So we'll begin here with Network Address Translation or NAT for short, but in reality we're going to cover Network Address Translation and Port Address Translation in this discussion.
So why do we need something like Network Address Translation? Well it really comes down to the fact that we need a way to go to the Internet even though we have IP addresses on our systems that don't allow us to do so.
Remember, inside your organization you're using private RFC 1918 addresses. So your address ranges are what? 10.0.0.0 to 10.255.255.255.
You have 172.16.0.0 to 172.31.255.255 and then you got 192.168.0.0 to 192.168.255.255. Those are the three different ranges you have that you can carve up and submit as you need to.
The thing about these RFC 1918 addresses is we're all using them inside of our organizations. I use them, you use them, we use them in our homes, we use them in our headquarters, our branch offices, our data centers and so on and so forth.
And so because all of our devices are addressed with these RFC 1918 addresses, we can't allow them on the Internet because if we allowed them on the Internet then that would conflict with other people that are using that exact same addressing space.
So what do we have out on the Internet? We have public IP addressing out on the Internet. So we need a way to allow our users who are using private IP addresses in order to go to the Internet and use a public IP address while they're on the Internet and that's where network address translation comes into play.
So over here as an example we have PC number one. They are 10.0.0.10. And so they built a packet and that packet is sourced from them going over to the web server at 8.8.8.8 in our example up in the upper right hand corner.
And so this is created by the PC. It's going to be sent out on the network and these RFC 1918 addresses are routable inside of our organization. So the packet can be routed based on any type of destination private IP address.
In this case we have a destination public IP address but if the destination was private as in when the traffic is returning it's routable through our environment. The thing is that they're not routable on the Internet. So your service providers are blocking the ability for you to be able to accidentally send or on purpose send packets to the Internet that are sourced or destined or whatever from these private IP addresses.
But you should really consider yourself making sure that you have an access control list set up at the edge of your environment that is denying all traffic from leaving your network if it is sourced from any one of those public IP addressing spaces. This is going to protect you just in case. So that way there are nothing accidentally goes out here unless it absolutely needs to go out there after it has been translated.
Nothing should leave my environment unless it has successfully gone through network address translation. So in this case I'm just denying all of those RFC 1918 ranges and we're permitting what we're going to be using for network address translation from a public IP addressing standpoint as source addresses. And then I'm denying that on my interface outbound in that case.
So this ensures that in the end if network translation fails or doesn't work the packets not allowed to leave the environment because the access control list is going to block it in that particular case. So now when we get to this network this router here this router is the entity that's running network address translation in this particular environment.
So what it has to be configured with is network address translation policies network address translation configurations is a better way to put it in this case is not actually policies. So we have these network address translation configurations and it's going to identify how we want to do translation. So in this particular case we are going to be translated anything that is sourced from this address to this address right over here.
So we go back one page it's this address to this address. So there is a source address. We need to route it out. So we got to translate it over to that. So the router is going to successfully translate it for us.
And then it can go and it keeps an entry of that in its NAT table. So this is our NAT table. And so now keeps an entry of what is the private IP what is the public IP we translated it to and what is the destination that they are trying to reach. And this is important because when the traffic comes back all three of these pieces of information are going to be necessary in order to translate the traffic when it arrives back at the environment.
So in this particular case now we can send it out and it goes and goes and goes and goes and goes and goes until it reaches the destination. So as you can see it's actually sourced now from an address that's associated with that particular router for network address translation. It's no longer sourced from the client.
So you kind of get to hide your clients from the Internet and a lot of people consider that a security feature and there are I recently wrote a book the CCST cybersecurity book for Cisco and Cisco makes a note that yes network address translation is a type of security. Not really like when you really get into the deep details of network address translation.
Yes it provides a little bit of security by masking your clients nobody can see who exactly the client is but in reality if a cyber criminal if a cyber criminal really wants to figure it out they're going to be able to figure it out right they're going to be able to get to your client regardless of whether you hide their real IP address or not.
So yeah it's a type of obfuscation it's a type of obfuscation absolutely when you think about it but you know it's if you if somebody asked me as a CISSP is network address translation security I know it's not right it's what to translate addresses.
Yeah but you know you don't really know the client IP look cyber criminals this is a joke to them this is a joke this is nothing. So if you're just using network address translation as a form of security for yourself you know beyond that you need firewalls you need a whole bunch of other security features in order to make sure you're secure and that's not going to do it for you when it's all said and done.
