Vule nombre limité d'adresses Ipv4 routables, des techniques comme le NAT et le PAT sont. utilisées pour gérer au mieux cette ressource rare du monde du réseau. Ce document s'interesse. à la manière de configurer un routeur pour qu'il puisse faire du NAT et du PAT. Objectifs. Public concerné-savoir configurer le NAT et le PAT. sur un

You are here Home / Cisco Routers / Cisco Router Configuration Commands – CLI Cheat Sheet In a previous post, I have published a Cisco Switch Commands Cheat Sheet tutorial. Since these kinds of posts are useful as a reference for many people, I have decided to create also a Cisco Router Commands Cheat Sheet with the most useful and the most frequently used Command Line Interface CLI configuration commands for Cisco Routers. Cisco IOS routers are probably the most complete, versatile and feature-rich networking devices. There are whole books written about Cisco router configurations and commands. Therefore it’s not possible to create a cheat sheet with all of the CLI commands of Cisco routers in one blog post. However, the list below I believe summarizes the most important ones so its a good starting point for a networking professional. Although there is a wide range of Cisco router models, the commands below will work on most devices running IOS with no problems. Make sure to download the cheat sheet in PDF format for future reference by subscribing above. Show/Verification Commands Routershow version [Displays information about running IOS version, hardware model etc] Routershow flash [Displays information about Flash memory] Routershow ip interface brief [Displays interface status and IP addresses for all interfaces] Routershow ip protocols [Displays configured routing protocols such as RIP,EIGRP, OSPF etc] Routershow ip route [Displays the routing table] Routershow cdp neighbors [Displays information about directly connected devices] Routershow cdp neighbors detail [Displays Detailed information about neighboring connected devices] Routershow running-config [Displays currently running configuration] Routershow startup-config [Displays configuration in NVRAM which will be loaded after reboot] Routershow history [Displays all commands in the history buffer] Routershow tech-support [Send the output of this command to Cisco tech support when you open a support ticket in TAC] Saving and Deleting Configurations Routercopy running-config startup-config [Save the running config to NVRAM to be used at next reboot ] Routercopy running-config tftp [Copy the running config to a TFTPserver for backup] Routercopy tftp running-config [Load the saved configuration from TFTP server to DRAM] Routererase startup-config [Delete the startup config from NVRAM Device Name Routerconfighostname MyRouter [Set hostname for the router] Device Security Commands MyRouterconfigenable secret test1 [Sets encrypted secret password for Privilege exec mode “enable” mode] MyRouterconfig line con 0 MyRouterconfig password strongconsolepass MyRouterconfig login [Secure the console with a password] MyRouterconfig line vty 0 4 MyRouterconfig password strongtelnetpass MyRouterconfig login [Secure the telnet terminal lines with a password] MyRouterconfig service password-encryption [Encrypt all passwords on the device] Configuring Router Interfaces Serial interfaces MyRouterconfiginterface s0/0/0 [Entering into serial interface s0/0/0 configuration mode] MyRouterconfig-ifip address [Set ip address and subnet mask on the interface] MyRouterconfig-ifclock rate 64000 [Assign a clock rate] MyRouterconfig-ifno shut [Turns the interface on] Ethernet Ports MyRouterconfigint f0/1 [Entering into ethernet interface fastethernet0/1 configuration mode] MyRouterconfig-ifip address [Set ip address and subnet mask on the interface]] MyRouterconfig-ifno shut [Turns the interface on] Configure Routing Static Routing 1st method MyRouterconfigip route [ Network , = subnet mask of destination network , = next-hop address] 2nd method MyRouterconfigip route serial 0/0/0 [Same as above but instead of gateway you specify the exit interface] MyRouterconfigip route 150 [Set administrative distance of 150 if needed. For static route, default is 1] Default routing MyRouterconfigip route [Send all packets destined for a network not in the routing table to hop] OR MyRouterconfigip route serial 0/0/0 [Send all packets destined for network not in the routing table out serial 0/0/0 interface] Dynamic Routing RIP version 1 MyRouterconfigrouter rip [Enable RIP as routing Protocol] MyRouterconfig-routernetwork [ is the directly connected network we want to advertise] RIP version 2 MyRouterconfigrouter rip [Enable RIP as routing Protocol] MyRouterconfig-routerversion 2 [Enable RIP version 2. Version 1 is default] MyRouterconfig-routernetwork [ is the directly connected network we want to advertise] MyRouterconfig-routerno auto-summary [Turns off auto-summarization- optional] MyRouterconfig-routerauto-summary [Turns on auto summarization – optional] RIP Verification Commands MyRoutersh ip route MyRoutersh ip rip database MyRoutersh ip route rip EIGRP MyRouterconfigrouter eigrp 10 [Enable EIGRP process. 10 is autonomous system AS number, AS can be any number b/w 1 and 65535. All routers should be in the same AS to build a neighbor relationship.] MyRouterconfig-routernetwork [ is the network to advertise] MyRouterconfig-routerno auto-summary [Turns off the auto-summarization – Optional] EIGRP verification commands MyRoutershow ip eigrp neighbors [Displays neighbor table] MyRoutershow ip eigrp interfaces [Displays information for each interface running EIGRP] MyRoutershow ip eigrp topology [Displays the topology table. Shows feasible successors] OSPF MyRouterconfigrouter ospf 10 [Enables OSPF process number 10. Process ID is any number b/w 1-65535. It doesn’t need to be matched with neighbor routers] MyRouterconfig-routernetwork area 0 [Any interface with an address of is to be put into AREA 0 and will advertise and receive OSPF routes] OSPF Authentication Simple MyRouterconfigrouter ospf 10 MyRouterconfig-routerarea 0 authentication [Enables simple authentication. Password will be sent in clear text] MyRouterconfig-routerexit MyRouterconfigint s0/0/0 MyRouterconfig-ifip ospf authentication-key 1234 [Sets password to 1234 for AREA 0 authentication] MD5 Encryption MyRouterconfigrouter ospf 10 MyRouterconfig-routerarea 0 authentication message-digest [Enables MD5 password encryption] MyRouterconfig-routerexit MyRouterconfigint s0/0/0 MyRouterconfig-ifip ospf message-digest-key 10 md5 1234 [10 is the key id. This value must be the same on neighboring routers. Md5 indicates that MD5 algorithm is used and 1234 is the password and must be same on the neighboring routers] OSPF Verification Commands MyRoutershow ip ospf [Displays basic configured ospf information] MyRoutershow ip ospf interfaces [Displays OSPF interfaces information] MyRoutershow ip ospf neighbor [Displays all ospf neighbors and their states] MyRoutershow ip route ospf [Show routes learned by ospf] Configure Access Control Lists MyRouterconfig access-list 101 deny tcp any eq 80 MyRouterconfig access-list 101 permit ip any any [Configure an extended ACL to deny access to port 80 for network and allow everything else] MyRouterconfig interface fastEthernet 1/0 MyRouterconfig-if ip access-group 101 in [Apply ACL 101 in the inbound direction on interface fe1/0] Configure Network Address Translation NAT Dynamic NAT overload PAT MyRouterconfig interface fastEthernet 1/0 MyRouterconfig-if ip nat inside [Specify which interface will be the inside for NAT, the source IPs of packets coming to this interface will be translated] MyRouterconfig interface fastEthernet 1/1 MyRouterconfig-if ip nat outside [Specify which interface will be the outside for NAT, packets going out from this interface will be translated] MyRouterconfig access-list 1 permit MyRouterconfig ip nat inside source list 1 interface fastEthernet 1/1 overload [Access list 1 specifies that inside source network will be translated to the IP address of fastEthernet1/1. Very useful for providing internet access to internal private addresses] Static NAT MyRouterconfig interface fastEthernet 1/0 MyRouterconfig-if ip nat inside MyRouterconfig interface fastEthernet 1/1 MyRouterconfig-if ip nat outside [Define again the inside and outside NAT interfaces] MyRouterconfig ip nat inside source static [Private IP will be translated statically to Public IP one-to-one mapping] DOWNLOAD THE CHEAT SHEET AS PDF FILE Related Posts Comparison of Static vs Dynamic Routing in TCP/IP Networks Cisco OSPF DR-BDR Election in Broadcast Networks – Configuration Example How to Configure Port Forwarding on Cisco Router With Examples Adjusting MSS and MTU on Cisco 800 routers for PPPoE over DSL The Most Important Cisco Show Commands You Must Know Cheat Sheet DynamicNAT Pooling, also known as NAT Pooling is a method of dynamically assigning real IP addresses to a dedicated mapped IP Address. In this lab you’ll learn how to configure and verify NAT Pooling along with PAT fallback on the Cisco ASA running 9.x. Dynamic NAT Pooling Policy defined in the the object configuration mapping the real IP OK nawal....213On va tenter d'autres choses Essaye de réinitialiser Firefox et essaye avec la configuration non modifiée et sans plugins, personas, ...Essaye une réinitialisation usine de ta attention, avant la réinit usine assure toi de disposer de ton identifiant de connexion et du mot de passe associénote tous tes paramétrages spécifiques déjà enregistrés pages WIFI, DHCP, NAT PAT, ...Si la réinitialisation usine ne résoud rien, il te faudra appeler la hotline 3900 ou 3970 si contrat open.Ils te referont probablement refaire tous les tests que tu as déjà faits, il se pourrait qu'ils te proposent un échange de Faites confiance aux produits libres Firefox, Thunderbird, LibreOffice, Irfanview, VLC, 7-zip, FileZillaVotre machine vous en remerciera Theconfiguration is almost the same as for dynamic NAT, but this time you specify the outside interface instead of a NAT pool. Router (config)# access list 1 permit 0.255.255.255. Router (config)# ip nat inside source list 1 interface serial 0/0/0 overload. Router (config)# interface FastEthernet 0/1.
NAT is a valuable tool for admins, both for conserving public IP addresses and securing internal resources. Several variations of NAT are available, including its cousin PAT. See the differences and learn how to set up PAT using the Cisco IOS. Port Address Translation PAT is a special kind of Network Address Translation NAT. It can provide an excellent solution for a company that has multiple systems that need to access the Internet but that has only a few public IP addresses. Let’s take a look at the distinctions between NAT and PAT and see how they are typically used. Then, I’ll show you how to configure PAT on a Cisco router. Understanding PAT and NATBefore discussing PAT, it will help to describe what NAT does in general. NAT was designed to be a solution to the lack of public IP addresses available on the Internet. The basic concept of NAT is that it allows inside/internal hosts to use the private address spaces 10/8, and networks—see RFC1918, go through the internal interface of a router running NAT, and then have the internal addresses translated to the router’s public IP address on the external interface that connects to the Internet. If you dig into NAT a little deeper, you will discover that there are really three ways to configure it. From these configurations, you can perform a variety of functions. The three configurations are PAT PAT is commonly known as “NAT overload” or sometimes just “overload”. In this configuration, you have multiple clients on your inside network wanting to access an outside network usually the Internet. You have few public IP addresses, many more than the number of clients, so you have to “overload” that real Internet IP address. In other words, you are mapping many inside clients to a single Internet IP address many to one. For an illustration of PAT, see Figure A. Figure A Pooled NAT Pooled NAT is similar to PAT except you have the luxury of having a one-to-one mapping of addresses. In other words, you have just as many inside network clients as you do outside network IP addresses. You tell the NAT router the pool of IP addresses that are available, and each client receives its own IP addresses when it requests a NAT translation. The client does not get the same address each time it requests a translation; it merely gets the next available address from the pool. In my article “Set up NAT using the Cisco IOS,” I explain how to configure Pooled NAT. For an illustration of Pooled NAT, see Figure B. Figure B Static NAT Static NAT is the simplest form of NAT. The most likely example is a mail server on the inside of a private network. The private network connects to the public Internet. In between the two networks, a router performs NAT. For a dedicated server, like a mail server, you would want a static not changing IP address. This way, every time someone on the Internet sends e-mail to the mail server, that server has the same public IP address. For an illustration of Static NAT, see Figure C. Figure C As I said, you can perform a variety of functions with these three configurations. For the purpose of this article, we will focus on configuring PAT. Configuring PATTo configure PAT/NAT correctly the first time, you need to understand the Cisco NAT terminology and how your IP networks/addresses map to each of the entities listed below Inside Local—This is the local IP address of a private host on your network a workstation’s IP address. Inside Global—This is the public IP address that the outside network sees as the IP address of your local host. Outside Local—This is the local IP address from the private network, which your local host sees as the IP address of the remote host. Outside Global—This is the public IP address of the remote host the IP address of the remote Web server that a workstation is connecting to. You’ll configure your Cisco router using seven commands. Let’s assume that your Internet service provider gave you a 30-bit network containing two public IP addresses. This configuration would allow one address for your router and one address for your internal clients and devices. The first command you’ll execute will tell the router which public IP address you want to use for PATip nat pool mypool prefix 30 This command configures a pool range of IP addresses to use for your translation. In this case, we want only one address in our pool, which we will overload. We do this by assigning the same IP address for the start and end of the pool. The next command will tell your router which IP addresses it is allowed to translateaccess-list 1 permit It’s not a good idea to put “permit any” in the access list, even though you will occasionally see that as a recommendation in some sample configurations. The next command isip nat inside source list 1 pool mypool overload This command puts the pool definition and the access list together. In other words, it tells the router what will be translated to what. The overload keyword turns this into a PAT configuration. If you left out overload, you would be able to translate only one IP address at a time, so only one client could use the Internet at a time. Next, you need to tell PAT/NAT what interfaces are the inside network and what interfaces are the outside network. Here’s an exampleinterface ethernet 0ip nat insideinterface serial 0ip nat outside With these commands, your PAT configuration is finished. You have told the Cisco IOS you are translating your network A into a single IP address from network B, that network A is on the ethernet 0 interface and network B is on the serial 0 interface, and that you want to allow the inside network to overload the single IP address on the outside network. Finally, verify that NAT works. This can be as simple as doing a ping command from your inside local host to an outside global host. If the ping succeeds, chances are you have everything configured correctly. You can also use the following Cisco IOS commands to confirm and troubleshootshow ip nat translations [verbose]show ip nat statistics With the translations command, you should see the translation that was created from your ping test. But watch out The translations will disappear after their time-out expires. If you have configured overload, these time-outs are configurable by traffic type. SummaryYou should now understand the differences between PAT, Pooled NAT, and Static NAT, and you should be able to do a basic PAT configuration with the Cisco IOS. For more information, check out the links below. Additional resources TechRepublic “Learn why NAT can cause VPN connection problems” TechRepublic “Set up NAT using the Cisco IOS” TechRepublic “Use NAT to connect your network to the Internet” Cisco NAT Technical Tips Index Cisco How NAT Works Cisco Configuring Network Address Translation Getting Started Cisco Frequently Asked Questions about Cisco IOS NAT Cisco IOS Configuring Network Address Translation Cisco IOS Overloading an Inside Global Address PAT Cisco IOS IP Addressing Command Reference including NAT commands PCWebopedia NAT Definition RFC1631 The IP Network Address Translator NAT RFC1918 Address Allocation for Private Internets Network Computing Network Address Translation Hiding in Plain Sight Verizon How Network Address Translation Works Da Lan Tech Network Address Translation for Beginners

