Using Cisco IOS 15.1(4)M10, Cisco ISR1841 box.
PAT(Port Address Translation) called also NAPT(Network Address Port Translation).
Simply called NAT, in many cases, it means NAPT technology.
192.168.10.210 192.168.10.211 172.16.2.0/24
conf t ! access-list 1 permit 172.16.2.0 0.0.0.255 ! ip nat inside source list 1 interface f0/1 overload ! int f0/0 ip nat inside exit int f0/1 ip nat outside exit ! end
R1#conf t Enter configuration commands, one per line. End with CNTL/Z. R1(config)# R1(config)# R1(config)# R1(config)# R1(config)#acce R1(config)#access-list 1 per R1(config)#access-list 1 permit 172.16.2.0 0.0.0.255 R1(config)#ip nat R1(config)#ip nat insi R1(config)#ip nat inside sour R1(config)#ip nat inside source lis R1(config)#ip nat inside source list 1 inter R1(config)#ip nat inside source list 1 interface f0/1 over R1(config)#ip nat inside source list 1 interface f0/1 overload R1(config)# *Apr 10 12:13:29.511: %LINEPROTO-5-UPDOWN: Line protocol on Interface NVI0, changed state to up R1(config)#int f0/0 R1(config-if)#ip nat insi R1(config-if)#ip nat inside R1(config-if)#exit R1(config)#int f0/1 R1(config-if)#ip nat outsi R1(config-if)#ip nat outside R1(config-if)#exit R1(config)#end R1# *Apr 10 12:19:33.091: %SYS-5-CONFIG_I: Configured from console by console R1#
% ssh pi@172.16.2.11 % ssh pi@172.16.2.12 % ssh pi@172.16.2.13
ping 172.16.2.1 -c2 ping 192.168.10.210 -c2 ping 8.8.8.8 ping 8.8.8.8 -c4
sh ip nat statistics sh ip nat translations sh ip nat translations verbose sh ip access-lists sh ip int f0/0 | i (translation|NAT) sh ip int f0/1 | i (translation|NAT) sh run | i nat
pi@pi1:~ $ ping 172.16.2.1 -c2 PING 172.16.2.1 (172.16.2.1) 56(84) bytes of data. 64 bytes from 172.16.2.1: icmp_seq=1 ttl=255 time=1.95 ms 64 bytes from 172.16.2.1: icmp_seq=2 ttl=255 time=1.66 ms --- 172.16.2.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms rtt min/avg/max/mdev = 1.660/1.805/1.951/0.151 ms pi@pi1:~ $ ping 192.168.10.210 -c2 PING 192.168.10.210 (192.168.10.210) 56(84) bytes of data. 64 bytes from 192.168.10.210: icmp_seq=1 ttl=255 time=2.23 ms 64 bytes from 192.168.10.210: icmp_seq=2 ttl=255 time=1.53 ms --- 192.168.10.210 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms rtt min/avg/max/mdev = 1.537/1.886/2.236/0.352 ms pi@pi1:~ $ ping 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=10.4 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=9.80 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=56 time=9.79 ms ^C --- 8.8.8.8 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2003ms rtt min/avg/max/mdev = 9.793/10.012/10.438/0.311 ms pi@pi1:~ $ ping 8.8.8.8 -c4 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=10.1 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=10.0 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=56 time=9.76 ms 64 bytes from 8.8.8.8: icmp_seq=4 ttl=56 time=10.4 ms --- 8.8.8.8 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3004ms rtt min/avg/max/mdev = 9.760/10.098/10.465/0.263 ms pi@pi1:~ $
pi@pi2:~ $ ping 172.16.2.1 -c2 PING 172.16.2.1 (172.16.2.1) 56(84) bytes of data. 64 bytes from 172.16.2.1: icmp_seq=1 ttl=255 time=1.86 ms 64 bytes from 172.16.2.1: icmp_seq=2 ttl=255 time=1.61 ms --- 172.16.2.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms rtt min/avg/max/mdev = 1.613/1.739/1.865/0.126 ms pi@pi2:~ $ ping 192.168.10.210 -c2 PING 192.168.10.210 (192.168.10.210) 56(84) bytes of data. 64 bytes from 192.168.10.210: icmp_seq=1 ttl=255 time=1.70 ms 64 bytes from 192.168.10.210: icmp_seq=2 ttl=255 time=2.03 ms --- 192.168.10.210 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms rtt min/avg/max/mdev = 1.706/1.868/2.030/0.162 ms pi@pi2:~ $ ping 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=10.3 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=10.1 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=56 time=9.89 ms ^C --- 8.8.8.8 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2003ms rtt min/avg/max/mdev = 9.891/10.129/10.326/0.179 ms pi@pi2:~ $ ping 8.8.8.8 -c4 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=10.5 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=9.91 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=56 time=9.76 ms 64 bytes from 8.8.8.8: icmp_seq=4 ttl=56 time=10.1 ms --- 8.8.8.8 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3005ms rtt min/avg/max/mdev = 9.762/10.080/10.503/0.305 ms pi@pi2:~ $
