All language subtitles for Free-CCNA-NAT-part-2-Day-45-CCNA-200-301-Complete-Course_en

Welcome to Jeremy’s IT Lab. This is a free,\xa0\n

videos, please subscribe to follow along with the\xa0\n

and share the video to help spread this\xa0\n

In this video we will finish up the topic\xa0\n

NAT is topic 4.1 of the CCNA exam.\xa0\xa0

In Day 44 I introduced NAT and covered static\xa0\n

After this video, I think you’ll have no problems\xa0\n

Here’s what we’ll cover in this video. First, I\xa0\n

I didn’t mention in the last video. Then\xa0\n

manually map addresses one-to-one, but instead the\xa0\n

And then another very important\xa0\n

which translates not only the IP address, but\xa0\n

useful because it allows many devices to share\xa0\n

until the end of the video for a bonus practice\xa0\n

First, some review about static NAT. Static\xa0\n

mappings of private IP addresses to public\xa0\n

host is sent to the outside network, the\xa0\n

So, I have mapped inside local address\xa0\n

and also mapped 192.168.0.168 to 100.0.0.2 Then,\xa0\n

at 8.8.8.8, it sends a packet with source IP\xa0\n

translates the source address to 100.0.0.1, a\xa0\n

reply, the destination is the public IP address.\xa0\n

to 192.168.0.167 and forwards it to PC1. Okay,\xa0\n

but let me demonstrate one other\xa0\n

This one-to-one mapping of IP addresses doesn’t\xa0\n

resources, it also allows external hosts to access\xa0\n

So, without PC1 initiating communication\xa0\n

to destination IP 100.0.0.1, and because of that\xa0\n

it to 192.168.0.167 and forward it to PC1, and\xa0\n

not just from inside to outside, but also\xa0\n

to make that clear since I didn’t mention it\xa0\n

In dynamic NAT, the router dynamically maps inside\xa0\xa0

local addresses to inside global addresses\xa0\n

‘map this IP address to this IP address,\xa0\n

The router makes those mappings automatically, and\xa0\n

Here’s how it works in Cisco IOS. An ACL is used\xa0\n

Okay, this part is important, because it’s a\xa0\n

very common use. ACLs can be used to indicate\xa0\n

should be blocked, you already know that. But\xa0\n

If the source IP of a packet is permitted by the\xa0\n

However if the source IP is denied by the ACL, the\xa0\n

mean the traffic will be dropped! We’re simply\xa0\n

translated, we’re not using it to drop traffic,\xa0\n

with the IP ACCESS-GROUP command. Anyway, when\xa0\n

Then, a NAT pool is used to define the available\xa0\n

translation. For example, on R1 I configured ACL\xa0\n

other traffic. I also configured NAT POOL1,\xa0\n

That means if a packet with a source IP permitted\xa0\n

address from POOL1. So, PC1 sends a packet, and\xa0\n

translates the source IP to an address from\xa0\n

and R1 translates the address back. So, it\xa0\n

The difference is that, instead of manually\xa0\n

to 100.0.0.1, R1 did it automatically\xa0\n

Now, I want to emphasize this point. If the\xa0\n

it doesn’t mean the packet will be dropped,\xa0\n

Let me explain a few more points about dynamic\xa0\n

Although they are dynamically assigned,\xa0\n

one inside local IP address per inside global IP\xa0\n

addresses available, if they are all currently\xa0\n

In the previous example, the ACL specified a /24\xa0\n

only had 10 inside global addresses. So, there\xa0\n

What happens if there are no available\xa0\n

If a packet from another inside host arrives and\xa0\n

the router will drop the packet. The host\xa0\n

until one of the inside global IP addresses\xa0\n

Dynamic NAT entries will time out automatically\xa0\n

in our previous example if PC1 stops\xa0\n

the inside global address 100.0.0.1 would become\xa0\n

Or you can use the CLEAR IP NAT TRANSLATION\xa0\n

Let me demonstrate that NAT pool exhaustion. A\xa0\n

It is translated to 100.0.0.1, and then forwarded.\xa0\n

and is translated to 100.0.0.2, and then\xa0\n

and now those ten inside global IP addresses,\xa0\n

If host 192.168.0.98 tries to send some\xa0\n

There are no addresses available, so the router\xa0\n

stops communicating over the Internet. After\xa0\n

If 192.168.0.98 tries to send that traffic\xa0\n

and it can reach the Internet. So, that’s a\xa0\n

Although both are one-to-one mappings, static\xa0\n

mappings are temporary, they will time out when\xa0\n

can use that same public IP address. However,\xa0\n

IP address at the same time. To do that, you\xa0\n

But before looking at Port Address Translation,\xa0\n

First, just like in static NAT you must\xa0\n

Then define the traffic that should be translated.\xa0\n

ACL will be translated. So, this ACL tells R1\xa0\n

Then define the pool of inside global IP\xa0\n

then the pool name. After that you\xa0\n

and then the last IP address in the range. So I\xa0\n

