All language subtitles for 33 - Routing - NAT Configuration-eng

>> We move from concept to configuration.

NAT configuration is one of the
more enjoyable on a Cisco router

because there's a few moving parts to it.

And you have to take some of the
concepts that you've learned about,

most specifically access list
which you just learned about

and apply it here to be successful.

So that just makes it kind
of a neat thing to do.

For this configuration I am
using real Cisco routers.

I moved out of GNS3 just
because there's something lost.

I mean you can bridge GNS3 to a real
network card and have it do NAT,

and that's definitely great if
you don't have a Cisco router.

But there's something lost when you just
can't open a web page and be like, oh look,

it's working and checking
all the NAT translation.

Because obviously without
getting virtual box set up

and all of that craziness there's no
real way to do that inside of GNS3

at least easily, but it's possible.

So what I'm going to do is I'm going
to build this router from scratch

because you can't see it enough, and as
we're nearing the end of this series I'd love

to solidify a bunch of concepts in your head.

So we're going to name this router NAT.

And we're going to make this
the fast ethernet 0/0 port

and give it the IP address 192.168.1.1/24.

Now, we're going to connect
this to a real service provider,

and one of the reasons you might be like,
wow, 192.168 that's kind of old school, right?

Instead of like your small environment,
but I wanted to set this up to

where this is something that
you could do at home.

I actually just answered an email from a
student, the previous edition of this series,

this CCNA series, I recommended at the very end

of the series purchasing
an 871W router for a lab.

And let me see if I can pull up a picture.

Here we go.

Now, don't look at the price
and be like oh my goodness.

I mean go on eBay.

This thing hasn't been made for years.

Like it's out of production from Cisco.

I think these vendors are just
trying to rake you over on the price.

You shouldn't pay more than $50 for this router.

But I got an email from a student
saying do you still recommend the 871W,

or do you have something more
recent that you recommend?

And I sat and I thought, you know
what, I still recommend the 871W now

as a great little lab router to use at home.

The reason I say that, and that actually
reminds me I'm going to add a nugget to the end

of this series where I add
some home lab recommendations.

Hang on, I'm just going to write that down.

Okay. So the reason that I recommend
this is because it's small enough

and it has the full IOS for you to play with
that somebody would want to use this at home.

Now, would I recommend getting
a 2800 series or 2900 series

or whatever big, classy brand of router?

I'm like, yeah, sure if you can afford it.

But what I found is people
-- I actually had one student

who said I've bought a whole
lab rack of equipment.

He bought like five or six
different routers and switches.

He just built a whole rack of Cisco
equipment that he used for a lab.

And I said, wow, what are
you going to do with it?

He goes I don't know yet
but I'm going to use it.

And I'm like, ah, because a
lot of times if you build a lab

without a practical scenario behind you,
you end up just making a pile of equipment

that you turn on every now and then.

You're like, oh well, I can type in host name.

But getting one of these little guys allows
you to put it on your shelf and start using it

as your home router which
immediately throws you into the fire.

Because you just took down your
home internet connection, right?

There's motivation.

I want to watch TV.

I mean what doesn't come
over the internet anymore?

So you now have instant motivation and
instant real world situations where, okay,

you want to set up NAT for your house.

You want to set up a subnet.

With this router you can even do VLANS
and set up VLANS inside of your house.

Maybe I want to create a VLAN and
separate my WiFi from my LAN connection

so that I can have a public WiFi
that's secured, ooh secured.

I can create an access list to make sure
that the public WiFi I just set up can't get

into my house and make sure
that -- you see what I mean?

It's just like it starts breeding
these like, ooh, that's cool.

And I can put this on the shelf and it's small.

These guys they're going to make a lot of noise.

[Squealing Noise] And you're like shut that off.

And they're going to be hot,
and they take up a lot of space.

Whereas this you get the full IOS.

I feel like I'm selling it but I'm not.

It's just a lab router.

So the reason that I'm setting this up, and I
want to frame it this way, is I want to set it

up very similar to what one of you guys
might do at home when you're setting this up.