Solved I am a cisco newbie, I have configured VLANS, dhcp, can get an IP address on my local machine. I can't seem to get out to the internet from said machine. Am I missing something in my NAT setup? Current configuration : 2220 bytes ! ! Last

Dans ce cours nous allons voir ce qu’est un serveur DHCP Dynamic Host Configuration Protocol et comment s’en servir pour automatiser la distribution d’adresses IP. Ce cours fait suite à celui sur le modèle TCP/IP et l’adressage IP. Les serveurs DHCP est un service du réseau TCP/IP, il permet aux ordinateurs et aux stations clientes d’obtenir automatiquement une configuration réseau complète. Cela évite à l’administrateur réseau de devoir configurer manuellement les postes rattachés à ce genre de service. Toutefois, les machines configurées pour utiliser le service DHCP n’ont pas le contrôle de leur configuration réseau, qu’elles reçoivent directement du serveur DHCP associé. Cette configuration est transparente pour l’utilisateur final.

Cetarticle a pour but de vous apprendre à configurer le NAT statique sur un routeur Cisco. La fonctionnalité NAT permet de translater une adresse IP local en adresse IP publique. Idum 14

Dans les paramètres des machines virtuelles créées avec VirtualBox, vous pouvez voir que les cartes réseau peuvent être connectées au réseau de différentes façons. NAT Réseau NAT Accès par pont Réseau interne Réseau privé hôte Pilotes générique 1. NAT Par défaut, les machines virtuelles sont configurées pour accéder au réseau via le mode NAT. Ce mode d'accès au réseau permet à la machine virtuelle d'accéder au réseau et à Internet sans créer de conflit dans votre réseau. En effet, en utilisant le mode NAT, les adresses IP seront distribuées aux machines virtuelles par VirtualBox et non par le serveur DHCP de votre réseau. Si vous le souhaitez, vous pouvez changer le type de carte réseau qui sera émulé par VirtualBox pour la machine virtuelle. Cela peut permettre de résoudre des problèmes de compatibilité avec certains systèmes d'exploitation ou certains Live CD qui ne supporteraient pas celle utilisée par défaut. Le seul problème avec le mode NAT, c'est que vous ne pourrez pas accéder aux services de votre machine virtuelle depuis un ordinateur de votre réseau, car votre machine virtuelle se trouvera derrière une passerelle émulée par VirtualBox. Pour vous le prouver, nous avons installé un serveur Web grâce à WAMP sur notre machine virtuelle. Une fois le serveur web démarré, Windows nous demande si l'on souhaite autoriser l'accès à notre serveur web depuis le réseau. On clique sur Autoriser l'accès. Dans notre machine virtuelle, nous avons bien accès à notre site local. Pour que le serveur web soit accessible depuis le réseau, nous cliquons sur "Put Online" dans le menu de WAMP. Comme vous pouvez le voir, notre ordinateur physique possède l'adresse IP " et le masque de sous-réseau " Donc, notre PC se trouve sur le réseau Alors que la machine virtuelle se trouve sur le réseau et qu'elle se trouve derrière la passerelle " Donc, nous ne pouvons pas accéder au serveur de notre machine virtuelle en tapant directement son adresse IP. Pour régler ce problème, le plus simple est d'utiliser le mode d'accès réseau Accès par pont. Mais, vous pouvez aussi configurer la redirection de ports ou port forwarding en anglais de la passerelle virtuelle créée par VirtualBox pour pouvoir accéder au serveur web de votre machine virtuelle depuis n'importe quel PC du réseau. Pour cela, retournez dans les paramètres réseau de votre machine virtuelle et cliquez sur Redirection de ports. La fenêtre "Règles de redirection de ports" apparait. Cliquez sur l'icône + située à droite. Pour créer une nouvelle règle, vous devrez indiquer un nom par exemple WAMP le protocole utilisé TCP ou UDP pour les serveurs web, il s'agit du protocole TCP l'IP hôte facultatif. Cela est utile si cette règle doit concerner une seule interface réseau carte réseau le port hôte le port du PC hôte via lequel les autres ordinateurs du réseau pourront accéder au serveur web tournant dans votre machine virtuelle. IP invité facultatif. La raison est la même que pour la colonne "IP hôte". Port invité le port de destination. Etant donné que notre serveur web écoute sur le port 80 HTTP dans notre machine virtuelle, nous avons indiqué 80. Cliquez sur OK pour valider cette règle. Maintenant, nous pouvons accéder au serveur web de notre machine virtuelle en utilisant l'adresse IP de notre PC hôte le port indiqué dans la colonne "Port hôte" Si vous afficher les infos de PHP via la fonction phpinfo de php, vous verrez que nous accédons au serveur via l'adresse que la vraie adresse IP du serveur est " et non " que l'adresse IP du client n'est pas la bonne. Cela est dû au fait que le serveur web se trouve derrière une passerelle. 2. Réseau NAT Avec VirtualBox, vous pouvez aussi créer des réseaux NAT supplémentaires. Néanmoins, par défaut, il n'y en a aucun de créé. Pour créer un nouveau réseau NAT, allez dans le menu Fichier -> Préférences. Ensuite, cliquez sur "Réseau", puis sur l'icône +. Par défaut, votre nouveau réseau NAT sera nommé NatNetwork. Pour le configurer, sélectionnez-le et cliquez sur l'icône représentant un engrenage. Pour chaque réseau NAT, vous pourrez choisir l'identifiant réseau à utiliser aussi appelé CIDR pour Classless Inter-Domain Routing. la possibilité d'activer ou non le serveur DHCP de VirtualBox pour ce réseau. Le désactiver peut être pratique pour apprendre à créer un serveur DHCP sous Linux ou Windows Server. de supporter aussi l'IPv6 ou non. de créer des redirections de ports comme expliqué précédemment. Dans ce cas-ci, vous pourrez rediriger des ports en IPV4 et/ou en IPv6. Voilà notre nouveau réseau NAT. Dans les paramètres de votre machine virtuelle, retournez dans la partie "Réseau" et sélectionnez le mode d'accès réseau Réseau NAT le nom de votre nouveau réseau NAT. Dans notre cas MySecondNatNetwork. Comme vous pouvez le voir, notre machine virtuelle a bien reçu une adresse IP qui correspond bien à l'ID réseau " configuré précédemment. Pour le mode de promiscuité, il est préférable de le désactiver refuser pour ne pas ralentir la vitesse du réseau pour votre machine virtuelle. L'activation du mode de promiscuité étant uniquement utile pour analyser le trafic réseau d'un réseau via des sniffeurs. 3. Accès par pont Le mode "Accès par pont" permet de placer virtuellement votre machine virtuelle dans votre réseau physique. Autrement dit votre machine virtuelle recevra une adresse IP du serveur DHCP de votre réseau en général, ce serveur se trouve dans votre Box ou routeur votre machine virtuelle apparaitra sur votre réseau comme une machine à part entière vous pourrez accéder aux services hébergés sur votre machine virtuelle comme si votre machine virtuelle était une vraie machine Lorsque vous sélectionnez le mode "Accès par pont", VirtualBox vous permettra de sélectionner quelle interface réseau il devra utiliser pour connecter cette machine virtuelle sur le réseau physique souhaité. Dans notre cas, notre ordinateur possède 2 interfaces réseau cartes réseau la carte réseau filaire IntelR Ethernet Connection 2 I219-LM la carte réseau sans-fil Wi-Fi IntelR Dual Band Wireless-AC 8260 Si vous ne savez pas quelle carte réseau sélectionner, allez dans le panneau de configuration de Windows pour afficher vos connexions réseau. Pour les afficher, vous avez 2 possibilités ouvrir le panneau de configuration et allez dans Réseau et Internet -> Centre Réseau et partage -> Modifier les paramètres de la carte ou faire un clic droit sur l'icône réseau de la barre des tâches et cliquez sur "Ouvrir le Centre Réseau et partage". Ensuite, cliquez sur "Modifier les paramètres de la carte". Bref, comme vous pouvez le voir ci-dessous, notre carte réseau Ethernet est connectée au réseau, alors que la carte Wi-Fi n'est pas connectée pour le moment. Nous avons donc sélectionné la carte réseau "IntelR Ethernet Connection 2 I219-LM" dans les paramètres réseau de notre machine virtuelle. Maintenant, notre machine virtuelle a reçu une adresse IP depuis le serveur DHCP présent dans notre vrai routeur. Nous pouvons donc accéder au serveur web de notre machine virtuelle comme si il se trouvait sur une machine physique de notre réseau. Cette fois-ci, l'adresse IP du serveur SERVER_ADDR correspond bien à l'adresse IP utilisée pour accéder à notre serveur web et l'adresse IP du client REMOTE_ADDR correspond bien à notre adresse IP locale. Configurationd'une route statique. Dans la commande suivante, le réseau à atteindre est le réseau /24 et l'interface utilisée pour joindre le réseau est ethernet 1/0. On peut aussi utiliser l'adresse IP du prochain routeur. R4 (config)#ip route 192.168.2.0 255.255.255.0 ethernet 1/0. R4 (config)#. Autre possibilité: What are NAT and PAT? explained with the configuration of NAT with PAT in Cisco packet tracer. We will also enable PAT as it immensely increases the capability of NAT. NAT Network Address Translation is used to translate the private IP address to a public IP address and vice versa. Most organizations have a limited amount of public IPs as the companies have to pay for them. So, we generally use a private IP range in the internal networks. However, if the internal network wants to communicate with the public network, it is not possible since the private IP address can’t recognize the public IP address. Hence, it can’t communicate. To overcome this issue, we use NAT. As the traffic goes out of the internal network, all this internal traffic is assigned a public IP address. This is how communication becomes possible with public networks, such as the internet. Within an organization, a large number of devices access the public network. So even though the public IP addresses are not expensive but it is just not feasible to do one-to-one translation with the public IPs. Besides, organizations would have to buy a large range of public IP addresses for their network. To solve this problem, Nat is often is used with Pat Port Address Translation. While translating the IP address of the internal network traffic, a port number is assigned to the traffic to distinguish the traffic originating from different systems in the network. This allows multiple systems to access the public network with the use of just one public IP. So, in this lab, we will configure Nat with Pat. First of all, we have to label the interfaces of the router with Nat Inside and Nat Outside. This would let us know the interfaces that are handling the traffic from internal as well as the public network. After that, we have to create an access list to allow a range of IP addresses that need to be translated to public IP with the help of NAT. And finally, we will enter a command that will take the IP addresses from the access list to be translated into public IP before communicating with the public network. Using overload’ at the end of the command will enable PAT, and the router will be able to perform port address translation as well. NAT overload configuration in packet tracer DOWNLOAD Lab Tasks 1. label the interfaces 2. create a access list to allow network to be translated 3. Enable NAT with PAT Lab Configuration Task 1 Routerconfiginterface fastethernet 0/0 Routerconfigip nat inside Routerconfiginterface fastethernet 0/1 Routerconfigip nat outside Task 2 Routerconfigaccess-list 1 permit Task 3 Routerconfigip nat inside source list 1 interface fastethernet 0/1 overload

SourceNAT is typically referred to simply as NAT. To be more correct, what most people refer to as NAT is actually the process of Port Address Translation (PAT), or NAT Overload. The process of having many internal host systems communicate to the Internet using a single or subset of IP addresses. To setup SNAT, we need to know: The internal IP

