6.6.7 Packet Tracer - Configure PAT (Instructor Version)
Instructor Note: Red font color or gray highlights indicate text that appears in the instructor copy only.
Objectives
- Part 1: Configure Dynamic NAT with Overload
- Part 2: Verify Dynamic NAT with Overload Implementation
- Part 3: Configure PAT using an Interface
- Part 4: Verify PAT Interface Implementation
Part 1: Configure Dynamic NAT with Overload
Step 1: Configure traffic that will be permitted.
On R1, configure one statement for ACL 1 to permit any address belonging to 172.16.0.0/16.
R1(config)# access-list 1 permit 172.16.0.0 0.0.255.255
Step 2: Configure a pool of address for NAT.
Configure R1 with a NAT pool that uses the two useable addresses in the 209.165.200.232/30 address space.
R1(config)# ip nat pool ANY_POOL_NAME 209.165.200.233 209.165.200.234 netmask 255.255.255.252
Step 3: Associate ACL 1 with the NAT pool and allow addresses to be reused.
R1(config)# ip nat inside source list 1 pool ANY_POOL_NAME overload
Step 4: Configure the NAT interfaces.
Configure R1 interfaces with the appropriate inside and outside NAT commands.
R1(config)# interface s0/1/0 R1(config-if)# ip nat outside R1(config-if)# interface g0/0/0 R1(config-if)# ip nat inside R1(config-if)# interface g0/0/1 R1(config-if)# ip nat inside
Part 2: Verify Dynamic NAT with Overload Implementation
Step 1: Access services across the internet.
From the web browser of each of the PCs that use R1 as their gateway (PC1, L1, PC2, and L2), access the web page for Server1.
Were all connections successful?
Yes
Step 2: View NAT translations.
View the NAT translations on R1.
R1# show ip nat translations
Notice that all four devices were able to communicate, and they are using just one address out of the pool. PAT will continue to use the same address until it runs out of port numbers to associate with the translation. Once that occurs, the next address in the pool will be used. While the theoretical limit would be 65,536 since the port number field is a 16 bit number, the device would likely run out of memory before that limit would be reached.
Part 3: Configure PAT using an Interface
Step 1: Configure traffic that will be permitted.
On R2, configure one statement for ACL 2 to permit any address belonging to 172.17.0.0/16.
R2(config)# access-list 2 permit 172.17.0.0 0.0.255.255
Step 2: Associate ACL 2 with the NAT interface and allow addresses to be reused.
Enter the R2 NAT statement to use the interface connected to the internet and provide translations for all internal devices.
R2(config)# ip nat inside source list 2 interface s0/1/1 overload
Step 3: Configure the NAT interfaces.
Configure R2 interfaces with the appropriate inside and outside NAT commands.
R2(config)# interface s0/1/1 R2(config-if)# ip nat outside R2(config-if)# interface g0/0/0 R2(config-if)# ip nat inside R2(config-if)# interface g0/0/1 R2(config-if)# ip nat inside
Part 4: Verify PAT Interface Implementation
Step 1: Access services across the internet.
From the web browser of each of the PCs that use R2 as their gateway (PC3, L3, PC4, and L4), access the web page for Server1.
Were all connections successful?
Yes
Step 2: View NAT translations.
View the NAT translations on R2.
R2# show ip nat translations
Step 3: Compare NAT statistics on R1 and R2.
Compare the NAT statistics on the two devices.
R1# show ip nat statistics R2# show ip nat statistics
Why doesn’t R2 list any dynamic mappings?
R1 lists dynamic mappings for the pool of addresses that has been configured. R2 is only using the outside interface as the address to translate internal addresses to so there is no dynamic mapping.