So I'm connecting this to a real
service router, and I'm going to say

at your house you probably
don't have static IP addresses.

You may, great, good for you
and go for it if you can.

But most of the time you're going to set this up
for DHCP to get a dynamic address from the ISP,

so I'll put ISP connection right here.

One more thing let me just fill in.

This is fast ethernet 0/1 right here.

And I think that's about
all the information we need.

Let's get going.

I'm going to bring up my router.

Which I told you I'm going to
set this guy up from scratch.

So I've literally cleared the
configuration off of this router.

Let's see if I squish it and
see everything at the same time.

No, I do not want to enter
the initial config dialogue.

So let's just mentally run
through the checklist.

We're going to have to put a base
configuration on there, assign the IP address,

give it a host name, set some of the console
port settings that we all know and love

like log in synchronous and all that.

We'll have to I would say set up a DHCP scope.

I'm going to allow this guy to be a DHCP server
for the LAN in handing out IP addresses there.

So a little bit to do to start off with.

So I'm going to go into global -- oh, no.

Have you ever done this before.

I think this is the first time
in the series I've done it.

Because I usually turn it off.

This, by the way, if you mistype
something in user mode or privilege mode,

what it's trying to do is
telnet to a device named eb.

So it's trying to resolve eb to an IP address.

If you don't set up your server or your router

for DNS the first command you want
to type is no IP domain-lookup.

And that's what keeps that from happening.

That's painful because you
have to sit there and wait.

A lot of them don't even let you -- you
can abort it by doing control shift 6

and just keep slamming the
keyboard until it finally does that.

But a lot of them won't even let
you do that, you're just stuck.

Alright, so let's get going.

We've got host name.

I'm going to give it the name of NAT.

Let's get into the interfaces.

Well, actually before I do
that let's go line console 0

because what just happened there is
not what I want to happen all the time.

Logging synchronous so those messages
don't interrupt when I'm typing.

No exec-time out.

Let's go into line vty 0 4.

Log in password will be Cisco.

Just giving it some base passwords
and telnet information, okay.

Exit out there.

Let's see, enable secret, password will
be Cisco so we'll put that in there, okay.

Interface fast ethernet at 0/0.

IP address 192.168.1.1 class c, right?

So we're giving that an IP address no shut.

And I get that guy powered up and going.

Exit back out.

Let's go into interface.

Let's go to the ISP connection.

Fast ethernet 0/1.

And we'll do an IP address.

And this is going to be dynamic because
we're connected to the service router.

So we'll say DHCP, we'll negotiate that, DHCP.

It's hanging there just because it's
trying to enable that interface.

We'll do a no shut down as well.

Let's just see if we get anything.

Not yet and that's okay.

I may have to -- if I could type.

I may have to -- oh, look at that,
it's going to say that I'll have

to reboot my cable modem, but I got one.

So we've got a DHCP address that's good.

It looks good to me.

So let's set up DHCP.

If you ever wonder what are these, by
default Cisco routers broadcast to try

and find a config if they don't have one.

If you save you config and give it
some time it will stop those messages.

You can also go into global config
mode and type in no service config,

and most of the time that will work.

There's been sometimes it doesn't work.

It's just an annoyance until
you save your config.

And even a little while after.

So I'm going to go in to set up a DHCP scope so
our client on this LAN can get an IP address.

So we'll do IP DHCP -- you always
when you're setting up a DHCP scope,

I mean the router's handing out IP address to
the LAN, you always say what you don't want

to hand out first, because there's no easy way

of setting a range, like
hand out from here to here.

So I'm going to exclude from
192.168.1.1 to 192.168.1.10.

We'll say those are reserved.

So the first address I'll hand out will be 1.11.

Following so far?

It's fast and furious, right?

IP DHCP pool, and we'll call in LAN,
hit enter, and we will say the network

that I want to hand out is 192.168.1.0.

One of the few commands that
will allow you to say /24,

or you can type in the full
subnet mask if you want to.

DNS server will be let's use 4.2.2.2,
4.2.2.3, my two favorite DNS servers.

And then Google coming in at a far side lash,

just because 8.8.8 is just
tougher to type on a keyboard.

