So now's the opportunity to test and verify and validate that the translations
are working as expected.
So with that in mind, and this game plan that's been implemented, let's do some
testing.
Here on R4, I'm going to start off by doing a clear IP NAT translations and an
asterisk.
Now behind the scenes, the Windows client, especially, is making lots of
requests for DNS and other
things out to that server. So it's going to create some translations right away
. But let's just
look at the configurations as we did them. So for static NAT, that's PC30, if
we go to PC30, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we go to PC30,
and do a show IP, that has the IP address of 10.30.0.51. And so if we did a
ping, for example,
to 23.1.2.100, and this is confirmed that address as well, that's the IP
address here of our server,
just off of R4, and we press Enter. That works. Great, great, great. And we
should see some ICMP
based translations between the client at 10.30.0.51 using the translation we
set up for it
with a static translation. So if we go back to R4 and we do a show IP NAT WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
with a static translation. So if we go back to R4 and we do a show IP NAT
translations and press Enter,
there is our static translation right there for 10.30.0.51. And these represent
the individual
pings that were used between that client 1030.0.51 as it communicated out to
the server at 23.1.2.100.
And if we went back into trace to 23.1.2.100, and let's use -p for 6. Let's use
-p6 for protocol 6.
There will be TCP based. Then we can go back to R4, use that same command again
,
and we should see some TCP based traffic. And there is that session right there WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we should see some TCP based traffic. And there is that session right there
.
Next, let's go ahead and verify our dynamic NAT. And one way of doing that is
to double click here
on clientnug, go to a command prompt. And here, let's do an IP config to verify
its IP address at 10.10.0.50.
And let's do a ping out to 23.1.2.100. So in our topology, that's from this
windows client
machine in the bottom left going to the server on the top right. And we are
getting a response.
Let's also go ahead and let's open up a browser. So if you open up a browser
here on our little WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here on our little
windows client, so I'm going to do that by clicking on the shortcut for Google
Chrome right there.
And then once Google Chrome comes up, I have a shortcut for the server at 23.1.
2.100.
I hear in the bookmarks. So if we click on that 23.1.2.100, that should bring
us to the server.
And, yeah, there we go. So it took a moment. And here it comes. So while that's
happening,
let me go back to our four. And here we do show IP NAT translation. Here we
have the IP address 10.10.0.50
being mapped out to an IP address from the pool of 23.1.2.65. So based on the
ports involved here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ports involved here,
there's tons of UDP traffic that is DNS. For example, right here, that's the
DNS request.
But based on the TCP session that we just did with HTTP, there should also be
some TCP as well.
And here's an example of one of those right here, where it was attempting,
based on the port,
there was attempting to go to the server at 4.4.3. And then it fell back to
port 80, because I don't have
HTTP has services running on that server. So the source address was 10.10.0.50.
The source port was 56,690.
The source address got translated to 23.1.2.65. The source port was left the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The source address got translated to 23.1.2.65. The source port was left the
same. And then it went
out to the server 23.1.2.100 to the destination port of 80. And the reason
these two columns here
are the same is because we weren't on that initial flow of traffic. We're not
doing destination
that. So the original and final destination regarding the IP address in the
port that didn't get changed.
So we've tested static that we've tested dynamic that coming in from client.nug
here 10.10.0.50.
Let's also test from PC 12 as well. So let me go ahead and do a clear IP net WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's also test from PC 12 as well. So let me go ahead and do a clear IP net
translation just to go
ahead and make a little bit cleaner and then we'll do a show IP net
translations. And this new one
right here is from our Windows client making a DNS request. So currently though
we have 10.10.0.50,
but we don't have 10.12.0.51. That's PC 12. That's because PC 12 hasn't sent
traffic yet. Let's go ahead and
change that by going to PC 12. And let's go ahead and do a ping to 23.1.2.100
as a test. And this also
do a trace that same address 23.1.2.100 that'll use UDP. And then we go back to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
do a trace that same address 23.1.2.100 that'll use UDP. And then we go back to
our four. Hit the
upper key to a show IP net translations. And as now that we have a translation
for 10.12.0.51,
mapping over to another IP address in the pool, which is 66. And here's an
example of it translating
with UDP. And here is an example of it translating for the ICMP traffic based
on the ping. And the last
one we have that we haven't tested yet is the dynamic pat for everybody else.
