into the web browser, the HQ router will translate and forward the traffic to only the internal web server.

To implement static NAT with port forwarding, use the following instructions:

1. Configure the inside interface on the HQ router that points to the internal web server:

   HQ(config)#interface GigabitEthernet 0/1
   HQ(config-if)#ip nat inside
   HQ(config...

Lab – implementing dynamic NAT

In this lab, you will learn how to implement dynamic NAT with a pool of IP addresses. The following network topology shows an organization network (left) that is connected to the internet via the ISP router:

Figure 9.19 – Dynamic NAT topology

The objective of this lab is to allow the IP addresses of devices in the company attempting to communicate on the internet to be translated to an available public IP address, via dynamic NAT, on the HQ router.

Please be sure to use the following guidelines when creating this lab to ensure that you get the correct results:

• Assign the IP addresses as shown in the preceding figure to each device accordingly.
• Each router (Cisco 2911 model) interface must be configured as shown in the topology.
• Configure each end device with the corresponding IP address, subnet mask, and default gateway, as shown in the topology.
• Configure a default route on HQ to point to...

Summary

In this chapter, we have discussed the important role that NAT plays in almost all private networks of all sizes. We explored the characteristics and functions of each type of NAT and in which situations they would be used. By completing this chapter, you have gained both a theoretical understanding of the operations of NAT on an enterprise network, and the hands-on skills to implement static NAT, dynamic NAT, and PAT on a Cisco network.

I hope that this chapter has been informative and helps you in your journey toward learning how to implement and administrate Cisco solutions and prepare for the CCNA 200-301 certification. In the next Chapter 10, Implementing Network Services and IP Operations, we will learn how to implement the Network Time Protocol (NTP), Dynamic Host Configuration Protocol (DHCP), and other IP services on a Cisco environment.

Questions

The following is a short list of review questions to help reinforce your learning and help you identify which areas of your knowledge require some improvement:

1. Which of the following network addresses are nonroutable on the internet?

   A. 192.167.68.200

   B. 192.169.87.23

   C. 172.31.1.5

   D. 172.32.1.6

2. Which of the following is a benefit of using NAT?

   A. Hides users behind a single public IP address

   B. Allows VoIP communication over the internet

   C. Ensures end-to-end connectivity between internal and external devices

   D. Supports IPSec

3. In terms of NAT, what is defined as the inside address?

   A. The public IP address

   B. The MAC address

   C. The address that is visible on the internet

   D. The address to be translated

4. How would you describe the address of the destination device?

   A. Inside local

   B. Outside local

   C. Inside global

   D. Outside global

5. Which type of NAT is recommended for forwarding all traffic to an internal server if a user on the internet knows the public IP address...

Further reading

The following links are recommended for additional reading:

• Network address translation: https://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/13772-12.html
• Configuring NAT: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/15-mt/nat-15-mt-book/iadnat-addr-consv.html