I have to use two hands.

Or not two hands but it's just the period, the
8, for no other reason it's just weird for me

to type 8.8.8 and I can't even say it.

So default, we want a default router.

We want to give the default
router 192.168.1.1 to the clients

on the internal network, and that should be it.

Let's do a quick show run,
let me do a section IP DHCP.

And just verify we've got
excluded address there.

We've got the LAN subnet

there, DNS server, default router.

That looks good, alright.

One of the things that you'll find is when
a Cisco router gets an IP address via DHCP,

if that ISP is assigning it a default gateway,

and it doesn't have a default
router already set up,

a lot of times it will accept the DHCP assigned
default gateway as its own default route.

Essentially it's going to say, oh okay, well, I
don't have a default gateway so I will use you.

And that's nice because it makes it versatile.

You can move your Cisco router
wherever and plug it into a connection.

If it's enabled for DHCP it will pick it up

and then start doing what it does
best which is router and do net.

So at this point I just want
to test and see where we're at.

I'm going to go here and do a ping.

Let's do a ping.

Oh, let's do a show IP interface brief.

We've got 208.92.153.6.

Let's do a show IP route, and I see it's
already set up, a nice little gateway

of last resort because it got that via DHCP.

So let's just do a ping 4.2.2.2.

Let's ee if we can reach the DNS server.

Good, and we do.

So this router now has internet access.

Now, my computer happens to be, the one that I'm
recording on right now, happens to be this guy.

So actually what I need to do
is go into the control panel

because I've got my own connection,

my own network that I save my
recordings and everything like that.

I'm going to actually go in and disable that
one which will not work well when I finish this

because it's going to say where do you want
to save this, and I won't have a place.

Let's get rid of virtual box as well.

It's a little free VM ware kind of thing.

So all that's left is my little
apple USB ethernet is after.

That's what I have connected to SLAV network.

So I'll open a comment prompt
and do an IP config.

And there it is, look at that.

We've already got a dynamic address
assigned from our pool 192.168.1.11.

Let's actually jump back
here and line it all up.

Here, I'll scoot this over a little bit.

I'm going to do a show IP DHCP binding which
shows what IP addresses have been handed out.

We're going back in time man.

So 192.168.1 -- whoa see, that's what
happens when I disconnect my network adapter.

There we go.

So where were we?

Okay, so I've got the 192.168.1.11
that's now assigned.

But let me just see if I can ping from here,
4.2.2.2 even though I've got a default gateway.

The reason for that is because the router
it's got an IP address and it can do routing.

It's got a [inaudible] but
it's not configured for NAT.

So my feeble attempts to
open a web browser will fail

because it will say, sorry, we're not connected.

Let's go to Google.

Let's see if we can get there.

Hold on, secure browsing to Google.

Nope, nothing.

I mean we're just hung.

We're not getting anywhere.

So what we want to do, let's get this browser
out of here, is start configuring NAT.

Basic steps.

Number one.

Let me get back to the white board.

Number one we need to identify our interfaces
meaning we need to go in there and identify

that this one is connected to the inside
of the network like fast ethernet 0/0.

Yeah, this is on the inside of my net.

And fast ethernet at 0/1 that's
on the outside of my net.

I need to identify that.

And the good news is it's
very simple to do this.

Watch this.

It's going to be logical.

Show IP interface brief.

Have you got the feel that I like this command?

So there's my interfaces.

I'm going to go into fast ethernet 0/0.

IP net inside.

Now, you will find out it's common
for it to hang, and don't panic.

Usually when you hang a router
like that something bad is

about to happen, crash or something.

But it's just enabling the
net process behind the scenes.

It's creating these virtual
interfaces that it needs to do NAT.

It's only on the first command.

When I come in here and do fast ethernet
at 0/1 IP net outside is the other command,

you can see that goes through right away.

Okay, good.

Step one is done.

Step two is to identify our inside IP addresses.

So we actually need to be able to say
this inside of our network is going

to be translated to the outside world.

Now, the way I'm going to do that is I'm
going to say essentially anything starting

with 192.168.1.anything/24 is
valid to be translated out.