pi@pi3:~ $ ping 172.16.2.1 -c2 PING 172.16.2.1 (172.16.2.1) 56(84) bytes of data. 64 bytes from 172.16.2.1: icmp_seq=1 ttl=255 time=1.62 ms 64 bytes from 172.16.2.1: icmp_seq=2 ttl=255 time=1.65 ms --- 172.16.2.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms rtt min/avg/max/mdev = 1.621/1.637/1.653/0.016 ms pi@pi3:~ $ ping 192.168.10.210 -c2 PING 192.168.10.210 (192.168.10.210) 56(84) bytes of data. 64 bytes from 192.168.10.210: icmp_seq=1 ttl=255 time=1.53 ms 64 bytes from 192.168.10.210: icmp_seq=2 ttl=255 time=1.80 ms --- 192.168.10.210 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms rtt min/avg/max/mdev = 1.530/1.669/1.808/0.139 ms pi@pi3:~ $ ping 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=10.5 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=9.84 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=56 time=9.95 ms ^C --- 8.8.8.8 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2003ms rtt min/avg/max/mdev = 9.846/10.098/10.500/0.309 ms pi@pi3:~ $ ping 8.8.8.8 -c4 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=10.4 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=10.0 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=56 time=9.98 ms 64 bytes from 8.8.8.8: icmp_seq=4 ttl=56 time=10.1 ms --- 8.8.8.8 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3005ms rtt min/avg/max/mdev = 9.986/10.151/10.422/0.206 ms pi@pi3:~ $
R1#sh ip nat statistics Total active translations: 3 (0 static, 3 dynamic; 3 extended) Peak translations: 6, occurred 00:03:54 ago Outside interfaces: FastEthernet0/1 Inside interfaces: FastEthernet0/0 Hits: 96 Misses: 0 CEF Translated packets: 96, CEF Punted packets: 0 Expired translations: 6 Dynamic mappings: -- Inside Source [Id: 1] access-list 1 interface FastEthernet0/1 refcount 3 Total doors: 0 Appl doors: 0 Normal doors: 0 Queued Packets: 0 R1#sh ip nat translations Pro Inside global Inside local Outside local Outside global icmp 192.168.10.210:6754 172.16.2.11:6754 8.8.8.8:6754 8.8.8.8:6754 icmp 192.168.10.210:7716 172.16.2.12:7716 8.8.8.8:7716 8.8.8.8:7716 icmp 192.168.10.210:6899 172.16.2.13:6899 8.8.8.8:6899 8.8.8.8:6899 R1#sh ip nat translations verbose Pro Inside global Inside local Outside local Outside global icmp 192.168.10.210:6754 172.16.2.11:6754 8.8.8.8:6754 8.8.8.8:6754 create 00:01:19, use 00:00:00 timeout:60000, left 00:00:59, Map-Id(In): 1, flags: extended, use_count: 0, entry-id: 8, lc_entries: 0 icmp 192.168.10.210:7716 172.16.2.12:7716 8.8.8.8:7716 8.8.8.8:7716 create 00:01:19, use 00:00:00 timeout:60000, left 00:00:59, Map-Id(In): 1, flags: extended, use_count: 0, entry-id: 9, lc_entries: 0 icmp 192.168.10.210:6899 172.16.2.13:6899 8.8.8.8:6899 8.8.8.8:6899 create 00:01:19, use 00:00:00 timeout:60000, left 00:00:59, Map-Id(In): 1, flags: extended, use_count: 0, entry-id: 7, lc_entries: 0 R1#sh ip access-lists Standard IP access list 1 10 permit 172.16.2.0, wildcard bits 0.0.0.255 (9 matches) R1#sh ip int f0/0 | i (translation|NAT) Network address translation is enabled, interface in domain inside Output features: NAT Inside, Stateful Inspection, NAT ALG proxy R1#sh ip int f0/1 | i (translation|NAT) Network address translation is enabled, interface in domain outside Input features: Stateful Inspection, Virtual Fragment Reassembly, Virtual Fragment Reassembly After IPSec Decryption, NAT Outside, MCI Check Output features: Post-routing NAT Outside, Stateful Inspection, NAT ALG proxy R1#sh run | i nat ip nat inside ip nat outside ip nat inside source list 1 interface FastEthernet0/1 overload R1#