You are here Home / Cisco Routers / Configuring NAT on Cisco Routers Step-by-Step PAT, Static NAT, Port Redirection The depletion of the public IPv4 address space has forced the internet community to think about alternative ways of addressing networked hosts. Network Address Translation NAT therefore was introduced to overcome these addressing problems that occurred with the rapid expansion of the Internet. Even if NAT was suggested as a temporary solution, it has been adopted by all network hardware manufacturers, and it is considered a very useful technology, not only for IP address conservation, but also for many other purposes including security. Basically NAT allows a single network device a router, firewall etc to act as an agent between a private local area network and a public network such as the Internet. The purpose of this NAT device is to translate the source IP addresses of the internal network hosts into public routable IP addresses in order to communicate with the Internet. Some of the advantages of using NAT in IP networks are the following NAT helps to mitigate the depletion of the global public IP address space Networks can now use the RFC 1918 private address space internally and still have a way to access the Internet using NAT. NAT increases security by hiding the internal network topology and addressing scheme. Cisco IOS routers support different types of NAT as will be explained below. NAT has many forms and can work in several ways, but in this post I will explain the most important types of NAT. For the next 2 scenarios we will be using the following simple network 1. Overloading or Port Address Translation PAT This is the most frequently used form of NAT in IP networks. It uses the concept of “many-to-one” translation where multiple connections from different internal hosts are “multiplexed” into a single registered public IP address using different source port numbers. This type of NAT allows a maximum of 65,536 internal connections to be translated into a single public IP. This type of NAT is very useful in situations where our ISP has assigned us only a single public IP address, as shown on the diagram below. All IP addresses of the LAN network will be translated using the public IP of the router interface FastEthernet0/0 ip address ip nat outside ! interface FastEthernet0/1 ip address ip nat inside ! access-list 1 permit ip nat inside source list 1 interface FastEthernet0/0 overload 2. Static Port Address Translation Port Redirection Assume now that we have only one public IP address which is the one configured on the outside interface of our border router. We want traffic hitting our router’s public IP on port 80 to be redirected to our internal Web Server at IP interface FastEthernet0/0 ip address ip nat outside ! interface FastEthernet0/1 ip address ip nat inside ! ip nat inside source static tcp 80 80 3. Configuring Static NAT NAT can be performed both statically and dynamically. Static NAT simply maps one private IP address to a single public IP address, and this is the flavor of NAT we are discussing in this section. A Cisco router performing NAT divides its universe into the inside and the outside. Typically the inside is a private enterprise, and the outside is the public Internet. In addition to the notion of inside and outside, a Cisco NAT router classifies addresses as either local or global. A local address is an address that is seen by devices on the inside, and a global address is an address that is seen by devices on the outside. Given these four terms, an address may be one of four types Inside local addresses are assigned to inside devices. These addresses are not advertised to the outside. Inside global are addresses by which inside devices are known to the outside. Outside local are addresses by which outside devices are known to the inside. Outside global addresses are assigned to outside devices. These addresses are not advertised to the inside. Let’s jump right into static NAT configuration on a Cisco router as shown in the Figure below R1 is the router performing Network Address Translation NAT and has two interfaces Fa0/0 on the inside and Fa0/1 on the outside. The specific IP addresses involved are NAT Address Type IP Address Inside local Inside global Outside local Outside global Table 1 NAT Addresses for Figure Above You probably know very well how to configure IP addresses on router interfaces, so we skip those configuration steps and move straight to the interesting stuff. First, we have to assign Fa0/0 as NAT inside interface and Fa0/1 as NAT outside interface on R1. This would tell the router that interesting traffic entering or exiting these two interfaces will be subject to address translation. R1conf term Enter configuration commands, one per line. End with CNTL/Z. R1configinterface Fa0/0 R1config-ifip nat inside R1config-ifinterface Fa0/1 R1config-ifip nat outside R1config-ifend Now we would tell the router how to perform address translation and mention which IP addresses source or destination to re-write in packets moving between the inside and outside interfaces. Here we go R1configip nat inside source static Here, we are telling the router to perform NAT on packets coming into the router on the inside interface Fa0/0. More specifically the router would identify which of these packets have a source IP address of and would change it to before forwarding the packet out the outside interface Fa0/1. Similarly, return packets coming in at outside interface Fa0/1 would undergo translation of destination IP address. Let’s now verify if NAT is actually working as it is supposed to work. There are a couple of very useful Cisco IOS commands that can be used to do just that. Command show ip nat statistics displays the number of static and dynamic NAT translations, inside and outside interfaces, and the number of hits and misses. R1show ip nat statistics Total active translations 1 1 static, 0 dynamic; 0 extended Outside interfaces FastEthernet0/1 Inside interfaces FastEthernet0/0 Hits 0 Misses 0 CEF Translated packets 0, CEF Punted packets 0 Expired translations 0 Dynamic mappings Appl doors 0 Normal doors 0 Queued Packets 0 Command show ip nat translations displays the IP addresses for NAT translations. R1show ip nat translations Pro Inside global Inside local Outside local Outside global — — — As you see in the above output, we have one NAT entry configured with Inside global address and Inside local address specified. Outside local and Outside global addresses are blank because our NAT configuration does not change those addresses. Let’s now go to the PC and ping the Server before running the command show ip nat translations again to see if it makes any difference. R1show ip nat statistics Total active translations 2 1 static, 1 dynamic; 1 extended Outside interfaces FastEthernet0/1 Inside interfaces FastEthernet0/0 Hits 10 Misses 0 CEF Translated packets 10, CEF Punted packets 0 Expired translations 0 Dynamic mappings Appl doors 0 Normal doors 0 Queued Packets 0 R1show ip nat translations Pro Inside global Inside local Outside local Outside global icmp — — — As you can see in the above output, NAT is active as manifested by the appearance of an additional dynamic entry for ICMP protocol and some additional hits, corresponding to our ping attempt from PC to Server. We just configured and verified a simple NAT scenario translating only the source or destination not both at the same time IP addresses of packets moving between inside and outside interfaces. This sort of NAT configuration is called static NAT as a single inside local IP address is statically mapped to a single outside local IP address. Another important feature of NAT is static Port Address Translation PAT. Static PAT is designed to allow one-to-one mapping between local and global addresses. A common use of static PAT is to allow Internet users from the public network to access a Web server located in the private network. Let’s assume we intend to host a Web server on the inside on the same PC, that has an IP address The following configuration line would allow us to do just that R1configip nat inside source static tcp 80 80 This configuration line performs the static address translation for the Web server. With this configuration line, users that try to reach port 80 www are automatically redirected to port 80 www. In our case, is the IP address of the PC which is also the Web server. This configuration can be verified using the same two NAT verification commands show ip nat translations and show ip nat statistics. Notice that the address with port number 80 HTTP translates to port 80, and vice versa. Therefore, Internet users can browse the Web server even though the Web server is on a private network with a private IP address. Related Posts Comparison of Static vs Dynamic Routing in TCP/IP Networks Cisco OSPF DR-BDR Election in Broadcast Networks – Configuration Example How to Configure Port Forwarding on Cisco Router With Examples Adjusting MSS and MTU on Cisco 800 routers for PPPoE over DSL The Most Important Cisco Show Commands You Must Know Cheat Sheet
Forthis purpose, go to the "templates" menu and choose the Paris vedge profile. Then we have to select Interface under VPN 0 ( Transport VPN). And enable the NAT in the profile. Now, we have to create "NAT POOL RANGE." After configuring the nat pool range, we need to choose "STATIC NAT" option and add static nat: That was the STATIC NAT config.
