User Tools

Site Tools


tech:network:cisco:pat:pat

PAT

Physical Lab 6

Using Cisco IOS 15.1(4)M10, Cisco ISR1841 box.

PAT(Port Address Translation) called also NAPT(Network Address Port Translation).
Simply called NAT, in many cases, it means NAPT technology.

192.168.10.210
192.168.10.211

172.16.2.0/24

Configuration with interface

conf t
!
access-list 1 permit 172.16.2.0 0.0.0.255
!
ip nat inside source list 1 interface f0/1 overload
!
int f0/0
ip nat inside
exit
int f0/1
ip nat outside
exit
!
end
R1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#
R1(config)#
R1(config)#
R1(config)#
R1(config)#acce
R1(config)#access-list 1 per
R1(config)#access-list 1 permit 172.16.2.0 0.0.0.255
R1(config)#ip nat
R1(config)#ip nat insi
R1(config)#ip nat inside sour
R1(config)#ip nat inside source lis
R1(config)#ip nat inside source list 1 inter
R1(config)#ip nat inside source list 1 interface f0/1 over
R1(config)#ip nat inside source list 1 interface f0/1 overload
R1(config)#
*Apr 10 12:13:29.511: %LINEPROTO-5-UPDOWN: Line protocol on Interface NVI0, changed state to up
R1(config)#int f0/0
R1(config-if)#ip nat insi
R1(config-if)#ip nat inside
R1(config-if)#exit
R1(config)#int f0/1
R1(config-if)#ip nat outsi
R1(config-if)#ip nat outside
R1(config-if)#exit
R1(config)#end
R1#
*Apr 10 12:19:33.091: %SYS-5-CONFIG_I: Configured from console by console
R1#

Verification

% ssh pi@172.16.2.11
% ssh pi@172.16.2.12
% ssh pi@172.16.2.13
ping 172.16.2.1 -c2
ping 192.168.10.210 -c2
ping 8.8.8.8
ping 8.8.8.8 -c4
sh ip nat statistics
sh ip nat translations
sh ip nat translations verbose
sh ip access-lists
sh ip int f0/0 | i (translation|NAT)
sh ip int f0/1 | i (translation|NAT)
sh run | i nat
pi@pi1:~ $ ping 172.16.2.1 -c2
PING 172.16.2.1 (172.16.2.1) 56(84) bytes of data.
64 bytes from 172.16.2.1: icmp_seq=1 ttl=255 time=1.95 ms
64 bytes from 172.16.2.1: icmp_seq=2 ttl=255 time=1.66 ms

--- 172.16.2.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 1.660/1.805/1.951/0.151 ms
pi@pi1:~ $ ping 192.168.10.210 -c2
PING 192.168.10.210 (192.168.10.210) 56(84) bytes of data.
64 bytes from 192.168.10.210: icmp_seq=1 ttl=255 time=2.23 ms
64 bytes from 192.168.10.210: icmp_seq=2 ttl=255 time=1.53 ms

--- 192.168.10.210 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 1.537/1.886/2.236/0.352 ms
pi@pi1:~ $ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=10.4 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=9.80 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=56 time=9.79 ms
^C
--- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 9.793/10.012/10.438/0.311 ms
pi@pi1:~ $ ping 8.8.8.8 -c4
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=10.1 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=10.0 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=56 time=9.76 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=56 time=10.4 ms

--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 9.760/10.098/10.465/0.263 ms
pi@pi1:~ $
pi@pi2:~ $ ping 172.16.2.1 -c2
PING 172.16.2.1 (172.16.2.1) 56(84) bytes of data.
64 bytes from 172.16.2.1: icmp_seq=1 ttl=255 time=1.86 ms
64 bytes from 172.16.2.1: icmp_seq=2 ttl=255 time=1.61 ms

--- 172.16.2.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 1.613/1.739/1.865/0.126 ms
pi@pi2:~ $ ping 192.168.10.210 -c2
PING 192.168.10.210 (192.168.10.210) 56(84) bytes of data.
64 bytes from 192.168.10.210: icmp_seq=1 ttl=255 time=1.70 ms
64 bytes from 192.168.10.210: icmp_seq=2 ttl=255 time=2.03 ms

--- 192.168.10.210 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 1.706/1.868/2.030/0.162 ms
pi@pi2:~ $ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=10.3 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=10.1 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=56 time=9.89 ms
^C
--- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 9.891/10.129/10.326/0.179 ms
pi@pi2:~ $ ping 8.8.8.8 -c4
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=10.5 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=9.91 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=56 time=9.76 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=56 time=10.1 ms

