Back to Dashboard
Module 14
Network Address Translation (NAT)
← Previous Module
Next Module →
# 📘 CCNA 200-301 - Video 14: Network Address Translation (NAT) ## Deep Study Notes --- ## 📌 Learning Objectives By the end of this video, you should understand: - What NAT is and why it's needed - IPv4 address scarcity problem - Static NAT, Dynamic NAT, and PAT (NAT Overload) - NAT terminology (Inside Local, Inside Global, Outside Local, Outside Global) - NAT configuration and verification - NAT troubleshooting --- ## 🧠 Core Concepts ### 1. The Problem: IPv4 Address Exhaustion **Problem:** IPv4 uses 32-bit addresses, providing approximately 4.3 billion unique addresses. With the explosion of internet-connected devices, this is insufficient. **Analogy:** Think of NAT like a company receptionist. The company has one public phone number (public IP). When employees (private IPs) make calls, the receptionist routes calls through that single number. When calls come in, the receptionist knows which employee to route to based on extension numbers (port numbers). ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ WITHOUT NAT (Every Device Needs Public IP) │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ Internet │ │ │ │ │ │ │ │ ┌──▼──────────────────────────────────────────────────────────────────┐ │ │ │ ISP │ │ │ │ Public IP Range │ │ │ └──┬──────────────────────────────────────────────────────────────────┘ │ │ │ │ │ ├──────────────┬──────────────┬──────────────┬──────────────┐ │ │ │ │ │ │ │ │ │ ┌──▼──┐ ┌──▼──┐ ┌──▼──┐ ┌──▼──┐ ┌──▼──┐ │ │ │ PC1 │ │ PC2 │ │ PC3 │ │ PC4 │ │ PC5 │ │ │ │Public│ │Public│ │Public│ │Public│ │Public│ │ │ │ IP │ │ IP │ │ IP │ │ IP │ │ IP │ │ │ └─────┘ └─────┘ └─────┘ └─────┘ └─────┘ │ │ │ │ PROBLEM: │ │ • Each device needs a unique public IP │ │ • Not enough IPv4 addresses for all devices │ │ • Expensive to acquire public IPs │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ┌─────────────────────────────────────────────────────────────────────────────┐ │ WITH NAT (Private IPs Share Public IP) │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ Internet │ │ │ │ │ │ │ │ ┌──▼──────────────────────────────────────────────────────────────────┐ │ │ │ ISP │ │ │ │ Public IP: 203.0.113.1 │ │ │ └──┬──────────────────────────────────────────────────────────────────┘ │ │ │ │ │ ┌──▼──────────────────────────────────────────────────────────────────┐ │ │ │ Router │ │ │ │ NAT Enabled │ │ │ │ Inside Global: 203.0.113.1 │ │ │ └──┬──────────────────────────────────────────────────────────────────┘ │ │ │ │ │ ├──────────────┬──────────────┬──────────────┬──────────────┐ │ │ │ │ │ │ │ │ │ ┌──▼──┐ ┌──▼──┐ ┌──▼──┐ ┌──▼──┐ ┌──▼──┐ │ │ │ PC1 │ │ PC2 │ │ PC3 │ │ PC4 │ │ PC5 │ │ │ │10.1.1.2│ │10.1.1.3│ │10.1.1.4│ │10.1.1.5│ │10.1.1.6│ │ │ │Private│ │Private│ │Private│ │Private│ │Private│ │ │ └─────┘ └─────┘ └─────┘ └─────┘ └─────┘ │ │ │ │ BENEFIT: All devices share one public IP (or a few) │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 2. Private IP Address Ranges (RFC 1918) **Reserved for private use (not routable on internet):** | Class | Address Range | CIDR | Number of Addresses | |-------|---------------|------|---------------------| | **Class A** | 10.0.0.0 - 10.255.255.255 | 10.0.0.0/8 | 16,777,216 | | **Class B** | 172.16.0.0 - 172.31.255.255 | 172.16.0.0/12 | 1,048,576 | | **Class C** | 192.168.0.0 - 192.168.255.255 | 192.168.0.0/16 | 65,536 | **Also Reserved:** - **Loopback:** 127.0.0.0/8 (localhost) - **Link-Local (APIPA):** 169.254.0.0/16 (DHCP failure) - **Multicast:** 224.0.0.0/4 - **Experimental:** 240.0.0.0/4 --- ### 3. NAT Terminology ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ NAT TERMINOLOGY │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ OUTSIDE │ │ │ │ (Public Network) │ │ │ │ │ │ │ │ Outside Local (OL) Outside Global (OG) │ │ │ │ = Outside device as seen = Outside device as seen │ │ │ │ from inside network from outside network │ │ │ │ │ │ │ │ Example: 209.165.200.225 = 209.165.200.225 │ │ │ │ (same in most cases) │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ INSIDE │ │ │ │ (Private Network) │ │ │ │ │ │ │ │ Inside Local (IL) Inside Global (IG) │ │ │ │ = Inside device as seen = Inside device as seen │ │ │ │ from inside network from outside network │ │ │ │ │ │ │ │ Example: 192.168.1.10 = 203.0.113.1 │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ NAT TERMS SUMMARY: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • Inside Local: Original source IP (private) │ │ │ │ • Inside Global: Translated source IP (public) │ │ │ │ • Outside Local: Destination IP as seen from inside (usually public)│ │ │ │ • Outside Global: Destination IP as seen from outside (public) │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 4. Types of NAT | Type | Description | Use Case | Translation | |------|-------------|----------|-------------| | **Static NAT** | One-to-one mapping | Servers that need inbound access | Private IP ↔ Public IP (fixed) | | **Dynamic NAT** | Many-to-many (pool) | Multiple devices share public pool | Private IP → First available public | | **PAT (NAT Overload)** | Many-to-one | Home/office networks | Private IP:Port → Public IP:Unique Port | --- ### 5. Static NAT **Definition:** Static NAT creates a permanent, one-to-one mapping between a private IP address and a public IP address. **Use Case:** Hosting a server (web, email, etc.) that needs to be accessible from the internet. ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ STATIC NAT │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ Internet User Router Web Server │ │ │ │ ┌─────────┐ ┌─────────┐ ┌─────────┐ │ │ │ Client │ │ Router │ │ Server │ │ │ │8.8.8.8 │ │ │ │10.1.1.10│ │ │ └────┬────┘ └────┬────┘ └────┬────┘ │ │ │ │ │ │ │ │ Dest: 203.0.113.10 │ │ │ │ │ ─────────────────────────────►│ │ │ │ │ │ │ │ │ │ │ Dest: 10.1.1.10 │ │ │ │ │ ───────────────────►│ │ │ │ │ │ │ │ │ │ Src: 10.1.1.10 │ │ │ │ │ ◄───────────────────│ │ │ │ │ │ │ │ │ Src: 203.0.113.10 │ │ │ │ │ ◄─────────────────────────────│ │ │ │ │ │ │ │ │ │ │ Static NAT Mapping: │ │ Inside Local (10.1.1.10) ↔ Inside Global (203.0.113.10) │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` **Static NAT Configuration:** ```cisco ! Configure static NAT mapping Router(config)# ip nat inside source static 10.1.1.10 203.0.113.10 ! Identify inside and outside interfaces Router(config)# interface gigabitEthernet 0/0 Router(config-if)# ip address 10.1.1.1 255.255.255.0 Router(config-if)# ip nat inside Router(config-if)# no shutdown Router(config-if)# exit Router(config)# interface gigabitEthernet 0/1 Router(config-if)# ip address 203.0.113.1 255.255.255.0 Router(config-if)# ip nat outside Router(config-if)# no shutdown Router(config-if)# exit ! Verify Router# show ip nat translations Router# show ip nat statistics ``` --- ### 6. Dynamic NAT **Definition:** Dynamic NAT maps private IP addresses to a pool of public IP addresses on a first-come, first-served basis. **Use Case:** When multiple internal devices need internet access but you have a pool of public IPs. ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ DYNAMIC NAT │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ Public IP Pool: 203.0.113.10 - 203.0.113.15 │ │ │ │ PC1 (10.1.1.2) → 203.0.113.10 │ │ PC2 (10.1.1.3) → 203.0.113.11 │ │ PC3 (10.1.1.4) → 203.0.113.12 │ │ PC4 (10.1.1.5) → 203.0.113.13 │ │ │ │ If more devices than IPs, some wait until IPs free up │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` **Dynamic NAT Configuration:** ```cisco ! Define access list for internal networks Router(config)# access-list 10 permit 10.1.1.0 0.0.0.255 ! Define NAT pool (public IPs) Router(config)# ip nat pool PUBLIC_POOL 203.0.113.10 203.0.113.15 netmask 255.255.255.0 ! Configure dynamic NAT mapping Router(config)# ip nat inside source list 10 pool PUBLIC_POOL ! Identify inside and outside interfaces Router(config)# interface gigabitEthernet 0/0 Router(config-if)# ip address 10.1.1.1 255.255.255.0 Router(config-if)# ip nat inside Router(config-if)# exit Router(config)# interface gigabitEthernet 0/1 Router(config-if)# ip address 203.0.113.1 255.255.255.0 Router(config-if)# ip nat outside Router(config-if)# exit ! Verify Router# show ip nat translations Router# show ip nat statistics ``` --- ### 7. PAT (NAT Overload) **Definition:** PAT (Port Address Translation) maps multiple private IP addresses to a single public IP address using different port numbers. This is the most common type of NAT. **Analogy:** An apartment building (private IPs) with one street address (public IP). Mail is delivered to the building, and the doorman (router) delivers to the correct apartment based on apartment number (port number). ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ PAT (NAT OVERLOAD) │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ Public IP: 203.0.113.1 │ │ │ │ PC1 (10.1.1.2) Port 12345 ───► 203.0.113.1:12345 │ │ PC2 (10.1.1.3) Port 12346 ───► 203.0.113.1:12346 │ │ PC3 (10.1.1.4) Port 12347 ───► 203.0.113.1:12347 │ │ │ │ Outbound Traffic: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ Source: 10.1.1.2:12345 ──► Source: 203.0.113.1:12345 │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ Return Traffic: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ Dest: 203.0.113.1:12345 ──► Dest: 10.1.1.2:12345 │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ NAT Translation Table: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ Inside Local │ Inside Global │ │ │ │ 10.1.1.2:12345 │ 203.0.113.1:12345 │ │ │ │ 10.1.1.3:12346 │ 203.0.113.1:12346 │ │ │ │ 10.1.1.4:12347 │ 203.0.113.1:12347 │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` **PAT (NAT Overload) Configuration:** ```cisco ! Define access list for internal networks Router(config)# access-list 10 permit 10.1.1.0 0.0.0.255 ! Configure PAT (NAT Overload) Router(config)# ip nat inside source list 10 interface gigabitEthernet 0/1 overload ! Alternative with pool Router(config)# ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.1 netmask 255.255.255.0 Router(config)# ip nat inside source list 10 pool PUBLIC_POOL overload ! Identify inside and outside interfaces Router(config)# interface gigabitEthernet 0/0 Router(config-if)# ip address 10.1.1.1 255.255.255.0 Router(config-if)# ip nat inside Router(config-if)# exit Router(config)# interface gigabitEthernet 0/1 Router(config-if)# ip address 203.0.113.1 255.255.255.0 Router(config-if)# ip nat outside Router(config-if)# exit ! Verify Router# show ip nat translations Router# show ip nat statistics ``` --- ### 8. NAT Configuration Steps **Step-by-Step NAT Configuration:** ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ NAT CONFIGURATION STEPS │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ STEP 1: Define Inside and Outside Interfaces │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ interface gigabitEthernet 0/0 │ │ │ │ ip address 10.1.1.1 255.255.255.0 │ │ │ │ ip nat inside │ │ │ │ │ │ │ │ interface gigabitEthernet 0/1 │ │ │ │ ip address 203.0.113.1 255.255.255.0 │ │ │ │ ip nat outside │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ ▼ │ │ STEP 2: Define Translation Method │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ Static NAT: │ │ │ │ ip nat inside source static 10.1.1.10 203.0.113.10 │ │ │ │ │ │ │ │ Dynamic NAT: │ │ │ │ access-list 10 permit 10.1.1.0 0.0.0.255 │ │ │ │ ip nat pool POOL 203.0.113.10 203.0.113.15 netmask 255.255.255.0 │ │ │ │ ip nat inside source list 10 pool POOL │ │ │ │ │ │ │ │ PAT (NAT Overload): │ │ │ │ access-list 10 permit 10.1.1.0 0.0.0.255 │ │ │ │ ip nat inside source list 10 interface gig0/1 overload │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ ▼ │ │ STEP 3: Verify Configuration │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ show ip nat translations │ │ │ │ show ip nat statistics │ │ │ │ show running-config | include nat │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 9. NAT Verification Commands | Command | Purpose | |---------|---------| | `show ip nat translations` | Display active NAT translations | | `show ip nat statistics` | Display NAT statistics (hits, misses, etc.) | | `show ip nat translations verbose` | Detailed translation info | | `clear ip nat translation *` | Clear all translations | | `clear ip nat translation [ip]` | Clear specific translation | | `debug ip nat` | Debug NAT (use cautiously) | **Example Outputs:** ```cisco Router# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 203.0.113.10 10.1.1.10 --- --- tcp 203.0.113.1:12345 10.1.1.2:12345 209.165.200.1:80 209.165.200.1:80 tcp 203.0.113.1:12346 10.1.1.3:12346 209.165.200.1:443 209.165.200.1:443 icmp 203.0.113.1:12347 10.1.1.4:12347 8.8.8.8:12347 8.8.8.8:12347 Router# show ip nat statistics Total active translations: 4 (1 static, 3 dynamic; 3 extended) Outside interfaces: GigabitEthernet0/1 Inside interfaces: GigabitEthernet0/0 Hits: 1245 Misses: 23 CEF Translated packets: 1245, CEF Punted packets: 23 Expired translations: 12 Dynamic mappings: -- Inside Source [Id: 1] access-list 10 interface GigabitEthernet0/1 refcount 3 Total doors: 0 Appl doors: 0 Normal doors: 0 Queued Packets: 0 ``` --- ### 10. NAT Troubleshooting | Problem | Symptom | Solution | |---------|---------|----------| | **No Translation** | `show ip nat translations` empty | Verify interfaces marked `ip nat inside/outside` | | **ACL Not Matching** | Traffic not translated | Verify ACL permits source networks | | **Pool Exhausted** | No translations for new hosts | Increase pool size or use PAT | | **Outside Access Failure** | Internal hosts can't reach internet | Check default route, NAT configuration | | **Inbound Access Failure** | External can't reach internal server | Verify static NAT, ACLs, routing | | **Translation Errors** | `debug ip nat` shows errors | Check for overlapping addresses, misconfiguration | **Troubleshooting Flow:** ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ NAT TROUBLESHOOTING FLOW │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ START: Can internal hosts ping external IP? │ │ │ │ │ ├─── NO ──► Check: │ │ │ • Default route to ISP │ │ │ • ISP connectivity │ │ │ • NAT configuration │ │ │ │ │ └─── YES ──► Check `show ip nat translations` │ │ │ │ │ ├─── Translations exist ──► NAT working │ │ │ │ │ └─── No translations ──► Check: │ │ • ip nat inside/outside on interfaces │ │ • ACL matches source networks │ │ • NAT overload keyword │ │ • show ip nat statistics │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 11. NAT and ACL Order of Operation **Router Processing Order (Inbound):** ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ ROUTER PROCESSING ORDER │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ Inbound (Outside → Inside): │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ 1. Inbound ACL (on outside interface) │ │ │ │ 2. NAT translation (Outside Local → Outside Global) │ │ │ │ 3. Routing decision │ │ │ │ 4. Outbound ACL (on inside interface) │ │ │ │ 5. NAT translation (Inside Global → Inside Local) │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ Outbound (Inside → Outside): │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ 1. Inbound ACL (on inside interface) │ │ │ │ 2. Routing decision │ │ │ │ 3. NAT translation (Inside Local → Inside Global) │ │ │ │ 4. Outbound ACL (on outside interface) │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ IMPORTANT: ACLs should match IP addresses BEFORE translation │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ## 🔧 Complete Configuration Examples ### Lab 1: PAT (NAT Overload) - Home/Office Network **Topology:** ``` Internal Network Router Internet 192.168.1.0/24 ┌─────────┐ ┌─────────┐ ┌─────────┐ │ PC1 │ │ Router │ │ Internet│ │192.168.1.2│ │ │ │ Server │ └────┬────┘ │ Gi0/0 │ │8.8.8.8 │ │ │192.168.1.1│ └────┬────┘ │ │ │ │ ┌────▼────┐ │ Gi0/1 │ │ │ PC2 │ │ DHCP │ │ │192.168.1.3│ │ Public IP│ │ └─────────┘ └────┬────┘ │ │ │ └────────────────────────┘ Public IP: 203.0.113.1/24 ``` **Configuration:** ```cisco hostname Router ! ! Configure interfaces interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip nat inside no shutdown ! interface GigabitEthernet0/1 ip address dhcp ip nat outside no shutdown ! ! Define internal networks access-list 10 permit 192.168.1.0 0.0.0.255 ! ! Configure PAT (NAT Overload) ip nat inside source list 10 interface GigabitEthernet0/1 overload ! ! Default route to ISP ip route 0.0.0.0 0.0.0.0 dhcp ! end ``` --- ### Lab 2: Static NAT for Web Server **Topology:** ``` Internal Network Router Internet 192.168.1.0/24 ┌─────────┐ ┌─────────┐ ┌─────────┐ │ PC1 │ │ Router │ │ Internet│ │192.168.1.2│ │ │ │ Client │ └─────────┘ │ Gi0/0 │ │8.8.8.8 │ │192.168.1.1│ └────┬────┘ ┌─────────┐ │ │ │ │ Web │ │ Gi0/1 │ │ │ Server │ │203.0.113.1│ │ │192.168.1.10│ └────┬────┘ │ └─────────┘ │ │ └────────────────────────┘ Public IP: 203.0.113.1/24 ``` **Configuration:** ```cisco hostname Router ! ! Configure interfaces interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip nat inside no shutdown ! interface GigabitEthernet0/1 ip address 203.0.113.1 255.255.255.0 ip nat outside no shutdown ! ! Static NAT for web server (HTTP/HTTPS) ip nat inside source static 192.168.1.10 203.0.113.10 ! ! PAT for other internal devices access-list 10 permit 192.168.1.0 0.0.0.255 ip nat inside source list 10 interface GigabitEthernet0/1 overload ! ! Default route ip route 0.0.0.0 0.0.0.0 203.0.113.254 ! end ``` --- ### Lab 3: Dynamic NAT with Pool **Topology:** ``` Internal Network Router Internet 10.1.1.0/24 ┌─────────┐ ┌─────────┐ ┌─────────┐ │ PC1 │ │ Router │ │ Internet│ │10.1.1.2│ │ │ │ │ └─────────┘ │ Gi0/0 │ └─────────┘ │10.1.1.1 │ ┌─────────┐ │ │ │ PC2 │ │ Gi0/1 │ │10.1.1.3│ │203.0.113.1│ └─────────┘ └────┬────┘ │ │ Public IP Pool: 203.0.113.10-15/24 ``` **Configuration:** ```cisco hostname Router ! ! Configure interfaces interface GigabitEthernet0/0 ip address 10.1.1.1 255.255.255.0 ip nat inside no shutdown ! interface GigabitEthernet0/1 ip address 203.0.113.1 255.255.255.0 ip nat outside no shutdown ! ! Define internal networks access-list 10 permit 10.1.1.0 0.0.0.255 ! ! Define public IP pool ip nat pool PUBLIC_POOL 203.0.113.10 203.0.113.15 netmask 255.255.255.0 ! ! Configure dynamic NAT ip nat inside source list 10 pool PUBLIC_POOL ! ! Default route ip route 0.0.0.0 0.0.0.0 203.0.113.254 ! end ``` --- ## 📊 Text-Based Diagrams ### NAT Translation Table Example ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ NAT TRANSLATION TABLE │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ PC1 (10.1.1.2) initiates web request to 8.8.8.8:80 │ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ Protocol │ Inside Local │ Inside Global │ Outside Local │ Outside Global │ │ ├──────────┼─────────────────┼─────────────────┼───────────────┼────────────────┤ │ │ TCP │ 10.1.1.2:54321 │ 203.0.113.1:54321│ 8.8.8.8:80 │ 8.8.8.8:80 │ │ │ TCP │ 10.1.1.3:54322 │ 203.0.113.1:54322│ 8.8.8.8:80 │ 8.8.8.8:80 │ │ │ TCP │ 10.1.1.4:54323 │ 203.0.113.1:54323│ 8.8.8.8:443 │ 8.8.8.8:443 │ │ │ ICMP │ 10.1.1.2:12345 │ 203.0.113.1:12345│ 8.8.8.8:12345│ 8.8.8.8:12345 │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ Return Traffic: │ │ Packet arrives: Dest = 203.0.113.1:54321 │ │ Router looks up table → Dest = 10.1.1.2:54321 │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ## ✅ Exam Tips (For CCNA 200-301) | Topic | What Cisco Tests | |-------|------------------| | **NAT Purpose** | Conserve public IPs, allow private IPs to access internet | | **Private IP Ranges** | 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 | | **NAT Types** | Static, Dynamic, PAT (NAT Overload) | | **PAT** | Most common; uses port numbers to differentiate | | **NAT Terminology** | Inside Local, Inside Global, Outside Local, Outside Global | | **Commands** | `ip nat inside`, `ip nat outside`, `ip nat inside source` | ### Common Exam Scenarios: **Scenario 1:** "A company has 200 internal devices but only 5 public IPs. Which NAT type should be used?" - **Answer:** PAT (NAT Overload) - allows many devices to share few public IPs **Scenario 2:** "A web server must be accessible from the internet with a fixed public IP. Which NAT type is appropriate?" - **Answer:** Static NAT - one-to-one permanent mapping **Scenario 3:** "`show ip nat translations` shows no translations. What is the most likely issue?" - **Answer:** Interfaces not marked with `ip nat inside/outside`, or ACL not matching traffic ### Mnemonics: **Private IP Ranges:** **"10 is a lot, 172 is medium, 192 is small"** - 10.0.0.0/8 (large) - 172.16.0.0/12 (medium) - 192.168.0.0/16 (small) **NAT Terminology:** **"Inside Local is inside looking in, Inside Global is inside looking out"** - Inside Local = Private IP (as seen from inside) - Inside Global = Public IP (as seen from outside) --- ## 📝 Summary (1-Minute Revision) ``` NAT (Network Address Translation): PURPOSE: ├── Conserve public IPv4 addresses ├── Allow private IPs to access internet └── Hide internal network structure PRIVATE IP RANGES (RFC 1918): ├── 10.0.0.0/8 (Class A) ├── 172.16.0.0/12 (Class B) └── 192.168.0.0/16 (Class C) NAT TYPES: ├── Static NAT: 1:1 permanent mapping ├── Dynamic NAT: Many:Many (pool) └── PAT (NAT Overload): Many:1 (most common) TERMINOLOGY: ├── Inside Local: Original private IP ├── Inside Global: Translated public IP ├── Outside Local: Destination as seen from inside └── Outside Global: Destination as seen from outside CONFIGURATION STEPS: ├── ip nat inside (on inside interface) ├── ip nat outside (on outside interface) ├── Define ACL for internal networks ├── Configure NAT mapping └── ip nat inside source list [acl] interface [int] overload VERIFICATION: ├── show ip nat translations ├── show ip nat statistics └── debug ip nat PAT (NAT OVERLOAD): └── ip nat inside source list 10 interface gi0/1 overload ``` --- ## 🧪 Practice Questions **1. Which RFC defines private IP address ranges?** - A) RFC 1918 - B) RFC 791 - C) RFC 826 - D) RFC 2131 <details> <summary>Answer</summary> <b>A) RFC 1918</b> - This defines private IP address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). </details> **2. Which NAT type maps many private IPs to a single public IP using port numbers?** - A) Static NAT - B) Dynamic NAT - C) PAT (NAT Overload) - D) Source NAT <details> <summary>Answer</summary> <b>C) PAT (NAT Overload)</b> - Port Address Translation uses port numbers to differentiate multiple connections to one public IP. </details> **3. What is the inside local address?** - A) Public IP of internal device as seen from outside - B) Private IP of internal device as seen from inside - C) Public IP of external device as seen from inside - D) Private IP of external device <details> <summary>Answer</summary> <b>B) Private IP of internal device as seen from inside</b> - Inside Local is the original private IP address of the internal host. </details> **4. Which command marks an interface as the inside NAT interface?