Lesson Contents
In this lesson we’ll take a look at some common NAT (Network Address Translation / PAT (Port Address Translation) issues. The configuration of NAT / PAT on Cisco IOS routers is pretty straight-forward but there are some issues. Let’s look at some scenarios…
NAT Inside / Outside
Here’s the topology I will use:
In this scenario we have 3 devices. The router on the left side is called “Host” and this is supposed to be a computer on our LAN. The device on the right side is supposed to be some webserver, something that we are trying to reach on the Internet. In the middle we’ll find our router that is configured for NAT and/or PAT.
Users from our LAN are complaining that they are unable to reach anything on the Internet. They have confirmed that their IP address and default gateway is OK. Let’s take a look at the NAT router:
NAT#ping 192.168.23.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.23.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
It’s not a bad idea to check if the NAT router can reach the webserver by trying a simple ping. If it doesn’t work you at least know that you have routing issues or that the webserver is down (or maybe just blocking ICMP traffic). Let’see if we can connect to TCP port 80:
NAT#telnet 192.168.23.3 80
Trying 192.168.23.3, 80 ... Open
You can see that this is working so routing between the NAT router and the webserver and connecting to the TCP port is no problem. Let’s focus on the NAT configuration:
NAT#show ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp 192.168.23.2:1 192.168.12.2:1 192.168.12.1:1 192.168.12.1:1
We can use the show ip nat translations to see if anything is going on. We see that the NAT router is translating something but it doesn’t look quite right if you look closely. The outside local and global IP addresses refer to the IP address on the inside. Let’s take a closer look:
NAT#show ip nat statistics
Total active translations: 0 (0 static, 0 dynamic; 0 extended)
Outside interfaces:
FastEthernet0/0
Inside interfaces:
FastEthernet1/0
Hits: 5 Misses: 0
CEF Translated packets: 0, CEF Punted packets: 0
Expired translations: 1
Dynamic mappings:
-- Inside Source
[Id: 1] access-list 1 interface FastEthernet1/0 refcount 0
Queued Packets: 0
Show ip nat statistics is a nice command to verify your configuration. You can see that the inside and outside interfaces have been swapped. FastEthernet 0/0 should be the inside and FastEthernet 1/0 should be the outside. Let’s fix this:
Hi Rene,
Interesting scenarios and explained by you clearly.
Thanks,
Srini
I’m confused about the 172.16.1.0 subnet.
I guess the address 172.16.1.1 does somehow configure automatically in the HOST.
Two questions :
1 - Why the static rule is simply not something like ip route 172.16.1.0 255.255.255.0 192.168.12.1 ?
2 - How come a private (inside) network (172.16.1.0) be advertised for outside of the NAT ?
Hello Maodo
The 172.16.1.0 subnet is a range of addresses that are given to us by the ISP that will be used to translate the INSIDE addresses to the OUTSIDE. In other words, when the Host communicates to the outside world, the 192.168.12.1 address will be translated to 172.16.1.X when it traverses the NAT router. So from the NAT router outwards, all communication occurs with the IP address 172.16.1.X. Note that this subnet essentially “exists” on the F1/0 interface of the NAT router. In a sense, it coexists with the 192.168.23.2 IP address on that interface
... Continue reading in our forumOk ! Ok ! I see. It’s “Dynamic NAT”, as it is explained by the following lesson.
https://networklessons.com/cisco/ccnp-route/how-to-configure-dynamic-nat-on-cisco-ios-router/
There’s, unfortunately, something confusing in the output of show ip nat translations. The column “Inside global” does not seem to have any relation with the green “Inside” box of the schema.
Hi @kayoutoure,
The inside global address is indeed the IP address on the outside interface of the NAT router, it’s the address that you translate to. This can be a bit confusing, if you see the word “inside” you might start looking at the green inside box but you won’t find it there….
Rene