--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 9.762/10.080/10.503/0.305 ms
pi@pi2:~ $
pi@pi3:~ $ ping 172.16.2.1 -c2
PING 172.16.2.1 (172.16.2.1) 56(84) bytes of data.
64 bytes from 172.16.2.1: icmp_seq=1 ttl=255 time=1.62 ms
64 bytes from 172.16.2.1: icmp_seq=2 ttl=255 time=1.65 ms

--- 172.16.2.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 1.621/1.637/1.653/0.016 ms
pi@pi3:~ $ ping 192.168.10.210 -c2
PING 192.168.10.210 (192.168.10.210) 56(84) bytes of data.
64 bytes from 192.168.10.210: icmp_seq=1 ttl=255 time=1.53 ms
64 bytes from 192.168.10.210: icmp_seq=2 ttl=255 time=1.80 ms

--- 192.168.10.210 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 1.530/1.669/1.808/0.139 ms
pi@pi3:~ $ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=10.5 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=9.84 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=56 time=9.95 ms
^C
--- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 9.846/10.098/10.500/0.309 ms
pi@pi3:~ $ ping 8.8.8.8 -c4
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=10.4 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=10.0 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=56 time=9.98 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=56 time=10.1 ms

--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 9.986/10.151/10.422/0.206 ms
pi@pi3:~ $
R1#sh ip nat statistics
Total active translations: 3 (0 static, 3 dynamic; 3 extended)
Peak translations: 6, occurred 00:03:54 ago
Outside interfaces:
  FastEthernet0/1
Inside interfaces:
  FastEthernet0/0
Hits: 96  Misses: 0
CEF Translated packets: 96, CEF Punted packets: 0
Expired translations: 6
Dynamic mappings:
-- Inside Source
[Id: 1] access-list 1 interface FastEthernet0/1 refcount 3

Total doors: 0
Appl doors: 0
Normal doors: 0
Queued Packets: 0
R1#sh ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
icmp 192.168.10.210:6754 172.16.2.11:6754 8.8.8.8:6754       8.8.8.8:6754
icmp 192.168.10.210:7716 172.16.2.12:7716 8.8.8.8:7716       8.8.8.8:7716
icmp 192.168.10.210:6899 172.16.2.13:6899 8.8.8.8:6899       8.8.8.8:6899
R1#sh ip nat translations verbose
Pro Inside global      Inside local       Outside local      Outside global
icmp 192.168.10.210:6754 172.16.2.11:6754 8.8.8.8:6754       8.8.8.8:6754
    create 00:01:19, use 00:00:00 timeout:60000, left 00:00:59, Map-Id(In): 1,
    flags:
extended, use_count: 0, entry-id: 8, lc_entries: 0
icmp 192.168.10.210:7716 172.16.2.12:7716 8.8.8.8:7716       8.8.8.8:7716
    create 00:01:19, use 00:00:00 timeout:60000, left 00:00:59, Map-Id(In): 1,
    flags:
extended, use_count: 0, entry-id: 9, lc_entries: 0
icmp 192.168.10.210:6899 172.16.2.13:6899 8.8.8.8:6899       8.8.8.8:6899
    create 00:01:19, use 00:00:00 timeout:60000, left 00:00:59, Map-Id(In): 1,
    flags:
extended, use_count: 0, entry-id: 7, lc_entries: 0
R1#sh ip access-lists
Standard IP access list 1
    10 permit 172.16.2.0, wildcard bits 0.0.0.255 (9 matches)
R1#sh ip int f0/0 | i (translation|NAT)
  Network address translation is enabled, interface in domain inside
  Output features: NAT Inside, Stateful Inspection, NAT ALG proxy
R1#sh ip int f0/1 | i (translation|NAT)
  Network address translation is enabled, interface in domain outside
  Input features: Stateful Inspection, Virtual Fragment Reassembly, Virtual Fragment Reassembly After IPSec Decryption, NAT Outside, MCI Check
  Output features: Post-routing NAT Outside, Stateful Inspection, NAT ALG proxy
R1#sh run | i nat
 ip nat inside
 ip nat outside
ip nat inside source list 1 interface FastEthernet0/1 overload
R1#