Now, it just so happens that the way that
I do that is by using an access list.

You see some of those concepts
come wrapping back around.

So here's what I can do.

Let's exist back out.

Now the beauty is for basic NAT configurations
I can use just the standard access list.

I go in there and do IP access
list, and it's going to be standard.

And we'll call this NAT addresses, how's that?

How about we do this because there's
a lot of NAT addresses inside.

That's a long access list
name but we'll go with it.

Inside NAT addresses, okay.

And so I will say permit 192.168.1.0
with a wild card mask of 000255.

I can log it if I want but I don't need to.

And that's it.

That's all there is to it.

Because remember I said access list,
when we were talking about access lists,

they're not just for access control.

In this case I'm going to use this
access list to permit these addresses

and only these addresses to be NAT-ed.

Okay, step three.

We're going to use our IP
NAT connection command.

What I mean by that is I'm going to go in
and say I want to NAT from this to that.

Now, this command can do a lot of stuff for us.

I'm going to show you the first thing right now.

I'm going to NAT -- so first off the
way the syntax works is I type IP NAT,

so I'll translate that into English.

IP NAT means I want a NAT, right?

Now, I hit question mark
and it's like an interview.

I want to NAT from the inside of my network out.

This is going to be a source.

Let me identify the source addresses to you.

So I want to NAT from the
inside of my network out.

The source addresses that are going to
be translated are going to be identified

in access list number -- well
actually not number in this case.

What did I name it?

Inside NAT addresses, right, right there.

Highlight copy.

Yeah, let me back up here.

There we go.

IP NAT. Okay, so I want to NAT
from the inside of my network out.

The source addresses are going to be
identified in access list inside NAT addresses.

So that's the source.

And I'm going to be going to the
destination of, and now we have the option.

We can either go to an interface as
the destination or a pool of addresses.

So here's the idea.

I can either say I just want to take all of
these guys and NAT them out this interface,

or I can create a pool of
addresses which is possible,

and I can say maybe 208.53.91.1-9 is
going to be the pool of addresses.

So I'm going to NAT all of these
guys out to that pool of addresses.

Now, you having that being dynamic
NAT, remember we were talking

in the concepts how dynamic NAT does
that one-to-one mapping if you will.

But then you'd only have nine people able
to get to the internet at the same time.

You don't want that.

So we would usually use PAT
in combination with those.

But in this case the reason the interface
command is so handy is because I don't need

to know what my outside address
is to use that command.

Let me type the command and I'll explain it.

So let me get back here.

Interface fast ethernet 0/1.

I know some of you are like blah, blah, blah.

That's a big command.

It is, it is.

There's a lot to that command.

But let me just read it.

I'll hit the up arrow and
go back to the beginning

of the line and read it again in English.

IP NAT, I want a NAT is what that means.

From the inside of my network out the source
addresses that I want to NAT are identified

by access list inside NAT addresses.

And what's in there?

192.168.1, right?

We said permit those addresses.

So NAT from that source to the destination of
interface, and let me go fast ethernet 0/1 and,

oh, actually I forgot a key word on there.

And I want to add on the key word overload.

Not just L, overload.

So the command just got bigger.

I mean what do you think overload does?

I know you're like, well, it says right
there an overloads an address translation.

What's that mean?

Overload enables PAT.

So when I typed the command the first
time and press enter it would work,

but it would only work for one IP address.

Whoever got there first would
use up the outside address

because it's a one-to-one mapping
if I don't have that keyboard.

But I'm putting overload on there.

That's when it says, oh, you want me to use PAT,

so that way I'll translate addressed
dynamically using port numbers,

and everybody can share the IP address
of whatever is on fast ethernet 0/1.

The beauty of using that command
is I can now use this versatilely.

I can move it to whatever internet
connection I want, plug it in,

and then whatever IP address
is received via DHCP

on that fast ethernet 0/1 will now
be used for all of my NAT settings.

I think, I'm hesitating, I think
that's everything that we need.

Oh, look at that, it's saying I can't change
this, dynamic mappings are already in use.

That's funny.