Finally, you have to specify the prefix\xa0\n

or the NETMASK option. IOS uses this to check\xa0\n

of the range, are in the same subnet. If\xa0\n

Finally, configure dynamic NAT by mapping the\xa0\n

and then instead of STATIC use LIST, followed\xa0\n

followed by the pool name. And that’s all there\xa0\n

complicated than static NAT configuration, but\xa0\n

complete I sent some traffic from PC1 and PC2 to\xa0\n

So, here’s R1’s table after sending pings as\xa0\n

Notice there are three entries for each\xa0\n

and three for 192.168.0.168 to 100.0.0.2. When\xa0\n

inside global mappings, these entries are created.\xa0\n

when translations are made, separate entries like\xa0\n

Now, those UDP and ICMP entries will\xa0\n

but the original dynamic mappings themselves\xa0\n

and each time a translation\xa0\n

So, dynamic NAT mappings actually last quite\xa0\n

if you want, but that’s not something you need\xa0\n

entries look like the static NAT entries from Day\xa0\n

these entries will be cleared because\xa0\n

Now here’s SHOW IP NAT STATISTICS.\xa0\xa0

Note that I entered this command when all\xa0\n

so it displays 6 total active translations.\xa0\n

So, all of those entries were dynamic, but can\xa0\n

They are those UDP and ICMP temporary entries\xa0\n

details of extended entries aren’t something you\xa0\n

point out here is that you can confirm the dynamic\xa0\n

with static NAT, the two SHOW commands you should\xa0\n

and SHOW IP NAT STATISTICS. You should be familiar\xa0\n

Now let’s move to PAT, Port Address Translation,\xa0\n

It translates both the IP address and the\xa0\n

And what’s the purpose of translating the port\xa0\n

communication flow between internal hosts and\xa0\n

be used by many different internal hosts. TCP\xa0\n

which means there are over 65,000 port numbers.\xa0\n

local address is using which inside global\xa0\n

track of the communication flows by using unique\xa0\n

PC1 sends a DNS message to 8.8.8.8. Its source IP\xa0\n

port, 54321. PC2 also sends a DNS message\xa0\n

It also selects a random source port, and it\xa0\n

54321. R1 translates the source IP of PC1’s\xa0\n

port the same, 54321. For PC2’s message, it\xa0\n

but it changes the source port to 54322. Why\xa0\n

the communication flows. If both flows\xa0\n

when the replies come from the server, R1\xa0\n

So, the server sends the replies to\xa0\n

but one has destination port 54321, and the\xa0\n

R1 knows to send this reply to PC1 and this reply\xa0\n

same random source port number, because I wanted\xa0\n

However, if PC2 selected a different\xa0\n

then R1 would have no need\xa0\n

It would simply use the source port PC2 selected\xa0\n

So, that’s how PAT works. Because many inside\xa0\n

is very useful for preserving public IP addresses,\xa0\n

Of the three types we have covered, static\xa0\n

widely used because it allows so many inside\xa0\n

Here’s how to configure PAT. It’s basically the\xa0\n

first define the inside and outside interfaces.\xa0\n

by using an ACL. Again, traffic permitted by the\xa0\n

inside global IP addresses. This time I defined\xa0\n

Chances are, unless the internal network is\xa0\n

IP address, but this provides some scalability,\xa0\n

a prefix length of 24 bits. As long as the\xa0\n

this specified prefix length doesn’t\xa0\n

all fit in the subnet 100.0.0.0/24, so the command\xa0\n

It’s the same as for dynamic NAT, except at\xa0\n

INSIDE SOURCE LIST 1 POOL POOL1 OVERLOAD. So,\xa0\n

Let’s take a look at the NAT\xa0\n

So, here are the translations on R1. One big\xa0\n

is that those one-to-one dynamic mapping entries\xa0\n

there are no one-to-one mappings, they’re many\xa0\n

inside global address. As you can see, both\xa0\n

They both selected different source port numbers,\xa0\n

It will use port number 63925 to track the\xa0\n

and it will use port number 59549 to track the\xa0\n

And here’s SHOW IP NAT STATISTICS. Feel free\xa0\n

you’re interested, but now I’m going to move on\xa0\n

One more way to configure PAT, and probably\xa0\n

router to use its own public IP address\xa0\n

So, as always you must configure the inside\xa0\n

And then just like before use an ACL to\xa0\n

Here’s the difference with the\xa0\n

Instead of specifying a POOL\xa0\n

you specify INTERFACE, then the outside\xa0\n

So, R1 will translate the source IP address of\xa0\n

its G0/0 interface, 203.0.113.1. It will also use\xa0\n

so it can keep track of them and multiple\xa0\n

Let me demonstrate that. PC1 and PC2\xa0\n

Notice that they both selected a different random\xa0\n

R1 translates the source IP address of both\xa0\n

G0/0 interface, 203.0.113.1. Because both\xa0\n

there is no need to translate the port numbers.\xa0\n

them back and sends them to their correct\xa0\n