Network Address Translation NAT replaces IP addresses within a packet with different IP addresses. NAT is very useful in these instances Conserving IP address space. Implementing TCP load distribution. Connecting networks with overlapping addresses. During network migration, which involves the renumbering of nodes. Connecting a private network using an unregistered address to a public network like the Internet. Distributing other Transmission Control Protocol TCP and User Datagram Protocol UDP based router configured for NAT maintains a translation table that has the mapping between the addresses used in the translation. Configuring NAT involves identifying the NAT inside and NAT outside interfaces, then configuring the way the addresses are to be translated, depending on the requirement. A router configured with NAT translates only traffic that is forwarded between the inside and outside interfaces, and the flow that matches the criteria specified for translation. Traffic that does not meet these conditions is forwarded without any translation. To configure the inside and outside interfaces, issue the ip nat inside and ip nat outside commands under the respective interfaces. A static NAT configuration creates a one-to-one mapping and translates a specific address to another address. This type of configuration creates a permanent entry in the NAT table, as long as the configuration is present and is useful when users on both inside and outside networks need to initiate a connection. To configure static NAT, issue the ip nat inside source static or ip nat outside source static commands in global configuration mode, depending on where the host is located. Static NAT can also be used to redirect traffic using a particular port to a different port on a host. This is helpful when the users belonging to the inside network use a particular port number to access a particular application like a web server available on the inside or outside network. The same application is accessed by users from the outside network using a different port number. To redirect traffic to a different port, issue the ip nat inside source {static {tcpudp local-ip local-port global-ip global-port} [extendable] or ip nat outside source {static tcpudp global-ip global-port local-ip local-port} [extendable] commands in global configuration mode, depending on whether the inside or outside network is available. Another type of configuration is dynamic NAT, which is useful when a limited number of addresses is available instead of the actual number of hosts to be translated. The addresses used for translation are configured by issuing the ip nat pool command in global configuration mode. The hosts to be translated are specified by issuing the access-list command or match statements in the route-map command. The pool and the list of hosts to be translated are linked together by issuing the ip nat inside source list name pool name command or the ip nat inside source route-map name pool name command in global configuration mode. The command can be issued for an outside network by replacing the keyword "inside" with "outside". Dynamic NAT creates an entry in the NAT table, when the host initiates a connection and establishes a one-to-one mapping between the addresses. But the mapping could vary depending on the address available in the pool at the time of communication. Dynamic NAT allows sessions to be initiated from inside or outside networks for which it is configured. Dynamic NAT entries are removed from the translation table if the host does not communicate for a specific period of time, which is configurable, and the address is returned to the pool for use by another host. Another form of dynamic translation is overloading or Port Address Translation PAT, which allows many hosts to be mapped to a single address at the same time. When PAT is configured, the router makes use of the source port numbers to distinguish the sessions from different hosts. PAT creates an extended translation entry in the NAT table by including the protocol as well as the port information. PAT is configured by adding the overload option to the dynamic NAT configuration command, which binds the hosts and the pool. Static and dynamic NAT can be configured simultaneously when it is required. This occurs in cases where many addresses are not available for translation, and certain devices must be statically configured for NAT at the same time. For more information on configuring NAT refer to these documents NAT Local and Global Definitions Configuring Static and Dynamic NAT Simultaneously Configuring Network Address Translation Getting Started View more Cisco How-To Tutorials Search 54,082 current Cisco Job openings worldwide! Join the Network World communities on Facebook and LinkedIn to comment on topics that are top of mind. Brad Reese is research manager at advancing the careers of 600,000-plus certified individuals in the growing Cisco Career Certification Program. Copyright © 2008 IDG Communications, Inc.
Note Ensure that the routers and switches have been erased and have no startup configurations. If you are unsure contact your instructor. Required Resources • 2 Routers (Cisco 4221 with Cisco IOS XE Release 16.9.4 universal image or comparable) • 2 Switches (Cisco 2960 with Cisco IOS Release 15.2(2) lanbasek9 image or comparable)

Published On August 6áµ—Ę°, 2019 0207 IP Addressing NAT Configuration Guide, Cisco IOS XE Gibraltar The Network Address Translation 46 NAT 46 feature solves IPv4 to IPv6 connectivity by providing a mechanism for connectivity of IPv4 hosts to IPv6 internet when dual stack and IPv6 tunneling solutions cannot be used. Note NAT 46 is supported only on Cisco ISR 4000 platforms. Feature Information for Connectivity Between IPv4 and IPv6 Hosts Using Stateless NAT 46 Restrictions for NAT 46 Information About NAT 46 Configuring Network Address Translation 46 Verifying the NAT 46 Configuration Feature Information for Connectivity Between IPv4 and IPv6 Hosts Using Stateless NAT 46 The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature. Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to An account on is not required. Table 1. Feature Information for Connectivity Between IPv4 and IPv6 Hosts Using Stateless NAT 46 Feature Name Releases Feature Information Connectivity Between IPv4 and IPv6 Hosts Using Stateless NAT 46 Cisco IOS XE Gibraltar Release The Network Address Translation 46 NAT 46 feature solves IPv4 to IPv6 connectivity by providing a mechanism for connectivity of IPv4 hosts to IPv6 internet when dual stack and IPv6 tunneling solutions cannot be used. Note NAT 46 is supported only on Cisco ISR 4000 platforms. Restrictions for NAT 46 Only Domain Name System DNS application layer gateway ALG is supported. Fragmented packet is not supported. Maximum Transmission Unit MTU discovery after converting to IPv6 packets is not supported. Virtual Routing and Forwarding-aware NAT 46 is not supported. Both NAT44 static, dynamic, and PAT configuration and stateful NAT46 configurations are not supported on the same interface. High-speed Logging HSL is not supported. Several IPv4 stateful features PBR, ZBFW, WAAS, WCCP, NBAR, and so on do not work after converting to IPv6 packets, and are not supported. High availability is not supported. Information About NAT 46 Overview of NAT 46 Scalability on NAT 46 NAT 46 Prefix Overview of NAT 46 The NAT46 solution solves IPv4 host to IPv6 internet connectivity. IPv4 hosts trying to reach a server, first initiate a DNS type A query packet. The NAT 46 router changes this to type AAAA query. When the query response is received, NAT 46 retrieves the IPv6 address from the response packet. An IPv4 address is allocated from the configured NAT 46 pool and an address binding is done for the retrieved IPv6 address and the allocated IPv4 address. An IPv4 address DNS response is sent to the IPv4 host. The source address of packets originating from IPv4 hosts is converted using a configured NAT 46 IPv6 prefix. The destination IPv4 address is translated to IPv6 address using pool address binding created during DNS packet flow. Example Configured Prefix IPv4 Address IPv4-Embedded IPv6 Address 20020DB8/96 20020DB8C000221 Scalability on NAT 46 There is no limitation to the number of private IPv4 addresses that can be supported because no sessions are maintained. The number of IPv6 hosts that can be represented by the IPv4 pool address should be scalable up to 40,000. NAT 46 Prefix The NAT 46 prefix cannot be same as the interface prefix. Neighbor Discovery Neighbor/Router Solicitation messages for the addresses in the NAT 46 prefix are not answered by the NAT 46 router. Hence, NAT 46 prefix cannot be same as the interface prefix. If a larger network smaller prefix that is less than 96 is obtained from the service provider, the network can be subdivided into multiple smaller networks and NAT 46 prefix can be configured with a smaller network prefix 96 bits. In addition, the NAT 46 router needs to be configured as a gateway or next hop router for the IPv6 hosts on an adjacent router of the service provider network. Configuring Network Address Translation 46 Procedure Step 1 enable Example Device> enable Enables privileged EXEC mode. Enter your password if prompted. Step 2 configure terminal Example Device configure terminal Enters global configuration mode. Step 3 interface type number Example Deviceconfig interface gigabitethernet 1/2/0 Configures an interface and enters interface configuration mode. Step 4 ip address ip-address mask Example Deviceconfig-if ip address Configures an IPv4 address for an interface. Step 5 nat64 enable Example Deviceconfig-if nat64 enable Enables NAT46 translation on an IPv4 interface. Step 6 exit Example Deviceconfig-if exit Exits interface configuration mode and enters global configuration mode. Step 7 interface type number Example Deviceconfig interface gigabitethernet 0/0/0 Configures an interface and enters interface configuration mode. Step 8 ipv6 enable Example Deviceconfig-if ipv6 enable Enables IPv6 processing on an interface. Step 9 ipv6 address {ipv6-address/prefix-length prefix-name sub-bits/ prefix-lenth Example Deviceconfig-if ipv6 address 2001DB811/96 Configures an IPv6 address based on an IPv6 general prefix and enables IPv6 processing on an interface. Step 10 nat64 enable Example Deviceconfig-if nat64 enable Enables NAT46 translation on an IPv6 interface. Step 11 exit Example Deviceconfig-if exit Exits interface configuration mode and enters global configuration mode. Step 12 nat64 settings nat46 enable Example Deviceconfig nat64 settings nat46 enable Enables NAT46 in the NAT64 settings. Step 13 nat46 v6 prefix ipv6 prefix/prefix-length Example Deviceconfig nat46 v6 prefix 2001/96 Configures the NAT46 IPv6 prefix. Step 14 nat46 v4 pool pool-name pool-address-range Example Deviceconfig nat46 v4 nat46_pool Configures the NAT46 pool address range. Step 15 end Example Deviceconfig end Exits global configuration mode and returns to privileged EXEC mode. Verifying the NAT 46 Configuration Use the show nat64 statistics command to view the NAT 46 statistics. The following is sample output of the command. SUMMARY STEPS show nat64 statistics DETAILED STEPS show nat64 statistics Example Router show nat64 statistics NAT64 Statistics Total active translations 0 0 static, 0 dynamic; 0 extended Sessions found 0 Sessions created 0 Expired translations 0 Global Stats Packets translated IPv4 -> IPv6 Stateless 0 Stateful 0 MAP-T 0 NAT46 30 Packets translated IPv6 -> IPv4 Stateless 0 Stateful 0 MAP-T 0 NAT46 30