Configuration with pool

conf t
!
ip nat pool PG1X-POOL 192.168.10.211 192.168.10.211 netmask 255.255.255.0
!
access-list 1 permit 172.16.2.0 0.0.0.255
!
ip nat inside source list 1 pool PG1X-POOL overload
!
int f0/0
ip nat inside
exit
int f0/1
ip nat outside
exit
!
end
R1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#ip nat
R1(config)#ip nat po
R1(config)#ip nat poo
R1(config)#ip nat pool PG1X-POOL 192.168.10.211 192.168.10.211 netma
R1(config)#$ PG1X-POOL 192.168.10.211 192.168.10.211 netmask 255.255.255.0
R1(config)#
*Apr 10 21:50:29.683: %LINEPROTO-5-UPDOWN: Line protocol on Interface NVI0, changed state to up
R1(config)#acce
R1(config)#access-list 1 permi
R1(config)#access-list 1 permit 172.16.2.0 0.0.0.255
R1(config)#ip nat insi
R1(config)#ip nat inside sour
R1(config)#ip nat inside source li
R1(config)#ip nat inside source list 1 poo
R1(config)#ip nat inside source list 1 pool PG1X-POOL overlo
R1(config)#ip nat inside source list 1 pool PG1X-POOL overload
R1(config)#int f0/0
R1(config-if)#ip nat insi
R1(config-if)#ip nat inside
R1(config-if)#exit
R1(config)#int f0/1
R1(config-if)#ip nat out
R1(config-if)#ip nat outside
R1(config-if)#exit
R1(config)#end
R1#
*Apr 10 21:58:37.327: %SYS-5-CONFIG_I: Configured from console by console
R1#

Verification

% ssh pi@172.16.2.11
% ssh pi@172.16.2.12
% ssh pi@172.16.2.13
ping 172.16.2.1 -c2
ping 192.168.10.210 -c2
ping 8.8.8.8 -c4
ping 8.8.8.8
sh ip nat statistics
sh ip nat translations
sh ip nat translations verbose
sh ip access-lists
sh ip int f0/0 | i (translation|NAT)
sh ip int f0/1 | i (translation|NAT)
sh run | i nat
pi@pi1:~ $ ping 172.16.2.1 -c2
PING 172.16.2.1 (172.16.2.1) 56(84) bytes of data.
64 bytes from 172.16.2.1: icmp_seq=1 ttl=255 time=1.98 ms
64 bytes from 172.16.2.1: icmp_seq=2 ttl=255 time=1.61 ms

--- 172.16.2.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 1.610/1.799/1.988/0.189 ms
pi@pi1:~ $ ping 192.168.10.210 -c2
PING 192.168.10.210 (192.168.10.210) 56(84) bytes of data.
64 bytes from 192.168.10.210: icmp_seq=1 ttl=255 time=1.14 ms
64 bytes from 192.168.10.210: icmp_seq=2 ttl=255 time=1.26 ms

--- 192.168.10.210 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 1.142/1.202/1.262/0.060 ms
pi@pi1:~ $ ping 8.8.8.8 -c4
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=11.6 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=10.1 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=56 time=10.0 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=56 time=10.0 ms

--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 10.038/10.464/11.612/0.671 ms
pi@pi1:~ $
pi@pi2:~ $ ping 172.16.2.1 -c2
PING 172.16.2.1 (172.16.2.1) 56(84) bytes of data.
64 bytes from 172.16.2.1: icmp_seq=1 ttl=255 time=1.71 ms
64 bytes from 172.16.2.1: icmp_seq=2 ttl=255 time=1.62 ms

--- 172.16.2.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 1.627/1.673/1.719/0.046 ms
pi@pi2:~ $ ping 192.168.10.210 -c2
PING 192.168.10.210 (192.168.10.210) 56(84) bytes of data.
64 bytes from 192.168.10.210: icmp_seq=1 ttl=255 time=1.20 ms
64 bytes from 192.168.10.210: icmp_seq=2 ttl=255 time=1.20 ms

--- 192.168.10.210 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 1.202/1.205/1.208/0.003 ms
pi@pi2:~ $ ping 8.8.8.8 -c4
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=11.5 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=10.2 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=56 time=10.0 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=56 time=9.80 ms

--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 9.802/10.393/11.540/0.678 ms
pi@pi2:~ $
pi@pi3:~ $ ping 172.16.2.1 -c2
PING 172.16.2.1 (172.16.2.1) 56(84) bytes of data.
64 bytes from 172.16.2.1: icmp_seq=1 ttl=255 time=1.84 ms
64 bytes from 172.16.2.1: icmp_seq=2 ttl=255 time=1.73 ms