So let me just do a quick
show run, include IP NAT.

I want to make sure that it took that command.

But all we did is identify inside and
outside interfaces, create an access list

that said these are the inside
addresses, these are the source addresses,

and then we combined them all with
this IP NAT connection command.

And so this is the biggest command
of all, probably the most confusing.

But, again, it's kind of like an access list.

You're just saying I want a NAT, here's
my source, here's my destination,

and in this case we overloaded it.

So I want to test it.

Come on, let's bring up, oh, this
was here before, cbtnuggets, right?

I was like that's not cool.

Woo hoo, it worked.

So, anyhow, I want to make sure it's
not in cache or something like that.

What's a website I haven't gone to?

Let's do USA Today.

I know I haven't gone there.

USA Today, wow, look at that,
Hall of Fame, no one elected.

Bad. So now I can -- okay, the reason I'm
doing this and going to a couple websites,

let me just go to one more,
let's go to amazon.com.

Get a nice little Amazon splash page up there.

The reason I'm going this is I now want to go in
there and do -- let's make this a little bigger,

we'll want it big, do a command to verify.

I'm going to do a show IP NAT translation.

Look at that, yeah.

We've got a massive amount of
translations going through.

Remember in the last nugget when I said, yeah,

theoretically you could share
one IP address for 65,000 people?

This shows exactly why that theory
would never prove true in reality.

Just by going to three websites, count
them, three websites, cbtnuggets,

USA Today and amazon.com, literally
let's just keep the scrolling going.

Okay, I reached the end.

These were all the translations that were built.

First off, you see all these guys?

These are all DNS translations.

Notice, let's read it here, and this is where
I want to get into some of the terminology.

The inside local address
is where I'm coming from.

So let me go to this network
diagram, change pen colors real quick.

According to the router inside local addresses
are those that are inside of the network

like the position they are on your
inside network, and they are local.

You can kind of translate that to be a
private address kind of in your mind.

Now, some of these terms I will tell you before
we even write them all out they are confusing

because they follow the industry standard.

NAT is an RFC standard, and so Cisco
said, okay, we'll follow the naming

that they say in there, but it is confusing.

So inside local means it's inside
my network, like it's mine,

I own it, and it's a private address.

That's the local.

Now, this one, the public address, is
actually identified as the inside global.

Now, that doesn't make sense initially because
you're like, well, inside, no it's outside.

Well, it is, but think of the word
inside of who owns that address.

You just kind of think of it that way.

Like inside means me, outside means
somebody else owns that address.

So when you put it that way it's like
okay, okay I own these addresses inside,

and I own this address because
it's assigned to my router.

Not literally I own it from my service router,

but I own it because it's assigned
to my router so it's inside.

Global essentially means public.

Now, you'll see some other
terms here like outside global.

Outside global is essentially the
IP address of the outside server.

Outside meaning I don't own it,
it belongs to somebody else.

Global meaning it's public.

So when you go to a website that's going
to be how they show up in this table.

So notice all of these.

What's port 53?

And notice the protocol, UDP port 53.

Anyone remember?

Raise your hand.

Yes, you?

>> DNS.

>> DNS, yeah, exactly right.

DNS these are all the DNS lookups that
were necessary to go to three websites.

Now, again, I want to make sure everybody gets
-- you're like this is crazy, why would you need

that many DNS lookups to go to three website?

Remember, again, amazon.com, this
picture right here is one server.

This picture is another server.

This picture another server.

This picture another server.

There's so much stuff on this website.

And every time you introduce another server
like Discover Card, something new in your city,

or it's not even Discover Card,
discover something new in your city,

anytime you go to a new server
it's like, oh well,

that ad right there is actually
fed from AWS9.amazon.local.

blah, blah, blah.

So your computer has to go, well, who is that?

And go do a DNS lookup just
to find out who that's from.

That's why sometimes pages take a while to
load because it's grabbing all this information

from all these different servers.

Okay, so back to the configuration.

So outside global says, okay, I access this
DNS server on port 53 all kinds of stuff.

And notice all these source port
numbers are where it came from.