conf t ! ip nat pool PG1X-POOL 192.168.10.211 192.168.10.211 netmask 255.255.255.0 ! access-list 1 permit 172.16.2.0 0.0.0.255 ! ip nat inside source list 1 pool PG1X-POOL overload ! int f0/0 ip nat inside exit int f0/1 ip nat outside exit ! end
R1#conf t Enter configuration commands, one per line. End with CNTL/Z. R1(config)#ip nat R1(config)#ip nat po R1(config)#ip nat poo R1(config)#ip nat pool PG1X-POOL 192.168.10.211 192.168.10.211 netma R1(config)#$ PG1X-POOL 192.168.10.211 192.168.10.211 netmask 255.255.255.0 R1(config)# *Apr 10 21:50:29.683: %LINEPROTO-5-UPDOWN: Line protocol on Interface NVI0, changed state to up R1(config)#acce R1(config)#access-list 1 permi R1(config)#access-list 1 permit 172.16.2.0 0.0.0.255 R1(config)#ip nat insi R1(config)#ip nat inside sour R1(config)#ip nat inside source li R1(config)#ip nat inside source list 1 poo R1(config)#ip nat inside source list 1 pool PG1X-POOL overlo R1(config)#ip nat inside source list 1 pool PG1X-POOL overload R1(config)#int f0/0 R1(config-if)#ip nat insi R1(config-if)#ip nat inside R1(config-if)#exit R1(config)#int f0/1 R1(config-if)#ip nat out R1(config-if)#ip nat outside R1(config-if)#exit R1(config)#end R1# *Apr 10 21:58:37.327: %SYS-5-CONFIG_I: Configured from console by console R1#
% ssh pi@172.16.2.11 % ssh pi@172.16.2.12 % ssh pi@172.16.2.13
ping 172.16.2.1 -c2 ping 192.168.10.210 -c2 ping 8.8.8.8 -c4 ping 8.8.8.8
sh ip nat statistics sh ip nat translations sh ip nat translations verbose sh ip access-lists sh ip int f0/0 | i (translation|NAT) sh ip int f0/1 | i (translation|NAT) sh run | i nat
pi@pi1:~ $ ping 172.16.2.1 -c2 PING 172.16.2.1 (172.16.2.1) 56(84) bytes of data. 64 bytes from 172.16.2.1: icmp_seq=1 ttl=255 time=1.98 ms 64 bytes from 172.16.2.1: icmp_seq=2 ttl=255 time=1.61 ms --- 172.16.2.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1002ms rtt min/avg/max/mdev = 1.610/1.799/1.988/0.189 ms pi@pi1:~ $ ping 192.168.10.210 -c2 PING 192.168.10.210 (192.168.10.210) 56(84) bytes of data. 64 bytes from 192.168.10.210: icmp_seq=1 ttl=255 time=1.14 ms 64 bytes from 192.168.10.210: icmp_seq=2 ttl=255 time=1.26 ms --- 192.168.10.210 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms rtt min/avg/max/mdev = 1.142/1.202/1.262/0.060 ms pi@pi1:~ $ ping 8.8.8.8 -c4 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=11.6 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=10.1 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=56 time=10.0 ms 64 bytes from 8.8.8.8: icmp_seq=4 ttl=56 time=10.0 ms --- 8.8.8.8 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3005ms rtt min/avg/max/mdev = 10.038/10.464/11.612/0.671 ms pi@pi1:~ $
pi@pi2:~ $ ping 172.16.2.1 -c2 PING 172.16.2.1 (172.16.2.1) 56(84) bytes of data. 64 bytes from 172.16.2.1: icmp_seq=1 ttl=255 time=1.71 ms 64 bytes from 172.16.2.1: icmp_seq=2 ttl=255 time=1.62 ms --- 172.16.2.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms rtt min/avg/max/mdev = 1.627/1.673/1.719/0.046 ms pi@pi2:~ $ ping 192.168.10.210 -c2 PING 192.168.10.210 (192.168.10.210) 56(84) bytes of data. 64 bytes from 192.168.10.210: icmp_seq=1 ttl=255 time=1.20 ms 64 bytes from 192.168.10.210: icmp_seq=2 ttl=255 time=1.20 ms --- 192.168.10.210 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms rtt min/avg/max/mdev = 1.202/1.205/1.208/0.003 ms pi@pi2:~ $ ping 8.8.8.8 -c4 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=11.5 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=10.2 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=56 time=10.0 ms 64 bytes from 8.8.8.8: icmp_seq=4 ttl=56 time=9.80 ms --- 8.8.8.8 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3005ms rtt min/avg/max/mdev = 9.802/10.393/11.540/0.678 ms pi@pi2:~ $
