6.5.6 Packet Tracer - Configure Dynamic NAT (Answers)

R2(config)# access-list 1 permit 172.16.0.0 0.0.255.255

R2(config)# ip nat pool ANY_POOL_NAME 209.165.200.229 209.165.200.230 netmask 255.255.255.252

R2(config)# ip nat inside source list 1 pool ANY_POOL_NAME

R2(config)# interface s0/0/0
R2(config-if)# ip nat outside
R2(config-if)# interface s0/0/1
R2(config-if)# ip nat inside

R2# show ip nat translations

! ==============================================================
!--- 6.5.6 Packet Tracer - Configure Dynamic NAT
!--- ANSWER SCRIPT FOR ROUTER R2
!--- Usage: from the console (or CLI tab) on R2, enter privileged EXEC mode with "enable",
!--- then paste this whole file. Every line beginning with "!" is a comment; IOS ignores it.
!--- R2 sits between the internal network (reached via R1 on S0/0/1: LANs 172.16.10.0/24 and
!--- 172.16.11.0/24, plus the 172.16.1.0/30 transit link itself) and the Internet (on S0/0/0).
!--- R1 needs no changes - only R2, the NAT boundary router, is configured in this lab.
! ==============================================================

enable
configure terminal

! --------------------------------------------------------------
!--- Part 1, Step 1: ACL 1 defines which traffic is eligible for translation - any source
!--- address anywhere in 172.16.0.0/16 (covers both internal LANs and the transit link).
! --------------------------------------------------------------
access-list 1 permit 172.16.0.0 0.0.255.255

! --------------------------------------------------------------
!--- Part 1, Step 2: NAT pool with only 2 public addresses, even though there are 3 internal
!--- networks that could source traffic - by design, only 2 simultaneous translations are
!--- possible until one times out and frees an address for a new device.
! --------------------------------------------------------------
ip nat pool ANY_POOL_NAME 209.165.200.229 209.165.200.230 netmask 255.255.255.252

! --------------------------------------------------------------
!--- Part 1, Step 3: Bind ACL 1's matched traffic to this pool for translation.
! --------------------------------------------------------------
ip nat inside source list 1 pool ANY_POOL_NAME

! --------------------------------------------------------------
!--- Part 1, Step 4: Mark the Internet-facing interface "outside" and the R1-facing
!--- (internal) interface "inside" - NAT only translates traffic crossing between the two.
! --------------------------------------------------------------
interface Serial0/0/0
 ip nat outside
exit

interface Serial0/0/1
 ip nat inside

end

! ==============================================================
!--- Verification (from R2, L1, PC1, PC2):
!---   L1, PC1, or PC2 > browse to Server1 (209.165.201.5) -> succeeds
!---   R2# show ip nat translations -> shows the internal source address (172.16.10.x or
!---   172.16.11.x) translated to one of the pool addresses (209.165.200.229 or .230)
!---   If a 3rd device tries to get online while both pool addresses are already in use, it
!---   is denied access until an existing translation times out and frees one up
! ==============================================================