So let's start putting these pieces together.

Inside local so this is me.

Excuse me, I've got 192.168.1.11.

I generated a DNS request
from the source port 53582.

Now, that was translated to the inside global

or essentially the outside public
IP address of 208.92.153.6.

Now, who's that?

That's my router, remember?

We actually got assigned
that address dynamically.

It was 208.92.153.6.

So that's me.

So what this is saying is I've
translated from this to this.

And notice what it did with the port number.

It actually said, okay, I'm going
to retain your source port number

and now so that's what you
look like to the outside world.

So it went out and talked to this
IP address, the outside global.

Now, I know some of you are
like, well, what's this?

I don't even want to tell you.

Honestly I don't.

But let me just say this.

That is outside local.

You might say, okay, so outside means
it belongs to somebody else, right?

Yup. Local means it's a private address?

Huh? Well, essentially what this means, and
trust me my public, private it's just kind

of a rough analogy, but what this
means is it belongs to somebody else,

but this is how my network sees it.

I will say for 95, 99, 98 percent of you
out there it will always be the same.

Essentially the outside global which is
what it really is will be the outside local

which is how your network sees it.

What you can do, let me give you this
example, and I really don't want to tell you

because it might confuse some,
but I just want to show it to you.

You can do NAT translations the other way.

Here's what I mean.

I could go in here on this router, and I could
say, well, I want to create a NAT translation

that when somebody accesses 192.168.1.52
it actually translates to 4.2.2.2.

Weird, right?

It's doable but very strange.

So what you could do is you could make 4.2.2.2,
we'll just say this DNS server out here,

appear as 192.168.1.52 to the internal network.

In that case if you did that kind of
translation then you would see outside local

at 192.168.1.52, outside global is 4.2.2.2.

So, again, it's kind of like a backwards net.

So if that confuses you forget I ever said it
and just say all these will always be the same,

outside local and outside
global always the same.

Honestly I've done this once, and
it was a whacked out situation

where I couldn't assign a
default gateway to this PC.

So I had to be able to get it to an outside
server, it wasn't even a DNS server,

but an outside server without a default gateway.

And the way I did it was by saying,
okay, I'm going to set up a NAT

so this guy will arp [phonetic] for this,

and it will actually translate
out to the public address.

So that will be where it
actually looks for that server.

So, again, weird situation,
forget I ever said it.

Okay. So all of this -- now let me hit the
up arrow, do a show IP NAT translations.

Look at that, look at that,
that's it right there.

They're all gone.

So all of these initial translations,
[rotating sound],

all of those [rotating sound] all the way
down have now consolidated down to this.

Why? Because the sessions have begun to close.

When I did my DNS lookups they show up in
th table but they quickly go under way,

because I know -- I'm sure many of you are
like, well good grief, if one computer going

to three websites can consume that many
port numbers, I mean look at all that,

can consume that many port
numbers, I mean it's not going

to be long before one public IP address
runs out of port numbers, right?

Well, yeah, but the good news
is they time out very quickly.

After they're used they stay there for a few
seconds longer and then, shoop, they're gone.

So now, just because I have my web browser
open, I still see these that are established,

but for the most part they've all closed down
and consolidated down to a smaller amount.

Okay, so we have the NAT overload
or PAT version of NAT working.

What if, let's change it a little.

I just gave you a scenario that works very well.

That whole config that we
just did works very well for

small office or home office environments.

But what if I do have static IP addresses here?

What if I'm a real business and maybe I have
even a pool of addresses available to me.

What about that situation?

Well, in that circumstances you want to squeeze
in one more command between two and three,

and that will create a pool
of outside addresses.

Here's what I mean.

I can go into the router, and let's
first off do a show run, include IP NAT.

And we want to remove the
existing configuration.

So I'm going to say I just
want to yank this one out.

I'm going to get rid of that command in there.

And it says, hey, you've still
got dynamic mapping, are you sure?

Yeah, sure, that's fine.

So I've got the dynamic mapping
or I should say mappings deleted.

That just means all of the, oop,
now I've done it, cleared it off.

