This is one of multiple videos where I discuss net or network address translation.
In this video, I'm answering a question from Pedro, who's attending my June three Q&A course.
The link to the course can be found below this video.
Pedro, thanks for the question.
Here's the answer.
In this Janus three topology.
I have three Cisco iOS routers acting as servers.
I also have a Cisco iOS router acting as a PC and will configure a fifth Cisco iOS router with NET to
allow the client to access the three servers on the internal network.
Now all I've done here is configure IP addresses on the devices.
I've also configured a default gateway on the servers to point to the net router, but the client router
has no routing enabled.
So here is router three acting as the client show IP route shows us that there are no rats in the routing
table except connected and local routes.
No gateway of last resort to set.
There's no default drought, no routing protocols such as OSPF, BGP or AJP or enabled on this router.
So if we run a debug IP packet and then try and ping one of the internal servers, this is rather one.
Acting as our first server.
What we told is that the packet is unreadable.
The router doesn't know how to get to this destination network.
The same is true for any of the other server IP addresses.
The PC doesn't know how to get there because there is no routing enabled and it has no route to server
one, server two or server three.
Rather one acting as server one is configured with the default route pointing to rather two which is
acting as the net rather.
It could, as an example, try and ping.
RADA three.
Acting as the PC.
And you'll notice that the traffic hits the router, but it doesn't know how to return the traffic back
to the server.
So there's a 0% success rate.
In other words, this server.
Sends the traffic to its default gateway, which is this router who routes the traffic onto this segment.
It hits this PC, but the PC doesn't know how to get back again.
Now, typically, RFC 1918 addresses are not readable on the Internet.
Because Internet routers will block traffic sent from those IP addresses.
So what we need to do is configure Nat on this router to allow this PC to access the servers and to
allow their traffic to be netted when going on to the outside or the internet.
So let's configure rather to with Nat.
Okay.
So this is rather to.
Which is our net rather show IP interface brief shows us the IP addresses configured on this router.
Gigabit there is configured with an IP address in the 8 to 8.8 range.
That is a public IP address used by level three.
So here we pretending that that interface is the outside or the internet facing interface on this router
gigabit is 0002 and zero three are using RFC 1918 addresses.
In other words, private IP addresses non ratable on the internet.
So what I'll do is configure.
Gigabit.
Zero one.
As a net outside interface.
In this example, I'm using an iOS V router, so we saw a CPU hog message.
But the writers come back now.
So I'm using a 15.62 version of iOS V interface gigabit zero zero IP Nat Inside Interface Gigabit zero
two IP Nat Inside Interface Gigabit zero three IP Nat Inside.
We have to tell the router which interfaces are on the inside.
In other words, internal networks and which interfaces are on the outside or internet facing.
So what we've done thus far.
Is configure.
Gigabit.
Zero zero as an inside NAT interface gigabit.
Zero one is outside.
And Gigabit zero two and zero three are inside net interfaces.
Now we can use the command IP.
Nat.
What are we going to net?
In this example, we're going to net inside addresses.
In other words, we are netting addresses for hosts on the inside of our network.
Think of the term inside as belonging to an insider, someone who's inside your organization.
I'm an outsider, so I'm on the outside of your organization.
You work for a company.
Perhaps you are an insider in that company.
I, on the other hand, am an outsider to your company.
So an inside host is an insider and they have addresses on the local area network.
So I'll talk about some terms in a moment.
But a local inside address is an address of this host found on the local land.
In other words, an inside local address is a insiders IP address when found on the local land and inside
global address is an IP address that belongs to this inside host found on the global internet.
In this example, we want to net an inside host address.
In other words, an address that belongs to a host on the inside of our network.
In other words, internal to our network, we're going to net the source IP address of that internal
host.
And in this example, we want to use a static net entry because we want devices from the Internet to
be able to initiate sessions to this host.
So we asked for the inside local IP address.
This is the real IP address of the host.
This host is on the inside of our network and it's connected to the local area network.
So the inside or local IP address is the physical IP address of that device on the local area network.
Now what are we going to net the address to?
In this example, I'm going to net it to 8.82 to 8.1.
That IP address does not exist in the network.
So going on to Rada three, which is acting as our PC in this topology at the moment, it's not able
to ping 88281 because that address doesn't exist.
Notice we're getting encapsulation failed.
Show up.
We're getting an incomplete up entry for that host.
The PC is not able to discover 8282281, and that's because it doesn't exist.
We're going to create this virtual IP address for that host.
Now I'm going to use extendable to complete the net translation.
So going back onto roster three.
Are we able to ping that address?
Yes, we are.
Let me just start.
Stop the debug previously.
We couldn't ping this address.
We had encapsulation failed.
The OP was incomplete, but after we created the net entry, we could ping 8.8 to 8.1.
So let's do that again.
And what I'll do is run up debug on the server.
So this is sort of a one.
Debug IP ICMP.
I'll do a single ping from router three, which is acting as our PC.
And what you can see here is a source of 10.1.
1.1 sent a reply to 8282281.
But.
The Internet device doesn't know that it's talking to 10.10, 10.1, because the address is being noted.
The Internet PC thinks it's talking to 828281.
And that's because show IP net translation shows us on router to the net router that 8282881 is being
translated to ten .1.1.1.
This is the inside of local address.
This is the actual physical address of this PC, as we can see here.
Here's the address.
This is the inside global address.
In other words, this is the netted address of that PC.
This is the address of that PC.
When traffic is sent onto the internet.
I hope you've found the video useful.
If you enjoyed it, please like it and please subscribe to my YouTube channel.
I wish you all the very best.