All right but yeah I mean if I'll tell you this though but on Cisco exams if and you probably won't have it on this exam but if you ever had a Cisco exam and they said what are the following benefits benefits of using that one of the things that Cisco expects you know that security okay well yes and no all right.
But for in the Cisco world you say yes but if you're a CISSP you'd be like no no no no. All right so with that in mind now our web server has gobbled it up in this particular case and so now when it creates a packet to return everything to the source remember our source is this but here's the deal right now the source is actually this when you think about it.
So we create from the source of the web server to the destination of this so return traffic so notice how everything's flipped over now right so this was the original source coming to the web server so now it's the destination coming back so everything's flipped.
So now eventually that all arrives back and this is where that NAT table becomes very very important you know remember how we kept track of who the destination was do you remember that in the NAT table well thank goodness we did because come back here originally we kept track of the destination and the destination was 8 8 8 8.
That's where we're going who on the internet are we going to this is important because now we receive something with this and this so we have this piece of the puzzle this piece of the puzzle okay what is this piece of the puzzle then and that's where the table comes into play the table says okay so now if it's source from this going to this so source from this going to this change it back to this so we changed it back to that.
Right and now we can go ahead and route it and now that we route it we send it on its way so NAT on the way on the way out routing happens first NAT happens second on the way back NAT happens first routing happens second.
All right so that's the gist of NAT now the thing about NAT is there's many different ways that we can implement it for example the way I just described to you is just one way it's about translating private IP addresses to public IP addresses that's what we're doing but you can use NAT in four different combinations for example you can do private to public translations like we're doing here but you can do private to private translations this is typically common when you are merging two companies together and if you're both using the 10 network.
And you have overlapping address spaces for a temporarily temporary solution you might NAT between those two environments so that way there you don't have IP addressing conflicts in that particular case you might do public to private translation so for example in a scenario where you have a server inside your environment.
That needs to be accessible from the Internet obviously the server wouldn't be located there if it was accessible from the Internet but let's say there's a private IP address well in this case we'd be doing public to private IP addressing so when people try to access my server then the public address that is well known on the Internet is translated to the private address so we can get to the server and back so nobody really knows the private IP address of the server they just know the public IP address of the server but I mean if a cyber criminal really wanted to figure it out they'd be.
Able to the good ones anyways and the last but not least public to public that's right you know out there there might be scenarios where ISPs are doing public to public translation for different situations and services right so our goal for the exam is to be available or be able to configure verify and troubleshoot private to public translation so that's what our discussions can be about so in that case we need to have very specific terms that we know and that is inside local address.
So the inside local address in this particular case is going to be the private IP address inside our network so that's the private IP address inside our network.
The inside global address is a little bit confusing but what I want you to realize that's the public IP address we're translating to so that's the public IP we're translating to so even though it says inside global right it's the public IP address we're translating the private IP addresses to and then outside global address that's who we're trying to reach so those are the three different pieces of information that are critical for us to be successful in this particular case.
So we have our private inside RFC 1918 addresses in this scenario.
Fighting me today 1918 addresses and then you have your public IP addresses that you'd get from your service provider that you can use for this scenario and then last but not least whoever you're trying to reach so this is going to be dynamically populated based on the NAT device.
Same thing with this one same thing with this one but this one is going to be from you know a set a set grouping or it could be one address or multiple IP addresses that are used for the public connectivity so when it comes to NAT we have static NAT dynamic NAT PAT and dynamic NAT with PAT that we had to be ready for for the certification exam so let's begin with static NAT so static NAT uses a one-to-one address mapping so what do I mean by one-to-one address mapping?
It means that you need one public address for every private IP address that you have that's right so if you have five private users then you need five public addresses so if you have a thousand users that means you're going to need a thousand public IP addresses so let me ask you this folks how many of you have or how many public IP addresses do you have for your organization?
Chat in all right so Andrew says about two hundred and fifty four ish public IP addresses Joshua are you a service provider?
