- [Instructor] In this video we're going to take
a look at the configuration of dynamic NAT
and when our prior video on static NAT we said
this static IP address is going to be translated
into this other static IP address.
Well, while that works fine,
it doesn't scale very well
if we've got a bunch of inside local addresses
or if we have several inside global addresses
into which we can translate.
What we're going to do here is create an access control list
that's going to match any IP address
living on the inside of our network
and we're going to have a pool of addresses
that are publicly ratable addresses,
and what GNATS going to do is say,
if this incoming packet is
matched by the access control list,
then it's an inside local address
and I'm going to pick one of the inside global addresses
I have available from this pool
and I'll translate the inside local address
that matches the ACL
into this inside global address
that I just pick from a pool.
Now let's get into the configuration
and we're doing this on the same typology
that we already had,
so let's get rid of
our static NAT configuration first of all.
Let's say no IP NAT inside
source
static
and we in our prior video,
we're using 192.168.1.100
and we were translating that into 192.0.2.101
Now I'm not going to remove the commands that say
which interfaces are inside interface
and which interfaces are outside interface.
We still need that in place
and we're using the same topology
so I'm just going to leave that,
but if you didn't already have that,
you would need to go in
and you would need to give those commands again,
I went into interface gigabit 0/1
and I said IP NAT inside,
we did that in the prior video
and I went into interface gigabit 0/2
and I said IP NAT outside,
so that's already done here.
Now let's create the access control list
that's going to match an IP address
on the inside of our network,
that's going to match our inside the local addresses.
Let's say access-list
and I just need to match source IP address information
and that means I can just
use a standard access control list.
I'll say access list 1,
I'll say permit
and then I'll say 192.168.1.0
and remember with an access control list,
instead of giving a subnet mask,
we give a wildcard mask
and I've got a subnet of a /24
that means my wildcard mask is going to be 0.0.0.255
and we'll press Enter.
That creates our access control list
that's going to be used to match inside local addresses.
Now let's create the pool of inside global addresses.
To do that, I'll say IP NAT pool
and I'll give it a name,
and I'll use the OSO Creative name of POOL.
Notice I'm using upper case though
to distinguish it from some sort of a Cisco iOS keyword,
I know it's something I created typically,
if it's all in upper case,
and I'll say this pool of addresses
that we have the luxury of having,
which is not that common,
we have a pool of addresses beginning at 192.0.2.101
going all the way through 192.0.2.199.
Now I say what is the network mask for this?
What is the subnet mask?
So not a wildcard mask here.
This is going to be the subnet mask.
I'll say netmask
and give the subnet mask of 255.255.255.0
and now I've created my two different entities.
I've got my ACL that's going to match inside local addresses
and I've got a pool of inside global addresses.
Now, the next command is the connective tissue
that ties everything together.
I'm going to say IP NAT inside source list 1.
The one is the number of the access control list
and I'm going to map the inside local address,
matched by this access control list
to an address in the pool named POOL.
All right, let's go test it out.
By going over to our PC,
I'll say can I ping
1.1.1.1
yes I can.
Let's go back over to R1
and we'll do a show IP NAT translations command,
and this looks very similar
to what we saw in the previous video.
We see that our inside local address was our pc1
at 192.168.1.100
it matched the access control list
and it was translated into a member of this pool
and the first member of that pool was 192.0.2.101
and we were going to an outside global address,
we did a ping to 1.1.1.1
Oh, here's another verification command by the way,
that can be handy when you're verifying
your troubleshooting NAT.
It's show IP NAT statistics
and I think this is useful for
getting a quick look at who is the inside interface
and who is the outside interface.
It tells us very clearly here
that the outside interface says gigabit 0/2
and the inside interface gigabit says 0/1.
It also shows that we're doing dynamic mappings
and the inside source address
is going to be matching access list 1
and we're translating it into the pool named the POOL.
In fact, we see details about the members
of that pool right here
and that's a look at dynamic NAT.
However, this assumed that we had a big pool of addresses
into which we could translate
our inside local addresses
and as we mentioned earlier,
that's not always the case.
Frequently we just get a single IP address
into which we can translate.
How do we handle that?
We're going to handle that with port address translation.
Let's take a look at our next video
on how to configure port address translation or Pat.