Configuring NAT (1)

Network Address Translation or NAT was created to represent a large number of private IP addresses for a limited quantity of public IPs; but it's useful for network migrations and mergers (when two networks have similar IP addressing), server load sharing and to create "virtual hosts".

Advanges:

1. To keep the registred addresses
2. it helps to solve IP overlaps
3. No need to renumber as the network changes

Disadvantage:

1. NAT increases delays
2. No End-toEnd traces
3. Some applications don't support NAT

Below there's a basic example from Cisco's Document: Configuring Network Address Translation:Getting Started

NAT statements allow to map an address to different one, based on source, destination or other rules. The first step is to define, what are the inside and outside interfaces.

For the example 1:We want to allow users to get to the internet, but we have only 1 Public IP used by the router's interface Serial0 (outside). We need to NAT our network to be able to get traffic from the internet in our LAN.

LAN: 10.10.10.1Router's E0: 10.1.1.1Router's S0: 172.16.10.64

First, we must configure an IP address in the E0 interface and define it as inside

interface ethernet 0
ip address 10.10.10.1 255.255.255.0
ip nat inside

Then, E1 will be configured the same

interface ethernet 1
ip address 10.10.20.1 255.255.255.0
ip nat inside

Serial0, configuring an IP and defined as outside interface

interface serial 0
ip address 172.16.10.64 255.255.255.0
ip nat outside

Now, we need a NAT pool with the name no-overload; the IP range is 172.16.10.1 to 172.16.10.63

ip nat pool no-overload 172.16.10.1 172.16.10.63 prefix 24
ip nat inside source list 7 pool no-overload

Indicates: any packets received on the inside interface and permitted by access-list 7 will have as source address translated to an address out of the NAT pool "no-overload".

access-list 7 permit 10.10.10.0 0.0.0.31
access-list 7 permit 10.10.20.0 0.0.0.31
!--- Access-list 7 permits packets with source addresses ranging from
!--- 10.10.10.0 through 10.10.10.31 and 10.10.20.0 through 10.10.20.31

Cisco access-list ACL

If you need assitance configuring ACLs, there's a technical reference from Cisco.com:

http://www.cisco.com/en/US/tech/tk648/tk361/tk821/tsd_technology_support_sub-protocol_home.html

and it includes:

Technology White Paper

(All IP Addressing Services Technology White Paper)

• GSR: Receive Access Control Lists
• Protecting Your Core: Infrastructure Protection Access Control Lists
• Transit Access Control Lists: Filtering at Your Edge

Design TechNotes

• (All IP Addressing Services Design TechNotes)
• Cisco Guide to Harden Cisco IOS Devices
• Configuring IP Access Lists

Configuration Examples and TechNotes
(All IP Addressing Services Configuration Examples and TechNotes)

• Cisco Guide to Harden Cisco IOS Devices
• Configuring Commonly Used IP ACLs
• Configuring IP Access Lists

Troubleshoot and Alerts

Security Advisories, Responses and Notices
(All IP Addressing Services Security Advisories, Responses and Notices)

• Cisco Security Advisory: MS SQL Worm Mitigation Recommendations

Troubleshooting TechNotes
(All IP Addressing Services Troubleshooting TechNotes)

• Characterizing and Tracing Packet Floods Using Cisco Routers
• Cisco Guide to Harden Cisco IOS Devices
• Configuring IP Access Lists

ACL, access-list, extended access-list,
Cisco.com\support\technology\IP\IP Addressing Services\Access Lists
Cisco.com\support\technology\IP\IP Addressing Services\Configure\Configuration Examples and TechNotes\Access Lists