This is one of multiple videos where I discuss not on network address translation in this video answering
a question from Pedro who's attending my Jeana's three CCN a course the link to the Course can be found
below.
This video
Pedros Thanks for the question.
Here's the answer in this genius three typology.
I have three Cisco Iowas routers acting in service.
I also have a Cisco Iowas router acting as a PC and will configure a fifth Cisco Iowas a Virata with
Nat to allow the client to access their three servers on the internal network.
Now all I've done here is configure IP addresses on the devices.
I've also configured a default gateway on the servers to point to the router but the client router has
no routing enabled so here is router 3 acting as a client show IP ROFFT shows us that they are no rants
in the writing table except connected and local routes.
No gateway of last resort is set.
There's no default draft no routing protocols such as OSPF BGP or Jappy are enabled on the router.
So if we run a debug IP packet and then try and ping one of the internal servers this is Rodda one acting
as our first server.
What we're told is that the packet is unreadable the rodded doesn't know how to get to the destination
network.
The same is true for any of the other server IP addresses.
The PC doesn't know how to get there because there is no routing enabled and it has no route to serve
a 1 7 2 0 7 3 router 1 acting as server 1 is configured with a default route pointing to Ratatouille
which is acting as the next router.
It could as an example try and ping WATERSTREET acting as the PC and you'll notice that the traffic
hits the road.
But it doesn't know how to return the traffic back to the server.
So there's a zero percent success rate.
In other words this server sends the traffic to its default gateway which is this router Roths the traffic
onto the segment it hits the PC that the pc doesn't know how to get back again.
Now typically RF see 19:18 addresses are not readable on the Internet because Internet routers will
block traffic sent from those IP addresses.
So what we need to do is configure Nat on the router to allow this PC to access the servers and to allow
the traffic to be noted when going on to the outside or the Internet.
So let's configure router 2 with nat.
OK so this is routed to which is our next router show IP interface brief shows us the IP address is
configured on those Raanta gigabit Zurr one is configured with an IP address and that 8 8 8 range that
is a public IP address used by level 3.
So here we are pretending that that interface is the outside or the Internet facing interface on the
router.
Gigabit is 0 0 0 2 and 0 3 are using RAFC 19:18 addresses.
In other words private IP addresses not ratable on the Internet.
So what I'll do is configure gigabit 01 as a net outside interface.
In this example I'm using an Iowas Virata.
So we saw a CPQ hug message but the road has come back now.
So I'm using a 15 6 2 version of IRA's V interface gigabit 0 0 0 IP not inside interface gigabit.
0 2 IP not inside interface gigabit.
0 3 moppy not inside.
We have to tell the router which interfaces on the inside.
In other words internal networks and which interfaces are on the outside or internet facing.
So what we've done thus far is configure gigabit 00 as an inside interface.
Gigabit 0 1 is outside
and gigabit 0 2 and 0 3 are inside net interfaces.
Now we can use the command IP that what are we going to not in this example if we going to net inside
addresses.
In other words we are getting addresses for hosts on the inside of our network.
Think of the term inside as belonging to an insider someone who's inside your organization.
I'm an outsider so I'm on the outside of your organization.
You work for a company perhaps you are an insider in that company.
On the other hand I'm an outsider to your company.
So an insight host is an insider and they have addresses on the local area network.
So I'll talk about some terms in a moment but a local inside address is an address of the host found
on the local LAN.
In other words an inside local address is a inciters IP address when found on the local LAN and inside
a global address is an IP address that belongs to the inside.
Host found on the global Internet.
In this example we want to know an inside host address.
In other words an address that belongs to a host on the inside of our network.
In other words internal to our network Baganda not to the source IP address of that internal host.
And in this example we want to use a static net entry because we want devices from the Internet to be
able to initiate sessions to the host.
So we asked for the inside local IP address.
This is the real IP address of the host.
The host is on the inside of our network and its connected to the local area network.
So the inside local IP address is the physical IP address of that device on the local area network.
Now what are we going to net the address to in this example I'm going to net it 2 8 8 8 8 8 1 that IP
address does not exist in the network.
So going on to rodders 3 which is acting as our P.S. In this typology at the moment it's not able to
pin 8 8 8 8 8 1 because that address doesn't exist.
Notice we're getting encapsulation failed show up.
We're getting an incomplete arp entry for that host.
The PC is not able to discover 8 8 8 1 and that's because it doesn't exist.
We get to create a virtual IP address for that host.
Now I'm going to use extendable to complete the NAT translation.
So going back on to rodders free are we able to ping that address.
Yes we are.
We just don't stop the debug previously
we couldn't ping this address.
We had encapsulation failed the OP was incomplete but after we created the data entry we could ping
8 8 8 8 1.
So let's do that again.
And what I'll do is run a debug on the server.
So this is server 1
debug IP ICMP will do a single ping from rotor 3 which is acting as our PC.
And what you can see here is a source of 10 dot wondered wondered one sent a reply to 8 8 8 8 1 but
the Internet device doesn't know that it's talking to 10 10 attended one because the address is being
Nottage the Internet PC thinks it's talking to 8 2 8 8 8 1 and that's because show IP translation shows
us on router to the NAT router that 8 8 8 8 8 1 is being translated to 10.
Wondered.
Wondered one.
This is the inside a local address.
This is the actual physical address of the PC as we can see here is the address.
This is the inside a global address.
In other words this is the nattered address of that PC.
This is the address of that PC when traffic is sent on to the Internet.
I hope you found the video useful.
If you enjoyed it please like it and please subscribe to my YouTube channel.
I wish you all the very best.