GW2(config)# interface fastethernet 0/1. GW2 (config-if)# standby 1 ip . GW2 (config-if)# standby 1 preempt. GW2 (config-if)# exit. You do not need to do this HSRP Cisco Configuration for both sides, but in this configuration, we do it for both sites. After this you can check the configuration with “show standby” command on GW1

CONFIGURATION DE BASE D’UN ROUTEUR Configuration de base du routeur Configuration des interfaces du routeur Enregistrer les modifications apportées à un routeur Vérifier des informations renvoyées par les commandes show Configurer une interface Ethernet Configurer une interface Série Vérifier les informations de routage Surveiller et dépanner son réseau avec CDP Utiliser les interfaces de bouclages ROUTAGE STATIQUE Configurer les routes statiques Configurer une interface de sortie pour une route statique Modifier une route statique Configurer une route statique sur un réseau Ethernet pour qu’elle n’ait pas à utiliser la recherche récursive de l’adresse IP de tronçon suivant Modifier une route statique Créer une route statique par défaut ROUTAGE DYNAMIQUE RIP V1 Activer / désactiver le protocole RIP Spécifier des réseaux Dépannage protocole RIP Empêcher la transmissions des mises à jours RIP sur une interface précise ROUTAGE DYNAMIQUE RIP V2 Activer / désactiver le protocole RIP V2 Activer / désactiver le protocole le résumé automatique dans RIP V2 Commande de vérification de RIP V2 ROUTAGE DYNAMIQUE EIGRP Mise en place EIGRP Paramétrage du réseau Vérifier le protocole EIGRP Modifier les mesures composites de EIGRP Modifier la valeur de la bande passante vérifier tous les chemins possibles vers un réseau Désactive le résumé automatique Configurer le résumé manuel Mettre en place route par défaut Configurer les intervalles Hello et les temps d’attente ROUTAGE DYNAMIQUE OSPF Mise en place OSPF Paramétrage du réseau Nouvelle carte bouclage Router-ID Vérifier le protocole ospf Adapter la bande passante OSPF Modifier le coût de liaison Contrôler le choix du routeur désigné et de secours Désigner la route par défaut Configurer les intervalles Hello et DEAD Livre complet sur la configuration du routeur Cisco CONFIGURATION DE BASE D’UN ROUTEUR Configuration de base du routeur Router>enable permet de passer en mode d’exécution privilégié. Routerconfig t Passez en mode de configuration globale. Routerconfighostname R1 Appliquez un nom d’hôte unique au routeur. Routerconfigenable secret fafamdp Configurez un mot de passe à utiliser pour passer en mode d’exécution privilégié, ici fafamdp. Configuration les lignes de console et telnet pour se connecter au routeur R1configline console 0 R1config-linepassword cisco R1config-linelogin R1config-lineexit R1configline vty 0 4 R1config-linepassword cisco R1config-linelogin R1config-lineexit Configuration d’une bannière de connexion R1configbanner motd Enter TEXT message. End with the character ’. ****************************************** WARNING!! Unauthorized Access Prohibited!! ****************************************** Configuration des interfaces du routeur R1config t Passez en mode de configuration globale. R1configinterface Serial0/0 passez au mode de configuration d’interface en indiquant le type et le numéro d’interface. R1config-ifip address Configurez l’adresse IP et le masque de sous-réseau. R1config-ifdescription CiruitVBN32696-123 help desk1-800-555-1234 donner une descritpion de l’interface. Enregistrer les modifications apportées à un routeur R1copy running-config startup-config Enregistrer les modifications . Vérifier des informations renvoyées par les commandes show R1show running-config Cette commande affiche la configuration en cours stockée dans la mémoire vive. R1show ip route Cette commande affiche la table de routage actuellement utilisée par l’IOS pour choisir le meilleur chemin à emprunter afin d’atteindre les réseaux de destination. R1show ip interface brief Cette commande affiche des informations sommaires sur la configuration d’interface, notamment l’adresse IP et l’état de l’interface. R1show interfaces Cette commande affiche tous les paramètres et toutes les statistiques de configuration d’interface. Configurer une interface Ethernet R1configinterface fastethernet 0/0 R1config-ifip address R1config-ifno shutdown Configurer une interface Série R1configinterface serial 0/0/0 Sélection de l’interface de série R1config-ifclock rate 64000 Une fois le câble connecté, l’horloge peut alors être paramétrée à l’aide de la commande clock rate. Les fréquences d’horloge disponibles, en bits par seconde, sont 1 200, 2 400, 9 600, 19 200, 38 400, 56 000, 64 000, 72 000, 125 000, 148 000, 500 000, 800 000, 1 000 000, 1 300 000, 2 000 000 et 4 000 000. R1config-ifip address Paramétrage réseau de l’interface. R1config-ifno shutdown Activer l’interface. R1show interfaces serial 0/0/0 Vérifier la configuration de l’interface série Vérifier les informations de routage R1show ip route Cette commande affiche la table de routage actuellement utilisée par l’IOS pour choisir le meilleur chemin à emprunter afin d’atteindre les réseaux de destination. R1show ip interface brief Cette commande affiche des informations sommaires sur la configuration d’interface, notamment l’adresse IP et l’état de l’interface. Surveiller et dépanner son réseau avec CDP Le protocole CDP fournit les informations suivantes concernant chaque périphérique CDP voisin Identificateurs de périphériques par exemple, le nom d’hôte configuré d’un commutateur. Liste d’adresses jusqu’à une adresse de couche réseau pour chaque protocole pris en charge. Identificateur de port le nom du port local et distant sous la forme d’une chaîne de caractères ASCII, comme ethernet0. Liste de capacités par exemple, pour savoir si ce périphérique est un routeur ou un commutateur. Plateforme la plateforme matérielle du périphérique, par exemple, un routeur Cisco série 7200. Les commandes possibles R1show cdp neighbors Donne des informations sur les voisins CDP comme l’ID du périphérique voisin, l’Interface locale, la Valeur du délai de conservation en secondes, le Code de capacité du périphérique voisin, la Plateforme matérielle voisine et l’ID du port distant voisin R1show cdp neighbors detail révèle l’adresse IP d’un périphérique voisin et permet de déterminer si l’un des voisins CDP présente une erreur de configuration IP R1configno cdp run désactive le protocole CDP R1config-ifno cdp enable Si vous souhaitez utiliser le protocole CDP, mais que vous devez arrêter les annonces CDP sur une interface précise. Utiliser les interfaces de bouclages Routerconfiginterface loopback 0 Sélection de l’interface de bouclage Routerconfig-ifip address ROUTAGE STATIQUE Configurer les routes statiques R1debug ip routing Pour que l’IOS affiche un message lorsque la nouvelle route est ajoutée à la table de routage. R1conf t Passez en mode de configuration globale. R1configip route Analysons de plus près ip route – Commande de route statique – Adresse réseau de réseau distant – Masque de sous-réseau de réseau distant – Adresse IP d’interface Serial 0/0/0 sur le routeur Configurer une interface de sortie pour une route statique R1conf t Passez en mode de configuration globale. R1configip route serial 0/0/0/ Configure cette route statique pour utiliser une interface de sortie au lieu d’une adresse IP de tronçon suivant. Modifier une route statique R1conf t Passez en mode de configuration globale. R1configip route Création d’une route statique R1config-ifno ip route Annulation de la route statique crée précedemment R1config-ifip route serial 0/0/0 Recréation d’une route statique Configurer une route statique sur un réseau Ethernet pour qu’elle n’ait pas à utiliser la recherche récursive de l’adresse IP de tronçon suivant R1conf t Passez en mode de configuration globale. R1configip route fastethernet 0/1 Configurer la route statique pour inclure à la fois l’interface de sortie et l’adresse IP de tronçon suivant. Modifier une route statique R1conf t Passez en mode de configuration globale. R1configip route Création d’une route statique R1config-ifno ip route Annulation de la route statique crée précedemment R1config-ifip route serial 0/0/0 Recréation d’une route statique Créer une route statique par défaut R1conf t Passez en mode de configuration globale. R1configip route serial 0/0/0 Tous les paquets iront par défaut vers l’interface serial 0/0/0 ROUTAGE DYNAMIQUE RIP V1 Activer / désactiver le protocole RIP R1conf t Passez en mode de configuration globale. R1configrouter rip Cette commande ne lance pas automatiquement le processus RIP. Elle fournit un accès permettant de configurer les paramètres du protocole de routage. Aucune mise à jour de routage n’est envoyée. R1configno router rip Cette commande arrête le processus RIP et efface toutes les configurations RIP existantes. Spécifier des réseaux R3conf t Passez en mode de configuration globale. R3configrouter rip Active RIP R3config-routernetwork La commande network est configurée sur les routeurs pour les réseaux directement connectés. R3config-routernetwork La commande network est configurée sur les routeurs pour les réseaux directement connectés. R3show running-config Vérifie la configuration. Dépannage protocole RIP R3show ip route La commande show ip route vérifie que les routes reçues par les voisins RIP sont installées dans une table de routage. Les routes RIP sont indiquées dans la sortie par la lettre R. R3show ip protocols Celle-ci affiche le protocole de routage actuellement configuré sur le routeur. Ces données peuvent être utilisées pour vérifier la plupart des paramètres RIP. R3debug ip rip permet d’identifier les problèmes qui affectent les mises à jour RIP. Cette commande affiche les mises à jour du routage RIP lors de leur envoi et de leur réception. Empêcher la transmissions des mises à jours RIP sur une interface précise Routerconfig-routerpassive-interface interface-type interface-number Exemple ci-dessous R3configrouter rip Active RIP R3config-router passive-interface fastethernet 0/0 Cette commande arrête les mises à jour de routage via l’interface spécifiée ici fastethernet 0/0. Toutefois, le réseau auquel appartient l’interface spécifiée continuera d’être annoncé dans les mises à jour de routage envoyées via d’autres interfaces. ROUTAGE DYNAMIQUE RIP V2 Activer / désactiver le protocole RIP V2 R1conf t Passez en mode de configuration globale. R1configrouter rip Cette commande ne lance pas automatiquement le processus RIP. Elle fournit un accès permettant de configurer les paramètres du protocole de routage. Aucune mise à jour de routage n’est envoyée. R1configversion 2 Permet de modifier RIP afin d’utiliser la version 2. Cette commande doit être configurée sur tous les routeurs du domaine de routage. R1configversion Rétablir RIP 1 R1configno router rip Cette commande arrête le processus RIP et efface toutes les configurations RIP existantes. Activer / désactiver le protocole le résumé automatique dans RIP V2 R1conf t Passez en mode de configuration globale. R1configrouter rip Cette commande ne lance pas automatiquement le processus RIP. Elle fournit un accès permettant de configurer les paramètres du protocole de routage. Aucune mise à jour de routage n’est envoyée. R1configno auto-summary Cette commande n’est pas disponible dans RIPv1. Une