Off of these previous mappings these were
all dynamic, those are all wiped out now

because I deleted the command
so I've removed that.

And now what I can do is create a pool.

So I'll say IP NAT pool, and I'll say, okay,

the pool of addresses let's just say
this is my outside public addresses.

And I would say the start IP address,
and that's why I'd come back here,

let's just say we started from
208.92.153.5, 208.92.153.5,

and we go through 208.92.153.6, right?

So we've got the start and the end.

If we need to add what subnet mask is there for
that subnet we'll say net mask 255.255.255.248,

that's just what the service
provider has given us and hit enter.

So now I've created this pool of
addresses that we call outside public.

It's not doing anything yet, it's just
there until I do IP NAT inside source.

And I'll say this time, again,
the same command as before.

This is the same exact one I just removed.

Inside source.

So I'm going to map from the
inside of my network out.

The source addresses are in access list
number 5, that's the one we created before.

And instead of going out the
interfaces, that was the previous command,

I'm going to go to the pool of address
that is defined as outside public.

So I'm going to say the outside
public pool of addresses,

and then I'm going to add on overload.

Otherwise, now I have more IP addresses, I
have 2, 5 and 6 right there that I can use.

But I'm going to overload them
so I'm going to max this one out.

And once this 5 runs out of port numbers then
I'm going to go over to 6 and max that one out.

So as we start growing and we start
requiring more public IP addresses

that we can overload and share we can do that.

So that would be -- now, this is still PAT.

But if you wanted to do that as dynamic
you would just leave overload off.

Remember dynamic NAT, doing the
dynamic one-to-one mappings.

But then you would only get two people
able to surf the internet at a time

because they would eat up the outside
addresses since we only created a pool of two.

Now, what if you only had one address?

Like same story as before, but
instead of being a DHCP it's static

and we only have one static address.

Well, easy enough, you would do the same
thing but create a pool of just one address.

Just say we're going out at .5.

You can see it starts at .5 and ends at .5.

So we create an outside pool of one address,
that's fine, and then we go in and overload it.

Now, we don't have to redo this command.

Let me just do a quick show run include IP NAT.

We don't need to redo the command.

We can change kind of pieces
of that command out.

Like I can change out this pool, and I don't
have to redo that IP NAT inside source command.

So that's a way to do it if you have
a static IP address on the outside.

Okay. The last one what about
doing a static translation?

So we've seen remember the three
modes of NAT, we have static,

we had dynamic which is dynamically doing
a bunch of -- you get it, dynamic, right?

Hard to talk.

And then we had PAT.

So we've done PAT.

We've even done dynamic which
you saw the config just now,

we would just leave off the overload command.

And then now static.

What if we have servers running
on that inside network that I want

to allow access to from the outside?

That's where you need static NAT mappings.

The way we do this is go into global
and type in IP NAT, again inside source.

So if you get used to this, I mean it's
the same commands over and over and over.

It always starts IP NAT inside source, and then
we either say I want to go to an access list

or see what I see, right, static.

And now we can do it the simple way.

I can say, okay, the inside
local IP address is 192.168.1.51.

We'll say that's our email server, right?

Then it's going to say, okay,
what's the inside global?

Remember the terms I talked about, inside local,

so they're saying inside global
where was that on our picture?

That was the public IP address that belongs
to us that goes to the interface right there.

So it says, okay, this inside local or
private IP address is going to translate to,

and that's where I would type in 208.53.

What was it?

208. I don't even remember.

Oh, okay, I was trying to
figure out what that was.

208.92.153.

let's just say 7, alright,
and hit the enter key.

That's one way of doing it.

That's the simplest way.

So that says any time somebody accesses this
IP address on the outside I will translate it

to this IP address on the inside and vice versa.

I will take this IP address when I
see it on the inside and translate it

to that IP address on the outside.

This is actually a two way
street, a two way translation.

A lot of people say, okay, well now do we have
to create a second one that says 208.92 is here

and 192.168 is here to kind of do both ways?

No. This is a two way street.

So as this one goes out you will always be
that 208.92.153.5 address that I just defined.

And as people come in on that
-- you get the point, right?