--- 172.16.2.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 1.731/1.787/1.844/0.070 ms
pi@pi3:~ $ ping 192.168.10.210 -c2
PING 192.168.10.210 (192.168.10.210) 56(84) bytes of data.
64 bytes from 192.168.10.210: icmp_seq=1 ttl=255 time=1.15 ms
64 bytes from 192.168.10.210: icmp_seq=2 ttl=255 time=1.12 ms

--- 192.168.10.210 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 1.122/1.139/1.156/0.017 ms
pi@pi3:~ $ ping 8.8.8.8 -c4
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=10.2 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=9.67 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=56 time=9.75 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=56 time=10.0 ms

--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3003ms
rtt min/avg/max/mdev = 9.674/9.941/10.298/0.265 ms
pi@pi3:~ $
R1#sh ip nat statistics
Total active translations: 3 (0 static, 3 dynamic; 3 extended)
Peak translations: 6, occurred 00:00:35 ago
Outside interfaces:
  FastEthernet0/1
Inside interfaces:
  FastEthernet0/0
Hits: 240  Misses: 0
CEF Translated packets: 240, CEF Punted packets: 0
Expired translations: 3
Dynamic mappings:
-- Inside Source
[Id: 1] access-list 1 pool PG1X-POOL refcount 3
 pool PG1X-POOL: netmask 255.255.255.0
        start 192.168.10.211 end 192.168.10.211
        type generic, total addresses 1, allocated 1 (100%), misses 0

Total doors: 0
Appl doors: 0
Normal doors: 0
Queued Packets: 0
R1#sh ip nat tras
R1#sh ip nat trans
R1#sh ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
icmp 192.168.10.211:7042 172.16.2.11:7042 8.8.8.8:7042       8.8.8.8:7042
icmp 192.168.10.211:8160 172.16.2.12:8160 8.8.8.8:8160       8.8.8.8:8160
icmp 192.168.10.211:7191 172.16.2.13:7191 8.8.8.8:7191       8.8.8.8:7191
R1#sh ip nat trasn
R1#sh ip nat transla
R1#sh ip nat translations verbo
R1#sh ip nat translations verbose
Pro Inside global      Inside local       Outside local      Outside global
icmp 192.168.10.211:7042 172.16.2.11:7042 8.8.8.8:7042       8.8.8.8:7042
    create 00:01:13, use 00:00:00 timeout:60000, left 00:00:59, Map-Id(In): 1,
    flags:
extended, use_count: 0, entry-id: 6, lc_entries: 0
icmp 192.168.10.211:8160 172.16.2.12:8160 8.8.8.8:8160       8.8.8.8:8160
    create 00:01:13, use 00:00:00 timeout:60000, left 00:00:59, Map-Id(In): 1,
    flags:
extended, use_count: 0, entry-id: 5, lc_entries: 0
icmp 192.168.10.211:7191 172.16.2.13:7191 8.8.8.8:7191       8.8.8.8:7191
    create 00:01:13, use 00:00:00 timeout:60000, left 00:00:59, Map-Id(In): 1,
    flags:
extended, use_count: 0, entry-id: 4, lc_entries: 0
R1#sh ip acc
R1#sh ip acce
R1#sh ip access-lists
Standard IP access list 1
    10 permit 172.16.2.0, wildcard bits 0.0.0.255 (6 matches)
R1#sh ip access-lists
Standard IP access list 1
    10 permit 172.16.2.0, wildcard bits 0.0.0.255 (6 matches)
R1#sh ip int f0/0 | i (translation|NAT)
  Network address translation is enabled, interface in domain inside
  Output features: NAT Inside, Stateful Inspection, NAT ALG proxy
R1#sh ip int f0/1 | i (translation|NAT)
  Network address translation is enabled, interface in domain outside
  Input features: Stateful Inspection, Virtual Fragment Reassembly, Virtual Fragment Reassembly After IPSec Decryption, NAT Outside, MCI Check
  Output features: Post-routing NAT Outside, Stateful Inspection, NAT ALG proxy
R1#sh run | i nat
 ip nat inside
 ip nat outside
ip nat pool PG1X-POOL 192.168.10.211 192.168.10.211 netmask 255.255.255.0
ip nat inside source list 1 pool PG1X-POOL overload
R1#

References

tech/network/cisco/pat/pat.txt · Last modified: 2018/04/11 08:35 by wnoguchi