fois le résumé automatique désactivé, RIPv2 ne résume plus les réseaux dans leur adresse par classe au niveau des routeurs de périphérie. R1show ip protocols Permet de vérifier si le résumé de réseau automatique n’est pas actif ».. Commande de vérification de RIP V2 R1show ip route Il s’agit de la première commande à utiliser pour vérifier la convergence de réseau. Lors de l’étude de la table de routage, il est important de vérifier si la table de routage contient les routes qui doivent y figurer . R1show ip interface brief Une interface hors service ou mal configurée est souvent la cause de l’absence d’un réseau dans la table de routage. La commande show ip interface brief vérifie rapidement l’état de toutes les interfaces. R1show ip protocols La commande show ip protocols vérifie plusieurs éléments critiques, notamment l’activation de RIP, sa version, l’état du résumé automatique et les réseaux inclus dans les instructions réseau. R1debug ip rip Très utile pour examiner le contenu des mises à jour de routage envoyées et reçues par un routeur. R1ping La commande ping permet de vérifier facilement la connectivité de transmission. R1show running-config La commande show running-config peut être utilisée pour vérifier toutes les commandes actuellement configurées. ROUTAGE DYNAMIQUE EIGRP Mise en place EIGRP R1conf t Passez en mode de configuration globale. R1configrouter eigrp système-autonome Le paramètre de système autonome est un nombre choisi entre 1 et 65 535 choisi par l’administrateur réseau. Ce nombre est le numéro d’ID de processus, et il est important car tous les routeurs situés sur ce domaine de routage EIGRP doivent utiliser le même numéro d’ID de processus numéro de système-autonome. Exemple R1configrouter eigrp 1 Faire la même configuration sur tout les routeurs Paramétrage du réseau R1conf t Passez en mode de configuration globale. R1configrouter eigrp 1 Faire la même configuration sur tout les routeurs R1config-routernetwork Toute interface sur ce routeur qui correspond à l’adresse réseau ici dans la commande network est activée pour envoyer et recevoir des mises à jour EIGRP. Ce réseau ou sous-réseau sera inclus dans les mises à jour de routage EIGRP. R1config-routernetwork Pour configurer EIGRP afin d’annoncer des sous-réseaux spécifiques uniquement dans ce cas représente le contraire de c’est donc le contraire du masque de sous réseau qu’il faut indiquer. Vérifier le protocole EIGRP R1show ip eigrp neighbors pour visualiser la table de voisinage et vérifier que EIGRP a établi une contiguïté avec ses voisins. Pour chaque routeur, vous devez voir l’adresse IP du routeur contigu et l’interface que ce dernier utilise pour joindre le voisin EIGRP. R1show ip protocols Affiche les différents types de sorties spécifiques à chaque protocole de routage. Modifier les mesures composites de EIGRP Explication EIGRP utilise les valeurs suivantes dans sa mesure composite pour calculer le chemin préféré vers un réseau Bande passante – Délai – Fiabilité – Charge Routerconfig-routermetric weights tos k1 k2 k3 k4 k5 Explication ci-dessous de la commande – La valeur tos Type of Service – Type de service est un vestige d’IGRP et n’a jamais été mise en œuvre. – K1 = Bande passante – K2 = Charge – K3 = Délai – K4 et K5 = Fiabilité Modifier la valeur de la bande passante R1conf t Passez en mode de configuration globale. R1configinterface s 0/0/0 Sélection de l’interface à modifier R1config-ifbandwitch 1024 La bande passante de la liaison entre R1 et l’autre routeur est de 1 024 Kbits/s, bien sur l’autre routeur devra être paramétrer de la même façon. R1config-ifip bandwidth-percent eigrp 1 50 Par défaut, EIGRP n’utilise que jusqu’à 50 % de la bande passante d’une interface pour les données EIGRP. Cela permet au processus EIGRP de ne pas surcharger une liaison en ne laissant pas suffisamment de bande passante pour le routage du trafic normal. La commande ip bandwidth-percent eigrp peut être utilisée pour configurer le pourcentage de bande passante pouvant être utilisé par le protocole EIGRP sur une interface. R1config-ifno bandwitch Pour restaurer la valeur par défaut. vérifier tous les chemins possibles vers un réseau R1show ip eigrp topology all-links montre tous les chemins possibles vers un réseau, notamment les successeurs, les successeurs potentiels et même les routes qui ne sont pas des successeurs potentiels. Désactive le résumé automatique R1conf t Passez en mode de configuration globale. R1configrouter eigrp 1 Active EIGRP R1config-routerno auto-summary Désactive le résumé automatique Configurer le résumé manuel R1conf t Passez en mode de configuration globale. R1configinterface serial 0/0/0 Sélection des interfaces qui transmet des paquets EIGRP R1config-ifip summary-address eigrp 1 Configure le résumé du routage sur toutes les interfaces qui transmettent des paquets EIGRP, donc il faut le faire sur chaque interface utilisé. Mettre en place route par défaut R1conf t Passez en mode de configuration globale. R1configip route votre_interface_de_sortie Tout les paquets utiliserons par défaut l’interface de sortie que vous configurerez R1configrouter eigrp 1 Active EIGRP R1config-routerredistribute static EIGRP nécessite l’utilisation de la commande redistribute static pour inclure cette route statique par défaut dans les mises à jour de routage EIGRP. La commande redistribute static demande à EIGRP d’inclure cette route statique dans les mises à jour EIGRP vers les autres routeurs. Configurer les intervalles Hello et les temps d’attente R1conf t Passez en mode de configuration globale. R1configinterface serial 0/0/0 Sélection des interfaces qui transmet des paquets EIGRP. R1config-ifip hello-interval eigrp 1 60 Modifie l’interval Hello, ici 60 secondes R1config-ifip hold-time eigrp 1 180 Si vous modifiez l’intervalle Hello, assurez-vous que vous modifiez également le temps d’attente en lui attribuant une valeur supérieure ou égale à celle de l’intervalle Hello. Ici 180 secondes. ROUTAGE DYNAMIQUE OSPF Mise en place OSPF R1conf t Passez en mode de configuration globale. R1configrouter ospf process-id Le paramètre process-id est un nombre choisi entre 1 et 65 535 choisi par l’administrateur réseau. Ce nombre est le numéro d’ID de processus, et il est important car tous les routeurs situés sur ce domaine de routage EIGRP doivent utiliser le même numéro d’ID de processus numéro de système-autonome. Exemple R1configrouter ospf 1 Faire la même configuration sur tout les routeurs Paramétrage du réseau R1conf t Passez en mode de configuration globale. R1configrouter ospf 1 Faire la même configuration sur tout les routeurs R1config-routernetwork area 0 Pour configurer OSPF afin d’annoncer des sous-réseaux spécifiques uniquement dans ce cas représente le contraire de c’est donc le contraire du masque de sous réseau qu’il faut indiquer. Area 0 fait référence à la zone OSPF. Une zone OSPF est un groupe de routeurs qui partagent les informations d’état des liaisons. Tous les routeurs OSPF de la même zone doivent avoir les mêmes informations. Nouvelle carte bouclage Router-ID R1conf t Passez en mode de configuration globale. R1configrouter ospf 1 Activer OSPF R1config-routerrouter-id La commande OSPF router-id a été ajoutée à IOS dans la version ; elle remplace les adresses de bouclage et les adresses IP d’interface physique pour la détermination des ID de routeur. Vérifier le protocole ospf R1show ip ospf neighbors pour visualiser la table de voisinage et vérifier que OSPF a établi une contiguïté avec ses voisins. Pour chaque routeur, vous devez voir l’adresse IP du routeur contigu et l’interface que ce dernier utilise pour joindre le voisin OSPF. R1show ip protocols Affiche les différents types de sorties spécifiques à chaque protocole de routage. R1show ip ospf La commande show ip ospf peut également être utilisée pour examiner l’ID de routeur et l’ID de processus OSPF. En outre, cette commande affiche les informations de zone OSPF, ainsi que la dernière fois où l’algorithme SPF a été calculé. R1show ip ospf interface La méthode la plus rapide pour vérifier les intervalles Hello et Dead est d’utiliser la commande show ip ospf interface. Adapter la bande passante OSPF R1conf t Passez en mode de configuration globale. R1configinterface s 0/0/0 Sélection de l’interface à modifier R1config-ifauto-cost reference-bandwidth Permet à la bande passante de référence d’être modifiée pour s’adapter aux réseaux ayant des liaisons d’une rapidité supérieure à 100 000 000 bits/s 100 Mbits/s Bande passante pour liaisons plus rapide R1config-routerauto-cost reference-bandwidth 10000 a bande passante de référence peut être modifiée pour prendre en compte ces liaisons plus rapides, grâce à la commande OSPF auto-cost reference-bandwidth. Lorsque cette commande est nécessaire, utilisez-la sur tous les routeurs afin que la mesure de routage OSPF reste cohérente. Modifier le coût de liaison R1conf t Passez en mode de configuration globale. R1configinterface s 0/0/0 Sélection de l’interface à modifier R1config-ifbandwitch 1024 La bande passante de la liaison entre R1 et l’autre routeur est de 1 024 Kbits/s, bien sur l’autre routeur devra être paramétrer de la même façon. Autre méthode R1configinterface serial 0/0/0 Sélectionnez votre interface. R1config-ifip ospf cost 1562 Il existe une méthode alternative à l’utilisation de la commande bandwidth, utiliser la commande ip ospf cost, qui vous permet de spécifier directement le coût d’une interface. Avec bandwitch il aurait fallu indiquer 64 pour avoir cette valeur, vous pouvez vérifier avec show ip ospf interface Contrôler le choix du routeur désigné et de secours R1conf t Passez en mode de configuration globale. R1configinterface fastethernet 0/0 Sélection de l’interface à modifier R1config-ifip ospf priority 200 La valeur de priorité par défaut était de 1 pour toutes les interfaces de routeur. C’était donc l’ID de routeur qui déterminait le DR et le BDR. Mais si vous remplacez la valeur par défaut, 1, par une valeur plus élevée, le routeur dont la priorité est la plus élevée devient le DR, et celui qui a la seconde priorité devient le BDR Désigner la route par défaut R1conf t Passez en mode de configuration globale. R1configinterface fastethernet 0/0 Sélection de l’interface à modifier R1configip route votre_interface_de_sortie Tout les paquets utiliserons par défaut l’interface de sortie que vous configurerez R1config-routerdefault-information originate Comme RIP, OSPF nécessite la commande default-information originate pour annoncer la route statique par défaut aux autres routeurs de la zone. Si la commande default-information originate n’est pas utilisée, la route par défaut quatre zéros » ne sera pas diffusée aux autres routeurs de la zone OSPF. Configurer les intervalles Hello et DEAD R1conf t Passez en mode de configuration globale. R1configinterface serial 0/0/0 Sélection des interfaces qui transmet des paquets EIGRP. R1config-ifip ospf hello-interval 5 Modifie l’interval Hello, ici 60 secondes. Le fait de modifier de façon explicite le minuteur est une saine pratique, plutôt que de compter sur une fonction automatique d’IOS. R1config-ifip ospf dead-interval 20 Après 20 secondes, le compte à rebours du minuteur Dead de R1 se termine. La contiguïté entre R1 et R2 est perdue.