I'm like I could fumble over
my words or you got it, right.

So, another way I can do this.

I could do IP NAT inside sources, and you saw
this when I first typed it, so I'll do static.

I could type the inside local IP address,
but I can also specify TCP or UDP.

So this would be useful if I want to
break this into multiple port numbers.

So let me show you.

Let's say I want to do TCP, and I'll
say the inside local address, 192.168.1.

let's say 53, but it's going to be on port 80.

This is a web server.

And I will go on the outside that really goes to
208.92.153.8 on the outside on port 80 as well.

So what this does is say now if I get
-- I'm running out of space to scribble.

Let's use orange.

If I get a request on the outside and it's
directed to 208.92.153.8 on port 80 and only

on port 80, it won't work for any other port
right now, then I will send it to the inside

of my network to the mysterious server
that showed up that is 192.168.1.

what did I say, 53?

Yeah, 53 on port 80, alright?

So I could hit the up arrow.

Let's say this is where I can split this
one IP address to multiple destinations.

I could say, well, maybe if they do 21 which is
FTP I'll send it in on port 21, 192.168.1.67.

That's an FTP server on my network.

Early on, this is long before go to my
PC and log me in and all these things

that let you access your computer from home,
long before that I actually had a router set

up at my house, let's get that orange color
off of there, router set up at my house

that was connected to an ISP, and I
would use Microsoft Remote Desktop.

It's been around for a long time.

And Microsoft Remote Desktop uses TCP port 3389.

And I had actually a bunch of
computers inside of my house

that I would access when I'm the road.

If I'm traveling or if I'm at the office
or something like that I could actually sit

out here and use Microsoft Remote Desktop.

You know what I mean when I'm
talking about Remote Desktop, right?

You go to all programs.

Of course, you can't see it.

How about you just do start
run, you actually type in MSTSC.

And that will bring up a remote desktop
connection to where I can type in I want to go

to this computer home.jeremy
or whatever the computer is.

And I can open a remote screen.

So I would sit out here and remote to my
computer because I would map port 3389

into my main PC which was actually
172.30.1.50 was my main PC IP address.

But the problem is now I've
eaten up that port number 3389.

On the outside it's eaten up.

So I wanted to remote desktop
to these guys as well.

What I would do is I would play this game.

I would say, okay, well I want to actually
map 3389 to let's just say 1.67.3389,

and then I would say I want to
actually map 3390 to the inside,

let's just say this is the
second IP address right there.

Let me get that all on the screen.

It's not quite fitting.

But you see what I'm doing here.

I would say 3390

on the outside actually translates
to 3389 on the inside.

Now, whenever I would be somewhere I
would say I want to go to jeremy.home.com

or whatever my domain -- I actually use
the dynamic DNS service and all that.

And if I wanted to connect to my main
computer I would just hit enter and connect.

If I wanted to connect to a secondary
computer I would put colon 3390.

You can do that, and it will say okay,
well, I'll use port 3390 which now hits this

and translates to a completely
different computer.

And then I did the same thing for the third
computer, 3391, and I would come over here

and map 3391 to whatever, 192.168.1.5 on 3389.

And that would work out perfectly well.

So it's saying if it receive it on this port

on the outside I'll actually
translate it to this port on the side.

So there's a lot of cool stuff that you can do.

You can either statically translate
the whole IP address in and out,

or you can statically translate port
numbers and even change port numbers

when you're translating in and out.

Okay, so we have now seen
the three flavors or NAT.

This was my only slide for this because
we're so into the live configuration.

Obviously with all the scribbles on the
screen you can see it builds on itself.

But we've seen configuring PAT, sending
it to go out to a specific interface

or to a specific pool of addresses.

Configuring dynamic NAT from one
pool of addresses to another.

And then we saw it configuring static
mappings from either a whole IP address

or individual ports on an IP
address into different servers.

So by the time you're done now you should
be able to go out and configure NAT for just

about any environment that you can encounter.

I wasn't hiding anything.

You've now seen all the flavors
of NAT that exist.

I hope this has been informative for you,
and I'd like to thank you for viewing.