pi@pi3:~ $ ping 172.16.2.1 -c2 PING 172.16.2.1 (172.16.2.1) 56(84) bytes of data. 64 bytes from 172.16.2.1: icmp_seq=1 ttl=255 time=1.84 ms 64 bytes from 172.16.2.1: icmp_seq=2 ttl=255 time=1.73 ms --- 172.16.2.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms rtt min/avg/max/mdev = 1.731/1.787/1.844/0.070 ms pi@pi3:~ $ ping 192.168.10.210 -c2 PING 192.168.10.210 (192.168.10.210) 56(84) bytes of data. 64 bytes from 192.168.10.210: icmp_seq=1 ttl=255 time=1.15 ms 64 bytes from 192.168.10.210: icmp_seq=2 ttl=255 time=1.12 ms --- 192.168.10.210 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms rtt min/avg/max/mdev = 1.122/1.139/1.156/0.017 ms pi@pi3:~ $ ping 8.8.8.8 -c4 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=10.2 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=9.67 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=56 time=9.75 ms 64 bytes from 8.8.8.8: icmp_seq=4 ttl=56 time=10.0 ms --- 8.8.8.8 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3003ms rtt min/avg/max/mdev = 9.674/9.941/10.298/0.265 ms pi@pi3:~ $
R1#sh ip nat statistics Total active translations: 3 (0 static, 3 dynamic; 3 extended) Peak translations: 6, occurred 00:00:35 ago Outside interfaces: FastEthernet0/1 Inside interfaces: FastEthernet0/0 Hits: 240 Misses: 0 CEF Translated packets: 240, CEF Punted packets: 0 Expired translations: 3 Dynamic mappings: -- Inside Source [Id: 1] access-list 1 pool PG1X-POOL refcount 3 pool PG1X-POOL: netmask 255.255.255.0 start 192.168.10.211 end 192.168.10.211 type generic, total addresses 1, allocated 1 (100%), misses 0 Total doors: 0 Appl doors: 0 Normal doors: 0 Queued Packets: 0 R1#sh ip nat tras R1#sh ip nat trans R1#sh ip nat translations Pro Inside global Inside local Outside local Outside global icmp 192.168.10.211:7042 172.16.2.11:7042 8.8.8.8:7042 8.8.8.8:7042 icmp 192.168.10.211:8160 172.16.2.12:8160 8.8.8.8:8160 8.8.8.8:8160 icmp 192.168.10.211:7191 172.16.2.13:7191 8.8.8.8:7191 8.8.8.8:7191 R1#sh ip nat trasn R1#sh ip nat transla R1#sh ip nat translations verbo R1#sh ip nat translations verbose Pro Inside global Inside local Outside local Outside global icmp 192.168.10.211:7042 172.16.2.11:7042 8.8.8.8:7042 8.8.8.8:7042 create 00:01:13, use 00:00:00 timeout:60000, left 00:00:59, Map-Id(In): 1, flags: extended, use_count: 0, entry-id: 6, lc_entries: 0 icmp 192.168.10.211:8160 172.16.2.12:8160 8.8.8.8:8160 8.8.8.8:8160 create 00:01:13, use 00:00:00 timeout:60000, left 00:00:59, Map-Id(In): 1, flags: extended, use_count: 0, entry-id: 5, lc_entries: 0 icmp 192.168.10.211:7191 172.16.2.13:7191 8.8.8.8:7191 8.8.8.8:7191 create 00:01:13, use 00:00:00 timeout:60000, left 00:00:59, Map-Id(In): 1, flags: extended, use_count: 0, entry-id: 4, lc_entries: 0 R1#sh ip acc R1#sh ip acce R1#sh ip access-lists Standard IP access list 1 10 permit 172.16.2.0, wildcard bits 0.0.0.255 (6 matches) R1#sh ip access-lists Standard IP access list 1 10 permit 172.16.2.0, wildcard bits 0.0.0.255 (6 matches) R1#sh ip int f0/0 | i (translation|NAT) Network address translation is enabled, interface in domain inside Output features: NAT Inside, Stateful Inspection, NAT ALG proxy R1#sh ip int f0/1 | i (translation|NAT) Network address translation is enabled, interface in domain outside Input features: Stateful Inspection, Virtual Fragment Reassembly, Virtual Fragment Reassembly After IPSec Decryption, NAT Outside, MCI Check Output features: Post-routing NAT Outside, Stateful Inspection, NAT ALG proxy R1#sh run | i nat ip nat inside ip nat outside ip nat pool PG1X-POOL 192.168.10.211 192.168.10.211 netmask 255.255.255.0 ip nat inside source list 1 pool PG1X-POOL overload R1#