Lab Objective:
Learn how to configure port address translation (PAT).
Lab Purpose:
Many businesses and homes can afford only one IP address but still have several hosts which need to access the internet. PAT allows one IP address to be used by thousands of hosts. They all use the same IP address but add a port number to the translation and keep a log of which host uses which port.
Lab Tool:
Packet Tracer
Lab Topology:
Please use the following topology to complete this lab exercise:
Lab Walkthrough:
Task 1:
Connect a couple of hosts to a switch. Connect two routers via a crossover cable.
Task 2:
Set the IP configuration for the hosts. The Ethernet interfaces should be 172.16.1.2 and .3 and the default gateway 172.16.1.1, which will be the closest IP address of R0. Here it is on one host device:
Task 3:
Configure IP addressing on R0 and R1. The routers are connected via G0/1.
Router(config)#host R0
R0(config)#int g0/0
R0(config-if)#ip add 172.16.1.1 255.255.0.0
R0(config-if)#no shut
%LINK-5-CHANGED: Interface GigabitEthernet0/0, changed state to up
R0(config-if)#int g0/1
R0(config-if)#ip add 192.168.1.1 255.255.255.0
R0(config-if)#no shut
R0(config-if)#exit
R1(config)#host R1
R1(config)#int g0/1
R1(config-if)#ip add 192.168.1.2 255.255.255.0
R1(config-if)#no shut
R1(config-if)#exit
Task 4:
Add a static route on R1 to send all traffic to R0. We do this because the NAT address won’t be in any routing tables and will otherwise be dropped by the router.
R1(config)#ip route 0.0.0.0 0.0.0.0 192.168.1.1
Task 5:
Add your PAT configuration to R0. The network 172.16.0.0 should be NAT-ted to a pool of addresses from the 10.0.0.0/8 network. In this instance, our pool consists of only one address. We would usually use a routable address, but I don’t want to take the risk here, so we’ll stick to private IP addresses. Note also that you must tell the router which is the inside/outside of your network for the purposes of NAT.
For a NAT pool, we must add a bit more configuration. We create a NAT pool, a source list that tells the router which pool to use, and then an access list. This access list is used by NAT to decide which subnets or networks to NAT. We add the ‘overload’ command to enable PAT. Without this, we would be able to translate only one IP address.
Note that we are using the same IP address twice; this would be the case when we have only one IP address allocated by our ISP.
R0(config)#ip nat pool 101labs 10.0.0.1 10.0.0.1 netmask 255.0.0.0
R0(config)#ip nat inside source list 1 pool 101labs overload
R0(config)#access-list 1 permit 172.16.0.0 0.0.255.255
R0(config)#int g0/0
R0(config-if)#ip nat inside
R0(config-if)#int g0/1
R0(config-if)#ip nat outside
R0(config-if)#end
Task 6:
Test your configuration by pinging 192.168.1.2 from your hosts. R0 should swap (PAT) this address for an address from the pool, but tag a port number onto it. Quickly do the same from the second host machine.
Check the NAT table on R0. The inside global address is the NAT address. The inside local is your host, and the outside local is the destination address. You should see your 172.16.1.2 and .3 hosts using addresses from the NAT pool, but all translations are tagged with a port number. You also get this with a NAT pool, but this is a limitation of Packet Tracer, I’m afraid.
R0#show ip nat tran
Pro Inside global Inside local Outside local Outside global
icmp 10.0.0.1:1024 172.16.1.3:1 192.168.1.2:1 192.168.1.2:1024
icmp 10.0.0.1:1025 172.16.1.3:2 192.168.1.2:2 192.168.1.2:1025
icmp 10.0.0.1:1026 172.16.1.3:3 192.168.1.2:3 192.168.1.2:1026
icmp 10.0.0.1:1027 172.16.1.3:4 192.168.1.2:4 192.168.1.2:1027
icmp 10.0.0.1:1 172.16.1.2:1 192.168.1.2:1 192.168.1.2:1
icmp 10.0.0.1:2 172.16.1.2:2 192.168.1.2:2 192.168.1.2:2
icmp 10.0.0.1:3 172.16.1.2:3 192.168.1.2:3 192.168.1.2:3
icmp 10.0.0.1:4 172.16.1.2:4 192.168.1.2:4 192.168.1.2:4
R0#show ip nat statistics
Total translations: 8 (0 static, 8 dynamic, 8 extended)
Outside Interfaces: GigabitEthernet0/1
Inside Interfaces: GigabitEthernet0/0
Hits: 8 Misses: 8
Expired translations: 0
Dynamic mappings:
— Inside Source
access-list 1 pool 101labs refCount 8
pool 101labs: netmask 255.0.0.0
start 10.0.0.1 end 10.0.0.1
type generic, total addresses 1 , allocated 1 (100%), misses 00
start 10.0.0.0 end 10.0.0.254
type generic, total addresses 255 , allocated 1 (0%), misses 0
Note:
PAT is used on every network running IPv4, including your home network.