45,000 John says we have a class C up figures you are 45,000 so John says class C so another so you know this is um this is um these are actually abnormal answers in my Encore class so typically when we're teaching CCNA typically we're teaching Encore we typically have people saying oh I've got either one
public IP or potentially they have seven or eight public IPs like in powers of two so they might have one or two or four or eight or sixteen and so on and so forth so that's typically what you find but today here we have some people are saying they've got 254
and 45,000 so from a typical standpoint it's very tough nowadays especially to get a lot of public IP addresses and so if you need a one-to-one relationship this this would not work for you because even to get you know seven public IP addresses today is a challenging it's challenging when it comes to IPv4 so when
it's all said and done this type of NAT is reserved for those specific circumstances where you want to one manually so statically manually control exactly which private IP gets converted to which public IP and when that public IP is in use or sorry once that public IP
is mapped then no one else can use it it's reserved for that specific device so any scenario that's on the exam that says you want to make sure that this public IP is always assigned to that device no matter what and nobody else can use it then static NAT is the way to go and you would
actually manually configure this and so it doesn't make sense when you have let's say 5,000 users that all need a public IP address to do something like this because the odds of getting 5,000 public IP addresses is slim and you manually having to map all of them just doesn't make sense in that type of environment so first of all let's talk about enabling NAT on our interfaces
so we have the concept of inside interfaces and then we have the concept of outside interfaces you can have multiple inside interfaces you can have multiple outside interfaces what does this do it teaches your router how to handle traffic for translation so for example in this case this is an inside interface
and inside interface and inside interface and outside interface based on my configuration so what this means is that if traffic arrives on an inbound interface and is leaving an inbound interface translation does not happen if it arrives on an in interface and goes out and out interface then translation has to happen
based on our configuration that then means if traffic is coming this way in and out interface it then has to be translated back before it can be routed out and in interface and then if you're coming in and out interface leaving an out interface you wouldn't be translated either in that particular case
so what you need to be aware of for the certification exam is that the right interfaces have been configured for inside and outside so based on some topology some diagrams some scenario anything they're providing to you and you compare that to configuration are those the right inside interfaces are those the right outside interfaces
you
waiting Andrew
so that's number one make sure
yeah so Andrew so there if you're saying there are scenarios where you do some hairpin on your outside interface that gets natted then that's fine like there are always exceptions to the rule okay there's always exceptions to the rule right but under typical
conditions this is how you know it would function but absolutely we you can totally set it up I've done it before in firewalls as well where you do the hairpin turn and basically it's almost like it will goes to an inside a different interface then comes back out gets translated again I've done those on like three armed firewalls and different things like that as well yeah yeah
yeah
so now inside outside
interfaces be able to verify them on the exam
next
this is the static configuration
say we need one of
these for each
and every single
manual static mapping
that you want to have
so we have here
ipnat inside source
and this is going to be the command
for all of your
examples ipnat
inside source why is
that because we are translating
an inside source
address that's what we're translating
so ipnat inside
source the source is insider
network so this is
the command ipnat inside source that is used for
our private to public translations
so now because we're doing
static NAT we type in the static
keyword and then
we can go ahead and we can specify
the RFC 1918
address that we want to have translated
so in this case 10.0.0.10
and then the public
IP address that we want it translated to
so that would be
a public IP address that I would have had to receive
for my ISP as an example
and now we
have a static
mapping for that so for every single
translation you want to have you're going
to need to have a static translation
there is a parameter
I want to tell you about here so I'm just
going to run out to R2 as an example
I don't have
it in my slides but I've
added it recently to my notes
so we'll type in ipnat
inside source
and let's say 10.0.0.10
and then we'll go to
203.0.113.
