So if you've done the lab and you are ready for a walk through of those lab
tasks and confirmation of those tasks,
this is the video for you because that's what we're going to do right now.
So with these lab tasks in mind, let's get to work.
So just as it heads up, I have reset the lab back to its base initial
configuration.
So let's open up the lab topology here on the desktop of the lab.
Fantastic. And let's go ahead and go into server one nug by selecting it and
then double clicking on it.
Give that a moment to initialize and then we'll begin our configuration.
All right. And here we go. So let's go to our four. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All right. And here we go. So let's go to our four.
So interface F a four slash one and gig one zero are going to be inside and gig
two zero is going to be outside.
So on our four, we'll go into interface configuration mode for fast ethernet.
In fact, let's do range interface range for fast ethernet four slash one comma
as well as gigabit ethernet one slash zero.
Enter and now in range configuration, we can say IP net inside and press center
and then we'll go to interface gig two slash zero.
And we'll say IP net. Whoa, look at that. It didn't like that all at once.
Well, let's troubleshoot if we have to. Let's keep on going IP net outside and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well, let's troubleshoot if we have to. Let's keep on going IP net outside and
then gig two zero is to an IP net outside and press center.
All right. Let's do a show process CPU and let's see how busy this is.
Huh. Didn't look like that busy. So it did have a little bit of stress there
for a moment.
As I input both of those inside interface commands on gig one zero and four one
, but looks like it's still going.
So although tracebacks are not always a great sign, I'm going to go ahead and
proceed.
We can also verify what we've done with the show IP net statistics just to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can also verify what we've done with the show IP net statistics just to
verify that it knows that gig two zero is the outside interface and one zero
and F a four slash one are inside fantastic.
So let's create our static net and that's going to be for PC 30.
So for PC 30, if we look at our topology here, it has the IP address of 10 30
zero dot 51 and we want to map that to 23 dot 1 dot 2 dot 51.
So in configuration, we'll say IP net inside source static and then we'll put
the source address, which is 10 dot 30 dot zero dot 51 space question mark.
And then the global, routable address is going to be 23 dot 1 dot 2 dot 51 and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then the global, routable address is going to be 23 dot 1 dot 2 dot 51 and
then let's go ahead and test that.
So if we go over to PC 30 and we do a ping to 23 dot 1 dot 2 dot 100 and press
center that's working.
And if we go back to our four and do a show IP net translations and press
center, there is our static translation and ICMP is currently being used over
that translation fantastic.
So there's our static net.
The next task is to use a nap pool with the range 23 dot 1 dot 2 dot 65 through WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The next task is to use a nap pool with the range 23 dot 1 dot 2 dot 65 through
126 with this last 26.
So we'll create that nap pool next so to create that will type in IP, not pool.
Go ahead and name it and I call our pool space question mark and the started
rest is 23 dot 1 dot 2 dot 65 space question mark.
Any address is 23 dot 1 dot 2 dot 1 26 space and we use prefix in the demos.
Let's go ahead and use net mask and that mask is going to be a slash 26 so it's
255.
There's eight.
There's eight more and eight more and then we need two more and there we have
it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it.
Perfect.
So we'll create the access list.
Let's create access list.
100 from it 10 dot 10 dot 0 dot 0.
We only care about the first three octets.
So the B zero dot 0 dot 0 for the wild carpets dot 25 meaning we don't care
about the last octet and there's our access control list.
Oh, you think that wouldn't happen after 20 plus years of working with us. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Oh, you think that wouldn't happen after 20 plus years of working with us.
So because I'm making an extended access list, it needs to know for example
what protocol.
So I'm going to hit the upper key and I'm going to say let's use access list 10
, a standard access list.
And then we are only focusing on the source and it should be much happier with
that.
So it just goes to show that practice hands on over and over again is going to
help make you better and better and better and refreshing those skills from
time to time is not a bad idea as well.
So there's our access control list that's matching on 10 10 zero anything.
Next, let's create a net rule that's using that access control list. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Next, let's create a net rule that's using that access control list.
And if it matches on the access control list, we'll use our pool and syntax to
be IP that inside source list.
And then we'll go ahead and put our access list number in there.
So I'm going to go ahead and copy paste 10 space and it will specify pool.
And then the name of our pool, which is our pool.
I'll copy paste that.
So I don't have a typo space question mark.
And that looks good.
And we'll press enter.
So now our windows client, which is right here in the bottom left of our top
ology.
Should be able to go to the server. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Should be able to go to the server.
So we go to that client and client.
And I'll reach will up here in the upper right.
So we'll go ahead and select client.
Nug and double click on it to bring it up.
So there's client.
Nug.
Let's bring up a command prompt on client.
Nug gets it 10.10.0.50.
And let's do it IP config just to confirm.
So 1010.0.50.
And let's do it IP config space slash all.
And sure enough, it's using 23.1.2.100 our server as a DNS server.