So by that, if we took
an example of let's say PC 20 as this sends traffic out to that server in that
direction, because it's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
direction, because it's
not going to match the rules for dynamic net. And there's no static net
configured for it. It's
going to fall into the bucket of dynamic pat because it's going to match 10
anything. And it should
get a translation dynamically to the IP address on gig 2 0 here on our four,
which is 23.1.2.4. So
let's go to PC 20 and generate some traffic out to the server. So we'll go to
PC 20. And there we
are. There's the IP address 10.20.0.51. And I want to generate some TCP traffic
. If we
under that with a trace, we can do trace from this little virtual machine. We WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
under that with a trace, we can do trace from this little virtual machine. We
can do a trace to 23.1.2.100.
That's the server's address space dash capital P. And then we can use six. And
that's the protocol
number for TCP. So we'll go ahead and generate that trace that trace is working
. Let's go back to R4
and do a show IP net translations once again. So PC 20 is right here. That's 10
.20.0.51. And notice
that it didn't give it a static mapping. And that's because it's dynamically
mapped to the outside
IP address, the 23.1.2.4 with ported rest translation. So there's the pat for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
IP address, the 23.1.2.4 with ported rest translation. So there's the pat for
PC 20's
address. And as a further test, what we could do is we could send traffic out
to that server. And we
could source it from gig 2 0, which is 10.20.0.2. We could also send some
traffic source from R2's gig 0 0,
which is 1023 0.2. And we can see that both of the addresses as they go through
the pat device with
dynamic pat that they're both being translated to the same external address of
23.1.2.4 with pat.
So let's do that next. So here on R2, let's go into a show IP interface brief. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's do that next. So here on R2, let's go into a show IP interface brief.
So let's send some
traffic. We'll source some of it from gig 2 slash 0, which is at 10.20.0.2. And
we'll source some
other traffic from gig a bit 0 0, which is 10.23.0.2. Let's do a trace because
they'll use UDP by default
here on a Cisco router. Let's do a trace to 23.1.2.100 press center. And I
forgot to say source it from
which address. And so I'll say source from the IP address on gig 2 slash 0. And
I'll do it again, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'll do it again,
but I'll source it from interface gig 0 slash 0. And then let's take a look at
the NAT translation
table over on R4 with a show IP NAT translations. So this here we have the IP
address 10.20.0.2 being
translated to 23.1.2.4. That's the outside address on R4. And then down here we
have 10.23.0.2,
which is the gig 0 0 interface, also being mapped to that same address of 23.1.
2.4. Now
depending on the version of iOS and what's going on with that router with port
address translation WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
address translation
with overload, it also may swap out the original source port. So if the client
was using for example
49,181, the router doing port address translation can swap that source port
along with the source
IP address over to a different source port. And that way if you have a conflict
, for example,
if two or three devices inside that all happen to use the same source port, the
path device has
the ability to swap out that port information as well. So whatever it
translates on the initial
flow of traffic going out, it'll un-translate that on the way coming back. So
that includes the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that includes the
layer 3 IP address. And if it manipulates the port information, it'll un-trans
late the port
information as well. Also, if we do a show IP NAT statistics one more time,
here we can confirm
not only what the interfaces are with network address translation and also what
the rules are,
but we could also get a feel for the hit counts as far as how often they've
been used.
Also, if we do a show access list and press center, it also have matches
regarding when those
access lists were hit as part of the NAT rules and path rules. And for the
dynamic NAT, because once
we have a NAT translation in place and until it times out, that layer 3 mapping WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we have a NAT translation in place and until it times out, that layer 3 mapping
that one to one
mapping is simply going to stay. Where on the other hand, with dynamic pad, it
's going to simply
map it to the outside address in our case. That's the outside interface gig 2,0
interface on our 4.
And then once that individual translation times out, if that client goes out
again, it'll rematch
on that access control list and as a result, it'll create the new translation.
So another we have
the opportunity to make a plan and implement that plan regarding static NAT and
dynamic NAT and
dynamic pad. In the next video, I'd like to present a hands-on lab that you can WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
dynamic pad. In the next video, I'd like to present a hands-on lab that you can
use to get practice
working with, configuring, verifying and when needed troubleshooting pad on
your own. So I'll see
you in the next video in just a moment.