So let's look at a demonstration of static NAT, in this example, I have three routers, router 1, router
2 and router 3, router 1 is connected to router
2 using network 10.1.1.0/24.
This will represent the outside network.
Router 2 in turn is connected to Router 3 using 8.0.0.0/24.
This will represent the outside network.
Network 8 is owned by Level 3 communications.
This is one of a range of /8 public IP addresses.
Others include 12 for AT&T, 17 for Apple and 19 for Ford.
So for our demonstration, we'll pretend that this is the Internet or outside network.
All I've done on these routers is configure IP addresses and a static route on router 1.
So on Router 1 show run interface F0/0, you can see the IP address and show IP route
shows me that that network is directly connected to FastEthernet 0/0 and Router
1 has a static default route to Router 2.
Router 3, however, does not have routing.
I've configured an IP address on the FastEthernet interface
but show IP route shows us that there is no default route.
There are no IP protocols running on this router, it only has this IP address configured on FastEthernet
00, router 2 in turn has
10.1.1.2 configured on FastEthernet 00 and 8.1.1.1 configured on FastEthernet 01.
It also has no static routes
and no routing protocols enabled, all it has is an IP address on this interface and an IP address on
this interface. At the moment, Router 3 is not able to ping Router
1, notice the pings are timing out.
If we use the command debug IP packet
and ping that address again, we can see that the traffic is unroutable, router 3 doesn't know
how to get to 10.1.1.1.
I'll turn the debug off, it can, however, get to a triple one, in other words Router 2, so Router
3 can ping router 2 but is not able to ping Router 1. So on Router 1.
I'll do it debug IP ICMP so we can see when traffic does arrive on that.
So once we do our ping tests, we'll be able to see the output on Router
1 show IP NAT translation's shows me that on Router 2, no NAThas been enabled.
There are no translations at the moment.
So CONFT interface F 0/1 IP NAT outside.
This is going to be outside network on Router 2, you need to tell the router which interfaces are
inside and which interfaces outside.
In this example, I'm using GNS3, so it's taking a while to bring up NAT
but there we go.
On the inside interface, we need to configure IP NAT inside, and now that we configuring static NAT,
we use the common IP NAT.
We have a few options we can do NAT of inside hosts or NAT of outside hosts.
In our example, we want to NAT this IP address, which is an insider, inside host
ao I'm going to specify inside. We're going to NAT, the source IP address of packets, not the destination.
So when traffic gets sent from R1 to R3, the source IP address is going to be natted
and not the destination IP address.
We could use a list, a route map or static in our example, we want to use static, we want to specify
a static local to global mapping.
So on Cisco devices, the first IP address that you're going to configure is the actual IP address of
a device.
So in my example, this is the actual IP address of this host, some specifying that.
So I need to specify source.
I then have a few options, I can specify the IP address and protocols in my example, I want to NAT
IP address 10.1.1.1, which is the actual IP address of this device.
All IP traffic is going to be natted.
You can specify that only TCP or UDP traffic is natted, but in our example we are specifying
that all IP traffic is needed.
More complex examples are not necessary for the CCNA, but I will demonstrate them just to make sure
that you understand those options.
Here we are simply doing a one to one mapping of an IP address.
We then need to specify the global IP address or an interface, so in my example, I'm just going to
pick an IP address in this range 8.1.1.
So I'm simply going to choose 8.1.1.5.
That address is not physically configured anyway.
We can specify various options, but I'm simply going to use carriage return to create to the NAT entry.
So now when I type show IP NAT Translations, we can see that the inside local address.
So the physical PC on the inside network went on.
The local area network has this IP address inside local IP address on the LAN.
So logically, we are saying that this is our land or local area network.
And this is the Internet in our example, so global Internet.
So this hosts IP address on the global Internet will appear as follows.
So on Router 3,
Can we ping 10.1.1.1?
No we can't, we can't ping that address at the moment because this device has no route to get to this
IP address.
However, can it ping 8.1.1.5?
Took it a while, but notice the ping started succeeding and on Router 1, we see the echo reply from
a source of 10.1.1.1 to a destination of 8.1.1.2.
Router 1 is replying using this address.
But what is Router 3 actually think it's pinging?
So let's do a debug IP ICMP on the site
and ping, 8.1.1.5.
Notice it's receiving traffic from 8.1.1.5
but router 1 is actually sending it from 10.1.1.1, So from router 3s point of view, the
destination IP address is 8.1.1.5.
That gets translated to 10.1.1.1 hits this router and it replies with a source IP address of 10.
1.1.1.
When it hits router 2, it's translated to 8.1.1.5 and forwarded to router 3.