Lesquatres types d'implémentations de NAT. NAPT (Network Address and Port Translation) / IP Masquerading. Translation d'adresses dynamique. Translation d'adresses statique. Redirection de port. Compatibilité et incompatibilité NAT. Exemple routeur CISCO 2500. Matrice de Compatibilité des protocoles VPN.
First of all, assuming that K router is ISP router, we need to remove nat configs from K router and add static routes on edge routers. there is also a duplicate IP address on serial interfaces. To make this NAT lab to work, we need NAT static entry on BB-S similarly what you have on DC router. Since you have same Private range on left and right sides, we need to hide those behind Nat. you can add on S router following entry ip nat inside source static you can test it using BB-K, an ISP router by pining Public IPs like or or newly added entry You cannot reach Private range from Internet, so you cannot ping any Normally and technically, to reach private web server from the Internet, routers will have static TCP NAT entries translating port 80 of Private IP to Public IP port 80. Example on BB-S has ip nat inside source static tcp 80 80 Regards, ML**Please Rate All Helpful Responses **
Cettevidéo proposée par Forum OFPPT, centre de formation , vous explique les étapes initiales de configuration NAT sous Cisco.Pour plus d'informations : htt
Sep 25, 2018 Last Updated Sep 25, 2018 CCNA 200-125 Which technology allows a large number of private IP addresses to be represented by a smaller number of public IP addresses?A. NAT*B. NTPC. RFC 1631D. RFC 1918What is the effect of the overload keyword in a static NAT translation configuration?A. It enables port address translation.*B. It enables the use of a secondary pool of IP addresses when the first pool is It enables the inside interface to receive It enables the outside interface to forward Hide Explanation/ReferenceBy adding the keyword “overload” at the end of a NAT statement, NAT becomes PAT Port Address Translation. This is also a kind of dynamic NAT that maps multiple private IP addresses to a single public IP address many-to-one by using different ports. Static NAT and Dynamic NAT both require a one-to-one mapping from the inside local to the inside global address. By using PAT, you can have thousands of users connect to the Internet using only one real global IP address. PAT is the technology that helps us not run out of public IP address on the Internet. This is the most popular type of two types of NAT addresses are used in a Cisco NAT device? Choose twoA. inside local*B. inside global*C. inside privateD. outside privateE. external globalF. external localShow Hide Explanation/ReferenceNAT use four types of addresses* Inside local address – The IP address assigned to a host on the inside network. The address is usually not an IP address assigned by the Internet Network Information Center InterNIC or service provider. This address is likely to be an RFC 1918 private address.* Inside global address – A legitimate IP address assigned by the InterNIC or service provider that represents one or more inside local IP addresses to the outside world.* Outside local address – The IP address of an outside host as it is known to the hosts on the inside network.* Outside global address – The IP address assigned to a host on the outside network. The owner of the host assigns this is the danger of the “permit any” entry in a NAT access list?A. It can lead to overloaded resources on the router.*B. It can cause too many addresses to be assigned to the same It can disable the overload It prevents the correct translation of IP addresses on the inside type of address is the public IP address of a NAT device?A. outside globalB. outside localC. inside global*D. inside localE. outside publicF. inside publicShow Hide Explanation/ReferenceNAT use four types of addresses* Inside local address – The IP address assigned to a host on the inside network. The address is usually not an IP address assigned by the Internet Network Information Center InterNIC or service provider. This address is likely to be an RFC 1918 private address.* Inside global address – A legitimate IP address assigned by the InterNIC or service provider that represents one or more inside local IP addresses to the outside world.* Outside local address – The IP address of an outside host as it is known to the hosts on the inside network.* Outside global address – The IP address assigned to a host on the outside network. The owner of the host assigns this command can you enter to display the hits counter for NAT traffic?A. show ip nat statistics*B. debug ip natC. show ip debug natD. clear ip nat statisticsShow Hide Explanation/ReferenceAn example of the output of the “show ip nat statistics” is shown below. As we can see, the “Hits” counter is NAT function can map multiple inside addresses to a single outside address?A. PAT*B. SFTPC. RARPD. ARPE. TFTPShow Hide Explanation/ReferenceBy adding the keyword “overload” at the end of a NAT statement, NAT becomes PAT Port Address Translation. This is also a kind of dynamic NAT that maps multiple private IP addresses to a single public IP address many-to-one by using different is the first step in the NAT configuration process?A. Define inside and outside interfaces.*B. Define public and private IP Define IP address Define global and local Hide Explanation/ReferenceIn NAT configuration we should specify the inside and outside interfaces first with the command “ip nat inside” and “ip nat outside” under interface which circumstance should a network administrator implement one-way NAT?A. when the network must route UDP trafficB. when traffic that originates outside the network must be routed to internal hosts *C. when traffic that originates inside the network must be routed to internal hostsD. when the network has few public IP addresses and many private IP addresses require outside accessWhich statement about the inside interface configuration in a NAT deployment is true?A. It is defined globallyB. It identifies the location of source addresses for outgoing packets to be translated using access or route maps.*C. It must be configured if static NAT is usedD. It identifies the public IP address that traffic will use to reach the Hide Explanation/ReferenceWhen we specify a NAT “inside” interface via the “ip nat inside” command under interface mode, we are specifying the source IP addresses. Later in the “ip nat” command under global configuration mode, we will specify the access or route map for these source example the commandRouterconfig ip nat inside source list 1 pool PoolforNATafter the keyword “source” we need to specify one of the three keywords+ list specify access list describing local addresses but this command does not require an “inside” interface to be configured+ route-map specify route-map+ static specify static local -> global mappingWhich NAT type is used to translate a single inside address to a single outside address?A. dynamic NATB. NAT overloadC. PATD. static NAT*Show Hide Explanation/ReferenceThere are two types of NAT translation dynamic and NAT Designed to allow one-to-one mapping between local and global addresses. This flavor requires you to have one real Internet IP address for every host on your networkDynamic NAT Designed to map an unregistered IP address to a registered IP address from a pool of registered IP addresses. You don’t have to statically configure your router to map an inside to an outside address as in static NAT, but you do have to have enough real IP addresses for everyone who wants to send packets through the Internet. With dynamic NAT, you can configure the NAT router with more IP addresses in the inside local address list than in the inside global address pool. When being defined in the inside global address pool, the router allocates registered public IP addresses from the pool until all are allocated. If all the public IP addresses are already allocated, the router discards the packet that requires a public IP this question we only want to translate a single inside address to a single outside address so static NAT should be are two benefits of using NAT? choose twoA. NAT protects network security because private networks are not advertised.*B. NAT accelerates the routing process because no modifications are made on the Dynamic NAT facilitates connections from the outside of the NAT facilitates end-to-end communication when IPsec is NAT eliminates the need to re-address all host that require external access.*F. NAT conserves addresses through host MAC-level Hide Explanation/ReferenceBy not reveal the internal IP addresses, NAT adds some security to the inside network -> A is has to modify the source IP addresses in the packets -> B is not from the outside to a network through “NAT” is more difficult than a normal network because IP addresses of inside hosts are hidden -> C is not order for IPsec to work with NAT we need to allow additional protocols, including Internet Key Exchange IKE, Encapsulating Security Payload ESP and Authentication Header AH -> more complex -> D is not allocating specific public IP addresses to inside hosts, NAT eliminates the need to re-address the inside hosts -> E is does conserve addresses but not through host MAC-level multiplexing. It conserves addresses by allowing many private IP addresses to use the same public IP address to go to the Internet -> F is not command can you enter to create a NAT pool of 6 addresses?A. Routerconfigip nat pool test prefix-length 24*B. Routerconfigip nat pool test prefix-length 16C. Routerconfigip nat pool test prefix-length 8D. Routerconfigip nat pool test prefix-length 8Show Hide Explanation/ReferenceThe syntax to create a NAT pool isRouterconfigip nat pool pool_name start_ip end_ip { netmask netmask prefix-length prefix-length }Therefore answer A is surely correct. Answer B is not correct as it creates many addresses from to then to C and D are not correct as we cannot use prefix-length of 8 /8 for a class B does NAT overloading provide one-to-many address translation?A. It uses a pool of addressesB. It converts IPV4 addresses to unused IPv6 AddressesC. It assigns a unique TCP/UDP port to each session*D. It uses virtual MAC Address and Virtual IP AddressesShow Hide Explanation/ReferenceBy adding the keyword “overload” at the end of a NAT statement, NAT becomes PAT Port Address Translation. This is also a kind of dynamic NAT that maps multiple private IP addresses to a single public IP address many-to-one by using different is the danger of the permit any entry in a NAT access list?A. It can lead to overloaded resources on the router.*B. It can cause too many addresses to be assigned to the same It can disable the overload It prevents the correct translation of IP addresses on the inside Hide Explanation/ReferenceUsing permit any can result in NAT consuming too many router resources, which can cause network problems. You should only limit the NAT access list to a specific range of IP configuration can be used with PAT to allow multiple inside address to be translated to a single outside address?A. Dynamic RoutingB. DNSC. PreemptD. Overload*