just say
91 as an example
alright
this extendable
I want to talk about this one here
extendable
so what you need to
realize is that for
every single
private IP
address
for every single private
IP address
you can only have one
static
translation
one static
translation so if I tried to create another
one I wouldn't be allowed
to do that
unless I add the
extendable parameter
the extendable
parameter so
if I wanted to create another one let's say
static 10.0.0.10
and give it another
public IP address
I would have to put extendable on the other
ones in order for it to be accepted
so the static NAT
extendable parameter is going
to be used if you want to translate
a single
private IP address
to more than
one public IP address let me repeat
that the extendable parameter
would be utilized if you want to
translate a single private
IP address to more
than one public IP address
another
keyword and it's not here another keyword
though that I want you to think about that they might throw at you
on the exam because
they
people who create exam questions
have
to do it in a way where they're not
giving the answer away
and sometimes
they use words that
they've pulled out of a thesaurus
and
it's not something you would
normally utilize or say yourself
ever
and so for example
if I said to you I wanted you
to create a network
address translation
for
a client and I wanted
to be deterministic
deterministic
alright that means
static NAT okay that means static
NAT don't let the word deterministic
throw you off it means
static NAT in that case
so
you see the word deterministic you're going with
a IP NAT inside source
static and define the values you need
and if you have to assign more than one public
IP address to that one address don't forget about
the extendable keyword
alright so now when you do that for
every single IP address
you do that to folks you're going to
get one of these entries in your NAT
table
basically
this is a placeholder
it's locked in which means
this address always gets
this address and no one else can
have it
and then every time that device communicates
10.0.0.10
for example you can see they went to the
internet in this example
notice that all of a sudden
there is a we'll call it dynamic
entry in the table it just magically
appeared so for
every flow of traffic
from that PC now
10.0.0.10 that goes to the internet
there will be an entry
added to the table for that
communication flow and that's important
there has to be right there has to be
because when
you go out and then you come
back we need that translated back
so if I go to a different outside address
there's got to be a mapping in here
for that so the traffic comes back
we can map it back right now we go
out we got to record everything so when the traffic comes
back we can map it back so we've got to keep track
of that as we go along so
if this device all of a sudden makes 30 connections
to the internet there will be 30
entries in here for that particular
client plus the static one
that's holding on to that position for it
we look
down here and show IP NAT statistics
for the exam really what are you going to need out of
this is how do I verify the outside
interfaces and the inside interfaces
and when we get to other discussions there will be a little bit more
information in here in regards to that
alright so that's static NAT
think about any scenario where they're asking you
to make sure that a certain
address is always used
by a specific client
regardless of the reason for it
even if it doesn't make sense for the real world
then okay well I'm going to have to use a static
NAT for that and so
basically you're reserving that IP
address for that client
alright so dynamic NAT on the other hand
allows us to avoid
having to manually do all of our
translations so with static NAT
you're manually doing all your translations
with dynamic NAT you're going to let the router
just dynamically pick
the translations on its own
but
I want you to realize even though it says a many to many
address mapping what does that mean it means
that I'm going to have many private IP addresses
to many public IP addresses
but what a lot of people don't realize
is that when you just implement dynamic NAT as
such what happens is that
once your router grabs
a public IP address and
gives it to a specific private
IP address no one else
can use that
until
that user no longer needs
it and approximately
30 minutes has expired without
them communicating ever again so
typically what happens if you use this
option during the day as soon as a
user is given one of the public IP addresses from
the pool then
they're typically going to be using that one for the rest of the
day because they're going to be chatty
at least once every 30 minutes
and so they'll just keep using that same address
right
so problem
just like with static NAT you need one public
IP address essentially for
every single private
IP address that you have in order
to make this work appropriately
inside
interfaces outside interfaces same as before
now here
instead we've got a pool
and we've got an access control
list so if you look
down at our IP NAT inside source
command you'll see that there's a list
50 that is referring
to the access control list
and then you have the pool
stormwind demos which
is referring to the actual pool
itself so what
is list 50 those are going
to be the private IP addresses
what do we call those again the
inside local
addresses that's what it is
and so these are now going to be the public
IP addresses and they're
going to be the wow that doesn't say
public pub
lick there we go and these are going to be
your in side
global addresses
make sure you know those terms
for the certification exam
so if we look at our access control
list notice that this
access control list is
only showing
three addresses in
total that's it we have
10.0.0.10
we have 10.0.1.50
