This is one of multiple videos discussing net or network address translation.
This is a troubleshooting video.
We've been told that some hosts in the internal network are not able to access Google.com.
In this example, the company is using Google's DNS server for name resolution.
The server's IP address is 8.8.8.8, which is found on the Internet in this topology.
I'm using Genesis three to simulate this environment.
Rather two is the broader that is configured for network address translation.
We've got three routers acting as hosts in our internal network and one router acting as an Internet
server.
So let's verify what we've been told.
On Rata one.
Which is acting as the piece on the top left.
Can we ping?
8.8.82.8?
Yes, we can.
Now what about rather five acting as our third PC?
Can that ping google.
Doesn't look like it can.
Debug ip packet.
It's definitely sending the packet.
So it's sending it somewhere.
Show IP route.
This router has a default gateway to tend .1232254.
It's going to send it to router two
to speed up.
Trace.
Right, I'll do that.
And then let's see how far it gets.
On all that first try again.
So it gets to 10.1, two, 3.2, five, four, and then it seems to die.
So it's sending the packet.
But not getting a response.
Okay.
So it looks like there's a problem with Nat on router to the Nat Rada.
So in order to let's have a look, the first thing we'll do on router two is debug IP.
Nat, be careful doing these kind of bugs.
In the real world.
You may get a lot of traffic in a production network and overwhelm the rudder.
But because this is a lab, we can do that.
So I'll send one ping and see if anything happens with the net translations.
Doesn't look like Nat's doing anything.
If rather one.
Sends a packet.
Notice rather one gets translated.
So rather one is the PC at the top.
When it sends a ping, traffic is netted.
So there the ping failed, but here we got a reply.
That's because of ARP.
So notice there's the source traffic being knackered and he has a reply.
But if we send traffic from.
PC five acting as our third host.
In other words, this host.
It looks like gnat doesn't take place.
In other words, it's not translating the address.
Show IP Nat translation these translations are all relating to host one.
They are dynamic nat translations, so they will expire after a period of time.
So we've already got one that expires, but there's no entries for root of five acting as our third
PC.
And yeah, you can see all the translations have expired.
So let's have a look at our net configuration.
For this host to be translated, this interface needs to be configured as an inside interface, and
this interface needs to be configured as an outside interface.
Now we've already got some hosts working, so that makes the job easier.
So we can scroll through the configuration.
Here's gigabit zero zero.
So that's the host of the top here, IP.
And inside, that looks good.
Gigabit zero one is the outside interface and it's configured for IP net outside.
That's good.
Gigabit zero two.
This device is also working.
Configured for IP Nat inside.
This is the interface where we have the problem, but it's also configured for IP Nat inside so it doesn't
look like that's the problem.
Scrolling down we see the net statement IP Nat inside source list one.
So this is using access list one and we are overloading gigabit zero one.
Now, can you see the problem?
What's the problem in this output?
Notice it's referencing access list one access list one has a permit statement of 10.1 and 1.0 slash
24, ten 1 to 0, and then a ten 100.
This is an inverse mask because it's an access list.
A zero means match, a one in binary means don't match.
So here we have a problem because the zero is matching ten.
This era is matching one and this zero is matching zero.
Traffic is coming from ten 1.3.3.
So it's not being matched by the success list.
So we could remove the entire access list and re-edit it or delete that individual line.
But I'm simply going to say permit ten 130 with the correct mosque.
So we've got an extra entry in our access list.
So show access list one year or our access list entries on write a five will do a ping.
Notice it now succeeded.
That host was netted because of this entry.
Notice we got one match.
Do that again.
Two matches.
And notice here we see the actual net translation taking place.
So be careful with your access lists.
This was an example of a dynamic net entry.
Referencing Access List one.
So we had a problem in our access list where this entry was incorrectly configured.
Notice the sequence numbers.
So what we could do is say IP access list standard one No.
30.
Show IP access list.
So line 30 has been removed.
And we've only got the correct entries in our access list.
So the ping works.
There was the net.
And we've got another match on the access list.
So we've now solved the problem.
These hosts can ping the Internet.
Let's verify that.
So right.
A one can ping Google root of four, which is this PC can ping Google.
And rather five can also ping Google.
So we've successfully solved the problem.
We verified it.
Don't forget, as always, in the real world or in your lab to save your configuration.
And don't forget to turn off your bugs.
They slow riders down typically, and increase CPU utilization.
It's not a good idea to keep them running.
So in this lab we solved a network address translation issue.
If you enjoyed this video, please like it and please subscribe to my YouTube channel.
I wish you all the very best.