In this video, you and I get to put a game plan together
for our design, implementation, and verification
of network address translation.
And here is what I would love to do.
I would love to modify our existing topologies
just a little bit, and I would like to go ahead
and instead of having this be my management network
that I'm double-dipping on, I'd like to go ahead
and use VLAN 23 right here as the external segment
where we can reach an external router over.
So the tier zero gateway is currently connected
to my 192.1 state network, but I'd like to go ahead WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to my 192.1 state network, but I'd like to go ahead
and use VLAN 23, which has the addressing space of 23.1.2.0
with a 24-bit mask.
I've got an external router connected right here at .1
on the 23.1.2 network.
And so for edge one and edge two here,
let's go ahead and use .61 and .62.
Make a little note, that's edge one, and this will be edge two.
I've also got OSPF configured on this edge already,
so once we modify our tier zero gateway
and move it over to this external segment
from VLAN 23 and update the addresses, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
from VLAN 23 and update the addresses,
we'll also take a quick peek at the OSPF configuration
just to make sure we have OSPF enabled
on these two interfaces.
And that way, this gateway right here
can dynamically learn about the 1010 network
and the 1020 network as we did in previous videos
regarding IP routing.
And in those previous videos, we did it with BGP
and we also did it with OSPF.
So if this gateway here,
this external router is already configured for OSPF,
we just need to make sure we enable it here
on our tier zero gateway.
I also think by doing that,
there'll be a great exercise in walking through that process again WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and to see those changes being made
and then we can verify them together.
So our first step in our game plan
will be to update our topology.
Next, let's go ahead and deploy some VMs
that we can test with.
So we already have these four VMs already in place
and what I'd like to do is add a couple more.
So I'm gonna add another VM down here to segment 10
and I'm also gonna put a little VM up here on VLAN 23
and that way we can test and verify
our network address translation going through our environment here.
'Cause my intention is to go ahead and implement NAT here
on our tier zero gateway zero. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on our tier zero gateway zero.
So deploy VMs for testing.
I also have DHCP services up here on VLAN 23
and also down here on segment 10.
So for the new VMs,
I won't know what those IP addresses are gonna be exactly
until we bring up those VMs
and then we'll take a look and use those addresses.
Then as we start configuring NAT,
let's go ahead and first configure source NAT.
Again, we're gonna do that right here on our tier zero gateway.
And here's what I propose we do.
Let's go ahead and let's do source NAT at tier zero
for any traffic sourced from 10.10.anything. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for any traffic sourced from 10.10.anything.
And for address translation, my lab environment,
I've got the whole 2312 network to play with.
So as we do that source address translation
for traffic on our initial flow,
it's going out to the internet.
Let's go ahead and map that to 23.1.2.151 through.
Let's go ahead and do 250.
So for my lab environment,
allowing a hundred unique IP addresses here
that can be translated to
but be more than enough to support
the two or three that we're gonna have right here.
So if we implement this,
it's gonna be a one-to-one mapping
for those first effectively hundred clients WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for those first effectively hundred clients
that are going through
and getting an address translation with source NAT.
Or if we said, you know what,
we just wanna map it to one address
like 2312.151 and that's it.
Then all those clients will be mapping to a single IP address.
And that would be an example behind the scenes
of using PAT or port address translation,
just based on if it's a one-to-one mapping
or many-to-one mapping.
So we'll set that up and verify
that our clients here on this network
can go out to the internet.
We'll also, when we update our topology verify
that right here on this connection
between our tier zero gateway and the external router, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
between our tier zero gateway and the external router,
we'll also verify that this gateway zero
has a default route and that it itself
can get up to the internet.
That way when we add network address translation here,
the clients who are now forwarding traffic
out towards the internet can get the address translation
and can go up to the internet.
Again, that would be due to source NAT.
Let's also walk through an exercise
of setting up destination NAT.
And for that, we'll pick a global address.
Let's go ahead and pick 23.1.2.
Let's go ahead and use 254.
We use the last valid IP address in that range there. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We use the last valid IP address in that range there.
And let's map that to the internal address
of one of our VMs.
So we could map that to VM1 or VM3 or better yet.
We could use a new VM that we're gonna bring into play.
And so this server right here,
we'll go ahead and label it as server.
It's gonna get an IP address via DHCP.
So whatever IP address that gets, we'll use
and we'll map the external globally-rattle address
to 23.1.2.2.2.2.2.
That guy's IP address, whatever it happens to be.
And for the lab, I have this 23.1.2 network,
which on the public internet is a valid IP address range, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which on the public internet is a valid IP address range,
but I'm just using it privately here in my lab.
And that way we get a very clear differentiation
of what are the private addresses here
and which ones are the public addresses.
So anything in my lab environment here that starts with 23
is a representation of a globally-rattle address
on the internet.
Now also, as part of this, you might ask,
well, Keith, if you swap out on the source that part,
if you swap out, for example, VM1's address
and you give it 23.1.2.something in this range
for the address translation,
and it goes up to the internet.
Well, the internet, if it tries to respond back, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well, the internet, if it tries to respond back,
it's gonna respond back to wherever that real address lives
and not back to your home lab environment.
So I also wanna point out something else
that I have going on that's also important to know about.
And that's this right here on the other side of this gateway.
I am also doing NAT again.
So I'm taking the addresses that come in
from 23.1 to anything after we do our NAT work here.
And I'm mapping it over to globally-rattle addresses
over here on this device as well.
And that way, as this client really goes up to the internet,
it's actually having that happen here,
which we'll verify together. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which we'll verify together.
And it's also having that happen here
just for reachability to the public internet.
So all that second layer of NAT isn't too critical
like for a production environment to be aware of.
I did want you in my lab environment
to be aware of how I'm pulling that off.
So that is our game plan.
So in our next video,
we're gonna begin with the update of our topology,
verify basic connectivity,
then we'll proceed to VM deployment
and then source NAT and destination NAT.
I'll see you as we continue this journey in the next video.