and we have 10.0.2.20
for the
access control is 50
why did I do it that way in this
particular example because look
at your global addresses look at your public
IP addresses this
pool here IP
NAT pool called it storm
wind demo notice how there's only
three addresses
we have 92
we have 93 and we have
94 that's it
so with this particular configuration
there's
only three public IP
addresses so it doesn't
make sense for me to have an access control
that includes more than
three devices
especially if they all
need to access the internet at the same time it
wouldn't make sense because once the three
addresses are consumed by
three devices
then they can't be used
by anybody else unless
those devices are no
longer using them anymore
and in the 30 minutes expires
the timeout period
so in this case
dynamic
NAT is using a scenario where
you have
certain systems
whereby
you want them to always
use
the same
IP addresses that are
in a group but you
don't care which one they use from that group
for example I don't care
which IP address is used by
10.0.0.10 any of those three is fine
I don't care which one 1.50
any of those three is fine
I don't care 220 any of those three is fine
so I'm just letting my
device my router
just give each one
whichever one it wants to at that moment
in time when it needs to
if the pool
did not have enough addresses
just remember this
once
the pool is exhausted
then the rest of the devices that need
addresses would not be able to connect
to the internet so that's
something to keep in mind on the exam when you configure verify
and troubleshoot NAT
double check
how is this NAT configuration set
up it's set up in a way
whereby I have to
have the same number of public IPs
as I do private IPs
so if the scenario has 10
private IPs and there's only 5 public
addresses and 5 users at any given
time cannot go to the internet
so if the scenario is talking about
intermittent connectivity or they can't get to
the internet and you look at this and you're like oh
yeah there's just not enough addresses in the pool
for the number of users that are there
so you'd have to
either get a bigger pool or
you know maybe
redefine what users are allowed to use that
pool in that particular case
so when we look at this output now
same thing outside inside interfaces
and now down here though you'll see
inside source with dynamic
mappings it says we're going to dynamically map
anyone from access list 50
to the pool
of Stormwind demo and the pool of Stormwind
demo is 20301
1392 all the way up to
20301 1394
so now when we look at our table
what you'll see
is that when the router
gives the public IP
address to that private IP
address it'll basically
put
we'll call it a lock on that particular
public IP address in the table
so you can confirm
here that 10010 has
been given 20301 1392
and
that will remain with
10010 for as long as
10010 keeps talking
if 10010 stops talking
then approximately 30 minutes later
that would be removed they don't stop
talking then they'll keep getting to use it
same thing with
the other ones
and then every time we communicate you'll see
that there's going to be a dynamic entry
added for each
of the conversations that are going on
so 10010 went out to the
internet 30 times then there'd be 30
entries here for each and every single one
of those connections it has out to the internet
because we got to keep track of all the
communications so we know how to translate
back when the return traffic comes back
so obviously
dynamic NAT and static
NAT are not
going to give us the best
results for our enterprise environment
and why is that
well think about
static NAT manually configure
if you have a thousand users do you really want to manually
configure all 1000
users probably not
what about dynamic NAT if you have a thousand
users well I mean
it can dynamically do it for you but you still need a
thousand IPs so both for static NAT
and dynamic NAT you're going to need the number
of public IP that you have for private
and that is typically
not going to happen for you
so that's where PAT comes into play
what is PAT
it's called port
address translation but I like to say it this way
port
and address
translation
so
think about network
address translation they could have just called it
address translation
not network address translation just
address translation or IP
address translation because that's all you're translating
when NAT
static NAT dynamic NAT
address translation that's all it is
whereas with port
or PAT you're doing
port and address
translation so now you can
translate both the port numbers
and the addresses themselves
and depending on
the situation the router will choose
what it wants to do if it doesn't need to
translate the port it won't if it needs to it will
also PAT uses a
many to one address mapping
what does that mean it means that you can
have
many many many many many
private IP addresses all
using the same public IP address
so let's just look at this configuration here
now we've got our insides we've got our
outside interfaces
here's our access control
list so in this case I've included every
single one of our
subnets that
we have that are attached to our SVI
so 10.0.0.24
1.0.0.24 2.0.0.24
3.0.0.24
so that access
control list is what that is referring to
our inside
local addresses
our RFC
1918 addresses when it's all
said and done it's the
private IPs
and as you can see IP NAT inside
source list 50 is right there
and then because we're
using PAT and we can do port and
address translation notice we
don't have a pool in this particular example
why do I not
need a pool I don't need
a pool because we can
all use the exact
same public IP address now
so typically
you would use the IP address
of an interface
as an example here
so interface fast
internet 0.0.0
so use the IP address
of interface 0.0.0
so this would be your inside
global address