R1#show ip nat statistics
Total translations: 4 (0 static, 4 dynamic, 4 extended)
Outside Interfaces: Serial0/1/0
Inside Interfaces: GigabitEthernet0/0/0 , GigabitEthernet0/0/1
Hits: 29 Misses: 4
Expired translations: 0
Dynamic mappings:
-- Inside Source
access-list 1 pool DYNAMIC refCount 4
pool DYNAMIC: netmask 255.255.255.252
start 209.165.200.233 end 209.165.200.234
type generic, total addresses 2 , allocated 1 (50%), misses 0Device Configs - Final
Router R1
! ============================================================== !--- 6.6.7 Packet Tracer - Configure PAT !--- ANSWER SCRIPT FOR ROUTER R1 (PAT with a Pool) !--- Usage: from the console (or CLI tab) on R1, enter privileged EXEC mode with "enable", !--- then paste this whole file. Every line beginning with "!" is a comment; IOS ignores it. !--- R1's two LANs (172.16.10.0/24 and 172.16.11.0/24) share R1's small 2-address public !--- pool (209.165.200.233-234) via PAT/overload - many internal hosts, few public !--- addresses, distinguished by port number rather than address alone. ! ============================================================== enable configure terminal ! -------------------------------------------------------------- !--- Part 1, Step 1: traffic eligible for translation - anything sourced from R1's own !--- 172.16.0.0/16 space (covers both of R1's LANs). ! -------------------------------------------------------------- access-list 1 permit 172.16.0.0 0.0.255.255 ! -------------------------------------------------------------- !--- Part 1, Step 2: the 2 usable addresses in the 209.165.200.232/30 WAN block. ! -------------------------------------------------------------- ip nat pool DYNAMIC 209.165.200.233 209.165.200.234 netmask 255.255.255.252 ! -------------------------------------------------------------- !--- Part 1, Step 3: "overload" is what makes this PAT rather than plain dynamic NAT - !--- multiple inside hosts can share the same pool address simultaneously, distinguished by !--- port number. ! -------------------------------------------------------------- ip nat inside source list 1 pool DYNAMIC overload ! -------------------------------------------------------------- !--- Part 1, Step 4: mark both LANs "inside" and the internet-facing serial link "outside". ! -------------------------------------------------------------- interface Serial0/1/0 ip nat outside exit interface GigabitEthernet0/0/0 ip nat inside exit interface GigabitEthernet0/0/1 ip nat inside end ! ============================================================== !--- Verification (from R1, PC1, L1, PC2, L2): !--- PC1, L1, PC2, L2 > browse to Server1 (209.165.201.5) -> all four succeed !--- R1# show ip nat translations -> all four hosts show up translated to the SAME single !--- pool address, each row distinguished by a different translated port number !--- R1# show ip nat statistics -> !--- Total translations: 4 (0 static, 4 dynamic, 4 extended) !--- Outside Interfaces: Serial0/1/0 !--- Inside Interfaces: GigabitEthernet0/0/0 , GigabitEthernet0/0/1 !--- Hits: 29 Misses: 4 !--- Expired translations: 0 !--- Dynamic mappings: !--- -- Inside Source !--- access-list 1 pool DYNAMIC refCount 4 !--- pool DYNAMIC: netmask 255.255.255.252 !--- start 209.165.200.233 end 209.165.200.234 !--- type generic, total addresses 2 , allocated 1 (50%), misses 0 ! ==============================================================
Router R2
! ============================================================== !--- 6.6.7 Packet Tracer - Configure PAT !--- ANSWER SCRIPT FOR ROUTER R2 (PAT using an Interface) !--- Usage: from the console (or CLI tab) on R2, enter privileged EXEC mode with "enable", !--- then paste this whole file. Every line beginning with "!" is a comment; IOS ignores it. !--- R2's two LANs (172.17.10.0/24 and 172.17.11.0/24) share R2's own single WAN interface !--- address (209.165.202.x on S0/1/1) via PAT/overload - no separate pool needed, since the !--- interface's own address IS the one public address everyone overloads onto. ! ============================================================== enable configure terminal ! -------------------------------------------------------------- !--- Part 3, Step 1: traffic eligible for translation - anything sourced from R2's own !--- 172.17.0.0/16 space (covers both of R2's LANs). ! -------------------------------------------------------------- access-list 2 permit 172.17.0.0 0.0.255.255 ! -------------------------------------------------------------- !--- Part 3, Step 2: "interface s0/1/1" here means "use whatever address is currently !--- configured on this interface" rather than a separate pool - simpler to maintain if that !--- address ever changes (e.g. via DHCP from the ISP), since there's nothing else to update. ! -------------------------------------------------------------- ip nat inside source list 2 interface Serial0/1/1 overload ! -------------------------------------------------------------- !--- Part 3, Step 3: mark both LANs "inside" and the internet-facing serial link "outside". ! -------------------------------------------------------------- interface Serial0/1/1 ip nat outside exit interface GigabitEthernet0/0/0 ip nat inside exit interface GigabitEthernet0/0/1 ip nat inside end ! ============================================================== !--- Verification (from R2, PC3, L3, PC4, L4): !--- PC3, L3, PC4, L4 > browse to Server1 (209.165.201.5) -> all four succeed !--- R2# show ip nat translations -> all four hosts translated to R2's own S0/1/1 address, !--- each distinguished by a different translated port !--- R2# show ip nat statistics -> NO "Dynamic mappings" section at all (unlike R1) - !--- because this command references the outside interface's own address directly rather !--- than a separate pool, there's no pool object to report statistics on ! ==============================================================
Download Packet Tracer (.pka) file:
Previous Lab
6.5.6 Packet Tracer – Configure Dynamic NAT
