This is one of the multiple videos discussing that network address translation.
This is a troubleshooting video.
We've been told that some hosts in the internal network are not able to access Google dot com in this
example the companies using Google's DNS server for name resolution.
The server's IP address is 8 8 8 8 8 which is found on the Internet in this typology.
I'm using Janus three to simulate to this environment.
Ratatouille is the broader that is configured for Network Address Translation.
We've got three routers acting as hosts in our internal network and one Rodda acting as an Internet
server.
So let's verify what we've been told.
One brought a one which is acting as the PC on the top left.
Ken we paying 8 8 8 8.
Yes we can.
Now what about a five acting as our third PC can that ping.
Google doesn't look like it can debug IP packet.
It's definitely sending the packet.
So it's sending it somewhere.
Sure IP route this router has a default gateway to 10 1 to 3 to 5 4.
It's going to send it to Rodda to
to speed up trace Rondell to you that and then let's see how far it gets on all that.
First try again.
So it gets to 10.
1 2 3 2 5 4.
And then it seems to die.
So it's sending the packet but not getting a response.
OK so it looks like there's a problem with Nat on router to the NAT router some router ready to let's
have a look.
The first thing we'll do in order to debug IP not be careful doing these kind of debugs in the real
world.
You may get a lot of traffic in a production network overwhelm the Rodda but because as a lab we can
do that.
So I'll send one ping and see if anything happens with the net translations.
It doesn't look like that's doing anything if we're a one sends a packet notice one gets translated
it's Rato one is the PC at the top.
When it sends a ping traffic is that it's there the pings failed.
But here we got a reply that's because of VOP So notice there's the source traffic being netted and
she has the reply.
But if we sent traffic from PC five acting as our third host.
In other words this host it looks like that doesn't take place.
In other words it's not translating the address show IP not translation.
These translations are all relating to host one.
They are dynamic not translations so they will expire after a period of time.
So we've already got one that expires but there's no entries for rather five acting as are so PC.
And here you can see all the translations of expired.
So let's have a look at our next configuration.
For this post to be translated this interface needs to be configured as an insider to face and this
interface needs to be configured as an outside interface.
Now we've already got some hosts working so that makes the job easier.
So we can scroll through the configuration his gigabit 00.
So that's the host at the top here.
My peanut inside that looks good.
Gigabit 0 1 is the outside interface and it's configured for IP not.
That's good.
Gigabit 0 to the device is also working configured for IP not inside.
This is the interface where we have the problem but it's also configured for IP inside.
So it doesn't look like that's the problem.
Scrolling down we see the next statement IP not inside source.
List one.
So this is using access list 1 and we are overloading gigabit 0 1.
Can you see the problem.
What's the problem in the south part.
It is.
It's referencing access list one access list one has a permit statement of 10 that wanted 1.0 less 24
10 1 2 0 and then a 10 1 0 0.
This is an inverse mosque because it's an access list.
A zero means match a one in binary means don't match.
So here we have a problem because the series matching 10 the series matching one and this zero is matching
zero traffic is coming from 10 dot one dots three dots three.
So it's not being matched by this access list.
So we could remove the entire access list and re-edit or delete that individual line.
But I'm simply going to say permit 10 1 3 0 with the correct mosque.
So we've got an extra entry in our access list
so show access list 1.
Here are access list entries on route 5 will do.
Ping notices now succeeded.
That hosta was enacted because of the entry notice we got one match do that again.
Two matches and notice here we see the actual Nat translation taking place.
So be careful with your access lists.
This was an example of a done Nemec not entry
referencing access list one.
So we had a problem in our access list where this entry was incorrectly configured.
Notice the sequence numbers.
So what we could do is say IP access list.
Standard one.
No.
30 show IP access list.
So line 30 has been removed and we've only got the correct entries in our access list.
So the pinger works they was the net and we've got another match on the access list.
So we've now solved the problem.
These hosts can ping the Internet.
Let's verify that serrata one can ping Google Rodda for which is this PC can ping Google and run a five
can also Google.
So we've successfully solved the problem.
We verified it.
Don't forget as always in the real world or when you have to save your configuration
and don't forget to turn off your debugs.
They slow Rajahs down typically an increase C.P. utilization.
It's not a good idea to keep them running.
So in this lab we solved a network address translation issue.
If you enjoyed this video please like it and please subscribe to my YouTube channel.
I wish you all the very best.