** - A) `ip nat inside` - B) `ip nat outside` - C) `nat inside` - D) `inside nat` <details> <summary>Answer</summary> <b>A) `ip nat inside`</b> - This designates the interface as the internal (private) side for NAT. </details> **5. What is the purpose of the `overload` keyword in NAT configuration?** - A) Enable static NAT - B) Enable PAT (many-to-one translation) - C) Enable dynamic NAT - D) Enable logging <details> <summary>Answer</summary> <b>B) Enable PAT (many-to-one translation)</b> - `overload` enables Port Address Translation, allowing multiple hosts to share one public IP. </details> **6. Which IP address range is reserved for private use?** - A) 192.0.0.0/8 - B) 172.32.0.0/12 - C) 10.0.0.0/8 - D) 169.254.0.0/16 <details> <summary>Answer</summary> <b>C) 10.0.0.0/8</b> - This is one of the RFC 1918 private address ranges. </details> **7. What command displays active NAT translations?** - A) `show nat translations` - B) `show ip nat translations` - C) `show ip nat table` - D) `show nat table` <details> <summary>Answer</summary> <b>B) `show ip nat translations`</b> - This shows all active NAT translation entries. </details> **8. A company has 1000 internal devices and 1 public IP. Which NAT type is most appropriate?** - A) Static NAT - B) Dynamic NAT - C) PAT (NAT Overload) - D) NAT Pool <details> <summary>Answer</summary> <b>C) PAT (NAT Overload)</b> - PAT allows many devices to share a single public IP using port numbers. </details> **9. Which command configures static NAT mapping?** - A) `ip nat inside source static 10.1.1.10 203.0.113.10` - B) `ip nat static 10.1.1.10 203.0.113.10` - C) `nat static 10.1.1.10 203.0.113.10` - D) `ip nat inside static 10.1.1.10 203.0.113.10` <details> <summary>Answer</summary> <b>A) `ip nat inside source static 10.1.1.10 203.0.113.10`</b> - Correct syntax for static NAT mapping. </details> **10. What does `clear ip nat translation *` do?** - A) Removes all NAT translations - B) Displays NAT statistics - C) Disables NAT - D) Saves NAT configuration <details> <summary>Answer</summary> <b>A) Removes all NAT translations</b> - This clears all active translation entries from the NAT table. </details> **11. Which NAT type is best for hosting a public web server behind a private IP?** - A) PAT - B) Dynamic NAT - C) Static NAT - D) Source NAT <details> <summary>Answer</summary> <b>C) Static NAT</b> - Provides a fixed, permanent mapping for inbound access to servers. </details> **12. A router shows 0 hits in `show ip nat statistics`. What is the most likely cause?** - A) NAT is working correctly - B) No traffic is being translated - C) Too many translations - D) Interface is down <details> <summary>Answer</summary> <b>B) No traffic is being translated</b> - Zero hits indicates no packets have been translated by NAT. </details> --- ## 📌 Next Steps After completing Video 14, you should be ready for: - **Video 15:** IPv6 Addressing and Configuration - **Video 16:** IPv6 Routing and Transition Mechanisms **Lab Practice:** 1. Configure PAT (NAT Overload) for a LAN to access internet 2. Configure static NAT for a web server 3. Configure dynamic NAT with a pool of public IPs 4. Verify with `show ip nat translations` and `show ip nat statistics` 5. Test connectivity from internal hosts to external 6. Test inbound access to static NAT server --- **Ready for Video 15?** Share the link or say "next" and I'll continue with IPv6 Addressing and Configuration. I'll create comprehensive deep notes for **Video 15: IPv6 Addressing and Configuration** based on the standard CCNA 200-301 curriculum. ---