R1 knows which to translate back to 192.168.0.167\xa0\n

Here is R1’s NAT translation table after that.\xa0\xa0

Notice that both 192.168.0.167 and .168\xa0\n

Also notice that, as I said, there was no need\xa0\n

because they were already unique. And here is SHOW\xa0\n

check this command out if you want, but going in\xa0\n

Here are the new commands\xa0\nwe covered in this video.\xa0\xa0

If you don’t remember these commands, go back\xa0\n

practice them in packet tracer either by making\xa0\n

Before moving on to the quiz, let’s\xa0\n

First, I demonstrated how static NAT not only\xa0\n

but it also allows hosts on external\xa0\n

using the mapped inside global IP address. Then I\xa0\n

is probably the most common type of NAT. It allows\xa0\n

all at the same time. My home router, for\xa0\n

of the devices in my home such as my PC, phones\xa0\n

public IP address when accessing the Internet. And\xa0\n

a bonus question from Boson Software’s ExSim\xa0\n

Which of the following NAT types best fulfills\xa0\n

Pause the video now to think about your answer.

Okay, the answer is D, NAT Overload, aka PAT.\xa0\n

use a single public IP address because the\xa0\n

using the Layer 4 port number. This means most\xa0\n

instead of each device requiring a unique\xa0\n

Which of the following dynamic NAT\xa0\n

local addresses from 172.16.1.0/24 to\xa0\n

Pause the video now to think about the answer.

Okay, the answer is B. So, what’s wrong with\xa0\n

255.255.255.128 is /25, but the address range is\xa0\n

not fall in the 203.0.113.0/25 subnet, so the\xa0\n

The ACL’s mask is 255.255.255.0, but\xa0\n

so /24 should be 0.0.0.255.\xa0\nOkay, let’s go to question 3.

Dynamic NAT is configured on R1 and a pool\xa0\n

Currently, all 10 addresses\xa0\n

but another inside host attempts\xa0\n

What does R1 do with this packet? Pause\xa0\n

Okay, the answer is B, it discards the packet.\xa0\xa0

When dynamic NAT is being used and a packet\xa0\n

addresses in the pool, the router will simply\xa0\n

Which of the following dynamic NAT\xa0\n

local addresses from 10.0.1.0/27 to use the\xa0\n

Pause the video now to think about the answer.

Okay the answer is A. It’s the\xa0\n

/27 wildcard mask in the ACL,\xa0\n

and assigns the inside and outside interfaces\xa0\n

After specifying the inside\xa0\n

you issue the following commands on R1. What\xa0\n

subnet? Pause the video now\xa0\nto think about the answer.

Okay, the answer is C, the packets\xa0\n

R1. When an ACL is used to identify\xa0\n

such as in dynamic NAT and PAT, packets\xa0\n

and packets denied by the ACL won’t be translated.\xa0\n

it doesn’t mean the router will drop the packets,\xa0\n

for the quiz. Now let’s take a look at a bonus\xa0\n

Okay, here's today's Boson ExSim practice\xa0\n

an HTTP connection to HostB through a NAT router\xa0\n

addresses. Here they are. Which of the following\xa0\n

when you issue the SHOW IP NAT TRANSLATIONS\xa0\n

Okay, pause the video now. Take a look at\xa0\n

Okay let's check. So, first off, what should the\xa0\n

They should be the IP address of the destination\xa0\n

are correct. Now how about the inside\xa0\n

That should be the IP address of the source host,\xa0\n

this case. So, 10.1.7.7. So that means A and D are\xa0\n

which is the IP address of RouterA's internal\xa0\n

the correct answer is either B or C. Now, how\xa0\n

10.1.7.1, like in B, or 203.0.113.62? So, 10.1.7.1\xa0\n

and 203.0.113.62 is the IP address of RouterA's\xa0\n

and translating to the IP address of the router's\xa0\n

address of the external interface, the public IP\xa0\n

So I will click on show answer and indeed that\xa0\n

that answer. You can pause the video now to read\xa0\n

Okay, so that was a quick look at\xa0\n

These are without a doubt the best practice\xa0\n

them. If you want to get Boson ExSim, please\xa0\n

There are supplementary materials for this video.\xa0\xa0

There is a flashcard deck to\xa0\n

There will also be a packet tracer practice\xa0\n

That will be in the next video. Sign up for my\xa0\n

and I’ll send you all of the flashcards\xa0\n

Before finishing today’s video I want\xa0\n

To join, please click the ‘Join’ button under the\xa0\n

Njoku, Viktor, Roger, Raj, Kenneth, Seamus, H\xa0\n

Gustavo, Anthony, Benjamin, Justin, Prakaash,\xa0\n

Funnydart, Velvijaykum, Mark, Yousif, Boson\xa0\n

Sorry if I pronounced your name incorrectly,\xa0\n

This is the list of JCNP-level members at the\xa0\n

If you signed up recently and your name isn’t\xa0\n

Thank you for watching. Please\xa0\n

like the video, leave a comment, and share the\xa0\n

If you want to leave a tip, check the links in the\xa0\n

and accept BAT, or Basic Attention Token, tips\xa0\n