for network address translation
your public IP address
now this keyword
here means what
that keyword means
turn
on
PAT
now on Cisco
iOS devices
if you forget that overload
keyword you're fine
it'll automatically do it for you
because it will not allow you
to put the interface
in unless you're
overloading on it so it'll automatically
do it for you folks no worries
about that but on the exam
if you saw
this on the exam
then that is wrong that is the reason
why it's not working even though it would still work
in the real world that is why it's not working
on the exam why because you can
photoshop copy and paste
do anything you want as a
exam developer
when it comes to Cisco exams
so keep that in mind that
the overload keyword if it's missing
that is probably what they are
looking for you to figure out in that
example
all
right so now
if we look at this you'll see our inside
or outside interfaces no change
there but now you'll see that when it comes to
the inside source information access list
50 is being translated to the
IP address of that interface
and notice it doesn't even say
overload here because it just it's going to have to
happen no matter what
all right
so now as devices are
communicating notice how there's no
entries in there with the dashes in them
like we had with the other two
because we don't have to make an entry
in that table
for that particular client because this just
happens on the fly and nothing's being
specifically reserved for anybody
in this case
so you'll see that we have 10.0.0.10
1.50
here and 2.20
notice how they're all using
the exact same
IP address
exact same
IP address every single
one of them
so that's great we can piggyback
and use the same IP
now what happens
though
if two devices
are using the exact
same port number
that is a problem
look at this
this device is using the same
port number as this
device right here
source port
so the traffic
is coming this way
from both of those devices
this one is from
10.0.0.10
this one's from
10.0.2.20
and this one's using port number
62345
so is this one
so now if we translate those
we would end up translating
to 203.0.113.91
at
62345
and
203.0.113.91
at
62345
that is a problem
why
is that a problem because these
are no longer unique
and if these are no longer unique
right here these ones here
that's a problem because the router
is not going to know 100%
what to translate it to
when it comes back because
it would not know when the traffic comes back
hey am I supposed to translate it to this
or am I supposed to translate it to this
because it's the same
so what does your router do this is where it does
port translation
notice that it translated this port
number right here
see that
so now it changed it to
64544
it simply uses an unused port number
in the table if that port's not
being used in the table it'll just go ahead
and use it so now we have
uniqueness between the two
so that way there when traffic comes back
and the traffic is
destined to
203.0.113.91
62345
from 8888
well that's
8888 okay right here
and that is
203.0.113.91
62345 that's this one here so now
we can translate it back to this
and when it comes back
to
203.0.113.91
it's 64544
from 8888
then that's gonna match this
entry here
203.0.113.91
64544
and it's coming from 8888
so now we can translate it back to this
so we'll have to translate the port number back as well
right because
the user is expecting this
the user's not expecting that port number
it's expecting that port number
we gotta translate the port number back as well
on the way back
so all of this is transparent
to the user they have no idea this is going on
so folks what is
our number one limitation with
PAT then what is the number one
limitation we have with port address
translation
you don't know put in a question
mark
so I know you're thinking
yeah good
ports
our biggest challenge with
port address translation is ports as
John said
how many ports are
there in total folks
yeah
0-65,535
so like 65,536
so here's
how PAT works you're not gonna have to know this for the
exam but I'm gonna tell you for the real world
if the source port
equals
0-511
then
if the port has to be
translated it'll translate it within
that range
if the source port
equals
512-1023
then it'll translate it in that range
the source port is
1024-65,535
then that will
translate it in that range
so most users are gonna be using
source ports of this
which means you don't even have a full
65,536
ports right because if a
user is using one of these source ports
and then all of a sudden
you run out of these source ports
for uniqueness and there's more translations
than you need then what happens
right well then they can't
translate because there's no more
ports to be used for translation
folks
if you go to one single website
approximately
how many translations
do you think happens today
just when you go to one website
right back in the day you went
to one website that was like one
translation right you
went to that website you got translated to go
there you're done but like
how many translations happen today
it's a
lot it really
is
I'm just gonna
execute the netstat command
on my device right now these are just the active
TCP sessions I have now
some of these are inside some of these are outside
right but there's not a whole lot going on
right now in regards to that
but see for every single one of those
that have to go to the internet
there would end up being a
translation that would have to happen so let's go to
www.cisco.com
before we go there let's remind you
this was the list
it's not very long it's short
very short there's the top
one two three so
just an extra three more clicks on my
wheel now let's go to cisco.com
and all I've done is gone to cisco.com
and what do we have now
three
netstat
do you see that look at that list
okay so now let's also
go to maybe
www.aws.com
hey
let's go at the same
