How to configure Cisco NAT ? Configure step-by-step
Hello everyone. Today we will talk about how to configure Cisco NAT. What is NAT and why is it needed at all since this functionality has long and tightly entered our everyday lives and now it is very difficult to imagine at least one enterprise that would not use this technology? At one time, she saved the Internet and greatly delayed the transition from IPv4 to IPv6, but first things first.
What is NAT?
NAT ( Network Address Translation ) is a network address translation mechanism. If simple, it is a technology that allows a bunch of private or gray IP addresses to sit behind one white IP address. An example is the office Internet, where all users sit through a common gateway, on which an ip address is configured that goes to the Internet, and users have local ip addresses configured.
It looks approximately like this.
- Static NAT-converting gray IP to white, an example of port forwarding to a local network, for example, RDP
- Dynamic NAT-transformation of gray ip into one of the ip addresses of a group of white ip addresses
- Overloaded NAT, or as it is also called, PAT (port address translation), converts several gray ip addresses to white, giving them different ports.
Today we will look at static NAT and PAT.
Configure Cisco NAT
This is what a small office layout looks like. We have 3 computers in vlan 2. There is a server in a separate vlan 3. All this stuff is connected to a Cisco 2660 second-level switch, which in turn is plugged into a Cisco 1841 router that routes local traffic between vlan 2 and 3.
Configuration of the Cisco 2960
Let’s create vlan 2 and vlan 3, give them names, and configure the necessary ports for these vlans.
- enable
- conf t
- create vlan 2
- vlan 2
- name VLAN2
- exit
- create vlan 3
- vlan 3
- name VLAN3
- exit put
- ports in vlan2
- int range fa0/1-3
- switchport mode access
- switchport access vlan 2
- exit
- put port in vlan3
- int fa 0/4
- switchport mode access
- switchport access vlan 3
- exit
now configure fa 0/5 as a trunk port
switchport mode trunk
switchport trunk allowed vlan 2.3
do wr mem
Next, we configure the Cisco 1841 router.
Cisco 1841 Configuration
First of all, let’s create sub interfaces and raise the port.
enable
conf t
int fa0/0
no shutdown
exit
int fa0/0.2
encapsulation dot1Q 2
ip address 192.168.2.251 255.255.255.0
no shutdown
exit
int fa0/0.3
encapsulation dot1Q 3
ip address 192.168.3.251 255.255.255.0
no shutdown
exit
ip routing
As a result, the port turned green
PAT setup
In my virtual infrastructure, unfortunately, our scheme cannot be released to the Internet, we emulate it, we will have a router with a white ip address and a server also with a white ip address. Schematically, it looks like this. On the provider’s router, a white ip address 213.235.1.1 and a netmask 255.255.255.252 are assigned on a specific port
Let’s configure this ip on our test provider router.
conf t
int fa0/0
ip address 213.235.1.1 255.255.255.252
no shutdown
exit
- int fa0/1
- ip address 213.235.1.25 255.255.255.252
- no shutdown
- exit
My server will have an ip address of 213.235.1.26 and the gateway will be 213.235.1.25, the router interface of the provider looking at the server.
Now we will configure our local router Router0, configure the white ip address allocated to us by the provider 213.235.1.2 255.255.255.252, the gateway will be 213.235.1.1
conf t
int fa0/1
ip address 213.235.1.2 255.255.255.252
no shutdown
exit
ip route 0.0.0.0 0.0.0.0 213.235.1.1
exit
wr mem
We try to ping the ip addresses of the provider and server from the office router, and we see that everything works fine.
Router#ping 213.235.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 213.235.1.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 0/0/0 ms
Router#ping 213.235.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 213.235.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 0/0/1 ms
Router#ping 213.235.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 213.235.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 0/9/17 ms
Router#ping 213.235.1.25
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 213.235.1.25, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 0/0/0 ms
Router#ping 213.235.1.26
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 213.235.1.26, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 0/0/0 ms
Well, the nating itself. On the local router, do the following. Now we need to set which nat interface will be considered external and which internal, everything will simply be external where the white ip address of the provider is configured, internal is what is connected to the second level switch. fa0/1 will be external and the two sub interfaces will be internal.
conf t
int fa0/1
ip nat outside
exit
int fa0/0.2
ip nat inside
int fa0/0.3
ip nat inside
exit
Customizing the Access List
Access List a list of which traffic needs to be natted and which should work without NAT.
Create an access list named NAT
ip access-list standard NAT
Allow two pools
permit 192.168.2.0 0.0.0.255
permit 192.168.3.0 0.0.0.255
exit
0.0.0.255 is Wildcard bits
as you can see, we have an access list in the config and the ports are marked which are outside and which are inside.
And we enter another magic command, where it says that the traffic that came to fa0 / 1 needs to be natted according to the NAT rule. As a result, we configured PAT.
Save all do wr mem
check the availability of external resources from a local network computer. Let’s look at the current configurations with the ipconfig command, see the ip address 192.168.2.1, ping 213.235.1.26, as you can see everything is OK and NAT cisco is working.
You can view nating packages with the command
It can be seen that ping packets from the local gray ip on ports 12,13,14,15 were sent from the external white ip, on the same ports.
This is how PAT (Port Address Translation) is configured
you can Configure Cisco NAT like this