So if we used NS lookup and we looked up, for example, how about PC 20?
And it didn't get a response.
How about PC 30? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
How about PC 30?
So one question is, is it not making the request or is the request going out
there,
but the server doesn't have a configured.
So let's go back to our four.
So we'll back to server one.
So we minimize our client.
Let's go back to server one and let's go to our four.
And on our four, let's just show IP NAT translations.
So we should have those requests, even if they weren't responded to correctly.
So those are going out to the server 23.1.2.100.53.
And the source IP address was 10.10.0.50.
And here's our source port.
So because I'm here sitting at server one, let's kind of re-app server manager WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So because I'm here sitting at server one, let's kind of re-app server manager
for a moment.
And let's take a look at the DNS entry.
It's just to verify we have a DNS entry we can pull back.
So here in server manager, we'll go to tools.
And oh, we don't have DNS setup.
That would explain why DNS isn't performing for us because DNS isn't running on
the server.
So let me go ahead and close that.
And let's use a different tact.
So let's go back to our client PC, which is right here.
And let's go ahead and close that.
And let's open up a browser.
And let's go to the web server. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's go to the web server.
And let's go to the web server showing on that server.
So we'll launch Chrome.
And here in Chrome, I'm going to click on the bookmark there for HTTP 23.1.2.
100.
And I'm going to hit a five a few times to refresh that.
That's looking good.
And as that loads, let's go back to server one.
And at server one, let's go to the tab for our four.
And do a show IP NAT translations.
So now in addition to a whole bunch of DNS requests that are not being
responded to, we
now are going to have some port 80 requests as well.
So here's an example of that right here.
So the source address is 1010-050. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the source address is 1010-050.
The translated address going out is 2312-65.
And it's going to the server at 23.1.2.100-2.80.
So where are we in our configuration?
So we do a show run pipe, including that.
As well as see what rules we have in place.
So here is our pool we created.
Here's our rule that says if you match access to 10 as a source address, you
can use an IP
address from that pool.
And here's our static mapping.
But what we haven't done is the dynamic mapping for 10, everything else.
So let's go ahead and fix that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's go ahead and fix that.
So let's do a do show access list.
And let's create an access list that matches on 10, anything.
So access list, let's call this 11, permit 10, anything, with the first octet
matching and
wild card bits for the second, third and fourth octet.
So with this access list 11, let's make a new rule with IP NAT inside source.
The keyword list we'll put in 11.
And if traffic matches that, we want to use interface gig and let's take a look
at our
topology here.
We want to use interface gig 2,0 that outside interface and the IP address
sitting on that.
And we want to overload that.
So interface gig 2 slash 0, space overload. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So interface gig 2 slash 0, space overload.
And now let's test that out.
So we should be able to go to anything else other than the 10, 10 address space
and trigger
that dynamic pat rule.
So let's go to PC, let's go to PC 12 because that's on the 10, 12 subnet.
And that should fall under the umbrella of 10, anything.
And it should be a dynamic translation to the outside address of 23 at 1.2.4.
So let's hit over to PC 12 and let's do a ping out to 23 at 1.2.100. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's hit over to PC 12 and let's do a ping out to 23 at 1.2.100.
Press enter that ping is working.
Let's go to our four and do a show IP NAT translations and press enter.
So I'll go down a few pages and here we go.
So there's our 10 dot 12 dot 0 dot 51 and it's being mapped to the outside
address at
23124 which is the interface address on gig 2, 0, 0.
So we've just confirmed that our port address translation is also working.
And if we went back to PC 12 and let's do a question mark to see what options
exist here
on this little virtual PC.
We've got ping and we have trace. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We've got ping and we have trace.
So let's do a trace to 23 dot 1 dot 2 dot 100.
And for the protocol, use dash capital P to specify the protocol.
And let's go ahead and use protocol TCP.
So we'll do that by specifying a six here, press enter.
And now if we go back to our four and hit the up arrow key and do a show IP NAT
translations
once again and then space party to the bottom here once again is 10 dot 12 dot
0 dot 51
mapped out to the IP address that's on gig 2, 0 of our four.
And this is the TCP session that we're currently tracking at the pat device. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And this is the TCP session that we're currently tracking at the pat device.
And again, depending on the protocol and the version of software that you're
running,
it's often common to see the source port that the client used with pat be also
changed
here.
And if it's being translated, if it's the IP address, it's being translated on
the reply
that is going to be untranslated.
And if the pat device did a translation of the source port as well, that also
would be
untranslated for the return traffic coming back to the client.
So thanks for joining me in this set of videos in this skill regarding working
with, configuring
and verifying NAT and its little cousin, Pat in a Cisco environment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and verifying NAT and its little cousin, Pat in a Cisco environment.
And I look forward to seeing you, my friend, in another set of videos very,
very soon.
Until then, I hope this has been informative and I'd like to thank you for
viewing.