time to stormwindstudios.com
so just think about it as a single
user right now who's that
this is a good looking guy
right so
when it's all said and done just think
about that now a lot of these are going to time out
here within 30 seconds right because they were
just temporary connections to get
what do you need but in the end folks
I hope you're realizing that
the moral of the story of this is that
you need to be well
aware that
it doesn't take long
for users in your organization
when they are aggressively
using the internet to end
up consuming all the port numbers
as a collective unit
so if you had a thousand users
if you had a thousand users
a thousand users
what's a thousand times let's
say 65
65
that's 65,000
you're almost maxed out right there folks
you're almost
maxed out right there so every user
just making 65 connections
out to the internet and you saw how many I
had which is three websites
could easily
consume all those port numbers
now the good news here is
that these time out
in 30 seconds out of your table
meaning what
meaning that if this
if my router doesn't continue to see traffic
in and out in and out
in and out for this translation
then in 30 seconds of
inactivity it will get rid of it
reclaiming that port number
that was being used there
so think of this scenario
on the exam or even in the real world
if you have users
who complain the internet is broken
and then by the time you reach
out to them they say oh no no it's
fine now and then you have another
user who complains the internet's broken
but then by the time you reach out to them
they're like oh no no it's fine everything's back to normal
if that is a constant theme
it might
simply be that you don't have
enough port numbers
for a network address translation
based on the amount of traffic
that's going to the internet
that's what that is
so how do
you add more port numbers folks
to solve
this problem if you
end up in that situation
how
do you add more port numbers
in order to solve this problem
yes exactly Andrew good one
add another IP address
because if we add another IP address
publicly
then what happens
we have another 60 approximately
65,000 address port numbers
so I've got 65,000
port numbers times 2
you've got a third address now you've got 65,000 port
numbers times 3 add another address
you get the picture so how do we implement
that we implement with dynamic
port address translation
that's right all that means is instead of
using
just one address let's use
addresses within a pool so before I
show you the configuration let's go back to this configuration
remember this configuration
dynamic NAT
what do we say the problem with this configuration
is that the way it's set up
every single
address gets mapped
specifically to a public IP address
and no one else can use it
what if we just simply
overload
on this entire config
and instead we change this to 0
0 0
0
that's it
just by making those few changes
folks we now
can implement
dynamic port address
translation
so for the exam think about if they show you
this without
overload
and they are indicating that users
are
not able to go to the internet just
double check that they forget the overload
keyword
and there
you go there's your patent with multiple IP addresses
so
now we have three public IP
in this scenario all
being overloaded on for this
entire access control list
range of private IP addresses
so now
when you look at this scenario
you'll see over here on the left
hand side we have
94 use
95 94 96
95 94 95 94
96
and if
two users are using
the same port number
and the same
and the same address
so did they use the same address
yes they
did right
then the port number had to be changed
so this port number was changed
so this one had to be
port and address translated
because it conflicted with that port number
there
you
question now is what if the same port
number is being used
but the device
chooses different IP addresses
then does it have to translate the port number
no it doesn't
so let me repeat that
your router can make a choice here either
I use the same
IP and translate the port
or I use a different IP and then I
don't have to translate the port it'll
make those decisions on the fly for you and it doesn't matter
what decision it makes
all right so there's your config for
config verify and troubleshoot network
gadgets translation on the certification exam
Andrew says funny that the exam
is new but you can't configure this
in the CLI and the next gen firewalls
okay so you got to remember this
Andrew this exam is not about next
gen firewalls
this exam is about network address translation
implemented on Cisco
iOS routers and
Cisco iOS XE
routers
that's the difference
that's the
difference so the exam
is very specific to the
operating system no don't apologize
I'm glad you brought that up
I'm glad you brought that up never apologize
for bringing something up ever right
it's part of the learning process part of the conversation
so so the important thing is
is that we as
network admins in the real world we deal
with a lot of different operating systems like for example
some of you might be using Nexus OS
other people are using firewall
operating system and they're all
different which is really unfortunate
in the grand scheme of things because it means you have to
learn many different operating systems and
we wonder why we have security problems in this
world that we can't keep up because
it's a different way to secure everything it's a different way to do
everything which is unfortunate in the world
of Cisco all right but
the end result
is that for this exam what I've shown
you is iOS and iOS XE
and if you don't use
a lot of iOS and iOS XE
labs
and other things like that that we have available
to you and a lot of the practice exams
and labs are going to help you get familiar with
iOS and iOS XE to get ready for the exam
Thank you