- [Instructor] In this video, we're going to consider
the configuration of Port Address Translation, or PAT.
That's another variant of Network Address Translation,
and personally I find myself using that most of the time
because usually in small office, home office environments,
we don't have a big pool of addresses
that our service provider has given us
that we can translate into.
Instead they give us one address,
and we might have to pay extra money
just to get that one address that doesn't change over time
to pay for a static IP address.
So what do we do if I've got let's say,
100 devices inside of a network,
but I've only got one publicly writable IP address?
Well we can use PAT, Port Address Translation,
which is going to keep track
of all the individual traffic flows
by paying attention to port number information.
And we're going to be using the same topology
that we've used in our prior two videos.
So I need to begin again by getting rid
of our dynamic NAT configuration.
I'll say no IP NAT inside source list one
for the pool named pool.
We'll get rid of that.
It says, are you sure you want to delete this?
Yes, I'm sure.
Let's get rid of our Access Control List.
I'll say, no IP access-list.
It was a standard Access Control List numbered one.
And I'll say, no IP NAT pool named pool,
and it ranged from 192.0.2.101
through 192.0.2.199
with a netmask of 255.255.255.0.
Now, let's start on our PAT configuration.
Oh, by the way, just like we did on our prior video,
I did not delete our original IP NAT inside command
on gigabit 0/1 nor our IP NAT outside command
on gigabit 0/2 because that's still needed.
That's needed in all these different NAT variants.
We need to say who's the inside and who's the outside,
so those commands are in place
just as we had in our prior two videos.
Now let's configure PAT.
Now, like dynamic NAT, I still need an Access Control List
to match addresses that are local,
that are inside local addresses.
And it's exactly the same Access Control List
that we had last time that we could use.
I'll just enter it again.
I'll say access-list one,
and I'll permit the network of 192.168.1.0
with a wild card mask of 0.0.0.255,
but this time I'm not going to specify a pool of addresses
to translate these inside local addresses into
because I've only got one address.
And it's whatever address happens to be currently assigned
to my outside interface, gigabit 0/2.
Here's how we do that.
I say, IP NAT inside source list one.
So far it looks very similar to dynamic NAT, doesn't it?
That's my source, but I'm going to translate into
whatever the IP address is on interface gigabit 0/2.
Now, here's the key word.
This is the key that turns on Port Address Translation
and allows me to have more than one translation
into that interface's IP address.
It's the key word of overload.
In fact, this is sometimes called NAT overloading.
All right, let's bounce out of this and go over to our PC
and generate some traffic.
And I'll create some different traffic flows
using different port numbers.
First of all, let's connect using a web port
out to the internet.
I'll say, telnet 1.1.1.1,
and I'll specify the port of http,
so I'll say port 80,
and I have a web service running on a router
out there on the quote unquote internet.
And let me disconnect from that.
Let's create just a regular telnet connection.
I'll say, telnet 1.1.1.1, so that's going to use port 23.
Now I don't have it set up where I could log in,
but the flow still went through.
Now, let's go over to our router
and do a show IP NAT translations command,
and we can see each of our flows that we just created.
Notice we went from an inside local address
of 192.168.1.100,
and we were translated into
the IP address of our interface of gigabit 0/2,
which was 192.0.2.100.
But, here's the key point, notice the port numbers.
We're keeping track of port numbers now
in our IP NAT translation table
so that we can distinguish between different packet flows.
Now in this case,
I didn't have any kind of overlapping port numbers.
I only had one PC, so, as we indicated a few videos back,
we kept our original dynamic port number,
which in this case was 40,848.
We kept that when we translated it
into an inside global address,
but here's our outside global.
Notice 1.1.1.1:23, that was our telnet session,
and :80 that was our web session.
And that's a look at
how to configure Port Address Translation.