Configurerle PAT Configurer le DHCP Configurer la route statique par défaut Configuration globale Topologie CPE ATM Internet DSL Agregation router DSLAM Configuration Une session PPPoE est initiée par le client. Si la session à un Timeout, ou est déconnectée, le client PPPoE essaye de ré-établir la session. 2 options de configuration DSL PPPoE on Ethernet (2

Introduction Ce document décrit comment configurer la traduction d’adresses réseau NAT, Network Address Translation pour permettre la communication entre un serveur et un client qui sont sur des segments de réseau différents dans un espace IP en chevauchement. Conditions préalables Conditions requises Aucune spécification déterminée n'est requise pour ce document. Components Used Ce document n'est pas limité à des versions de matériel et de logiciel spécifiques. The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared default configuration. If your network is live, make sure that you understand the potential impact of any command. Note Ce document s’applique à tous les routeurs et à tous les commutateurs Cisco qui exécutent le logiciel Cisco IOS. Informations générales Objectif Permettre la communication entre un serveur et des clients qui sont sur deux segments de réseau différents dans un espace IP en chevauchement situation survenant généralement suite à une fusion de réseaux. Description Deux réseaux avec le même espace IP sont connectés par l’entremise des routeurs A et B nous utilisons ici un mécanisme de bouclage pour simuler la présence du réseau connecté. Le routeur NAT situé entre les routeurs A et B permet la communication entre les deux espaces IP en chevauchement. Configuration Diagramme du réseau Flux de trafic Lorsque les clients lancent le trafic vers le IP global du serveur, le trafic atteint le routeur NAT qui l’achemine vers le serveur, mais lorsque le trafic revient au routeur NAT, le routeur ne parvient pas à acheminer le trafic, car le serveur est connecté/connu du côté intérieur de l’interface. Pour résoudre ce problème, utilisez Mask NAT sur le trafic source provenant de l’extérieur au moment où il traverse le routeur NAT. Activez la NAT sur les interfaces intérieure et extérieure. interface Ethernet0/0description Connection to Serverip address nat insideend!interface Ethernet0/1description Connection to Clientsip address nat outsideend! Configurez la NAT pour qu’elle traduise les adresses intérieures locales en adresses intérieures globales. ip nat inside source static extendable Maintenant, configurez les clauses NAT pour qu’elles traduisent les adresses source des clients au moment où elles atteignent l’interface externe de la NAT. ip nat outside source static network /24 Configuration du routage Routage pour le serveur. Notez que la route spécifique pour le serveur est configurée pour pointer en direction du réseau local LAN Ethernet 0/0 ip route Ethernet0/0 Routage pour le réseau client ip route Ethernet0/1 Vérification Utilisez cette section pour confirmer que votre configuration fonctionne correctement. *Aug 12 1134 NAT* o icmp 10 -> 10 [42] *Aug 12 1134 NAT* o icmp 10 -> 10 [42]*Aug 12 1134 NAT* s= d= [42]*Aug 12 1134 NAT* s= d= [42]*Aug 12 1134 NAT* i icmp 10 -> 10 [42]*Aug 12 1134 NAT* s= d= [42]*Aug 12 1134 NAT* s= d= [42]NAT-Router*Aug 12 1134 NAT* o icmp 10 -> 10 [43]*Aug 12 1134 NAT* s= d= [43]*Aug 12 1134 NAT* s= d= [43]*Aug 12 1134 NAT* i icmp 10 -> 10 [43]*Aug 12 1134 NAT* s= d= [43]*Aug 12 1134 NAT* s= d= [43]NAT-Router Comme mentionné précédemment, lorsqu’un client lance le trafic la NAT extérieure traduit les adresses externes globales en adresses externes locales et achemine ensuite le trafic vers l’interface intérieure de la NAT. L’interface interne de la NAT traduit ensuite l’adresse de destination en adresse locale intérieure et le trafic est acheminé vers le serveur. Le serveur reçoit le trafic avec une adresse source Dépannage Il n'existe actuellement aucune information de dépannage spécifique pour cette configuration. Limite Dans cette configuration, seuls les clients peuvent amorcer une connexion et la connexion s’effectuera. Le trafic ne peut pas avoir une origine intérieure provenant du serveur et la NAT sera en échec, car il n’y a pas d’enregistrement NAT dans la table de traduction extérieur local » vers globale ».

Ina previous post, I have published a Cisco Switch Commands Cheat Sheet tutorial. Since these kinds of posts are useful as a reference for many people, I have decided to create also a Cisco Router Commands Cheat Sheet with the most useful and the most frequently used Command Line Interface (CLI) configuration commands for Cisco Routers.. Cisco IOS routers are

PAT – Port Address Translation – plays a huge role in IPv4 networks. Today’s post looks at the simpler of the two configuration options for router NAT configuration a single router interface IP address as in the inside global address. Jump in for your next bit of 5-10 minutes of practice! All about Config LabsThe blog has a series of lab exercises called “Config Labs.” Each lab presents a topology with the relevant initial configuration for each device. -action="collapse">Answer Options - Click Tabs to RevealOption 1 Paper/EditorOption 2 Cisco Packet TracerOption 3 Cisco Modeling LabsOption 1 Paper/Editor You can learn a lot and strengthen real learning of the topics by creating the configuration – even without a router or switch CLI. In fact, these labs were originally built to be used solely as a paper exercise! To answer, just think about the lab. Refer to your primary learning material for CCNA, your notes, and create the configuration on paper or in a text editor. Then check your answer versus the answer post, which is linked at the bottom of the lab, just above the comments section. Option 2 Cisco Packet Tracer You can also implement the lab using the Cisco Packet Tracer network simulator. With this option, you use Cisco’s free Packet Tracer simulator. You open a file that begins with the initial configuration already loaded. Then you implement your configuration and test to determine if it met the requirements of the lab. Use this link for more information about Cisco Packet Tracer. Use this workflow to do the labs in Cisco Packet Tracer Download the .pkt file linked below. Open the .pkt file, creating a working lab with the same topology and interfaces as the lab exercise. Add your planned configuration to the lab. Test the configuration using some of the suggestions below. Download this lab’s Packet Tracer File Option 3 Cisco Modeling Labs You can also implement the lab using Cisco Modeling Labs – Personal CML-P. CML-P or simply CML replaced Cisco Virtual Internet Routing Lab VIRL software in 2020, in effect serving as VIRL Version 2. If you prefer to use CML, use a similar workflow as you would use if using Cisco Packet Tracer, as follows Download the CML file filetype .yaml linked below. Import the lab’s CML file into CML and then start the lab. Compare the lab topology and interface IDs to this lab, as they may differ more detail below. Add your planned configuration to the lab. Test the configuration using some of the suggestions below. Download this lab’s CML file! Network Device Info The CML topology matches the lab topology. Lab Answers Below Spoiler AlertLab Answers Configuration Click Tab to RevealLab ConfigurationLab Configuration Answers Figure 1 PAT Topology interface GigabitEthernet0/1 ip nat inside!interface GigabitEthernet0/2 ip nat outside!ip nat inside source list 1 interface GigabitEthernet0/2 overload!access-list 1 permit Example 3 R1 Config Commentary, Issues, and Verification Tips Click Tabs to RevealLab CommentaryKnown Packet Tracer IssuesVerification Tips for CPT/CMLLab Commentary Commentary There are several ways to configure NAT, including static NAT, dynamic NAT, and Port Address Translation PAT. Static NAT is typically used for one-to-one translations from a specific inside address called an inside local address to a specific outside address called an inside global address. Dynamic NAT differs slightly because it allocates the outside address from a configured pool rather than pre-determining the specific address to use in each case. The third major type of NAT, PAT or NAT overload, uses either a specific outside address or a configured pool. The difference between PAT and the other types is that the mapping is not one-to-one from an inside address to an outside address. With PAT, there is a many-to-one mapping between the inside local address and the inside global address using unique TCP and UDP port numbers to decide where and how to translate the packets. For this lab, you were tasked with configuring PAT using R1’s G0/2 interface IP address for translations and access list 1. The ACL should match only R1’s LAN connecting to S1, S2, and S3. Once this is configured, the last step is to configure a PAT statement to use R1’s G0/2 interface and the ACL to map entries from R1’s LAN to its interface IP address. First, you have to determine which interfaces connect to hosts inside the network and connect to hosts outside the network. For this lab, R1’s G0/1 interface is connected to S1, S2, and S3 and is considered the inside interface. To configure this, use the ip nat inside command while in interface configuration mode. R1’s G0/2 interface is connected to R2 and is considered the outside interface. To configure this, use the ip nat outside command while in interface configuration mode. The second task to perform is to configure the ACL to match R1’s LAN connecting to S1, S2, and S3, all in subnet The global command access-list 1 permit configures the entire ACL. The third and final task uses one long command that ties four ideas together Packets entering interfaces per the source keyword Packets matching the logic in ACL 1 To use one inside global address – the address of the G0/2 interface To use the PAT overload feature The command ip nat inside source list 1 interface GigabitEthernet0/2 overload. Also, note that the requirements tell you to configure static routes on R2 as needed for the inside global addresses. In this case, the configuration uses a range of addresses in the subnet between R1 and R2, so R2 already has a connected route that includes the addresses used by NAT. So there is no need for any additional static routes. Known Packet Tracer Issues Known Issues in this Lab This section of each Config Lab Answers post hopes to help with those issues by listing any known issues with Packet Tracer related to this lab. In this case, the issues are Summary Detail 1 Occasional incorrect NAT show command output based on sequencing CPT may show incorrect NAT behavior if you configure NAT and then move directly to testing. You might want to configure, then save and re-open the .pkt file before testing. Why Would Cisco Packet Tracer Have Issues? Note The below text is the same in every Config Lab. Cisco Packet Tracer CPT simulates Cisco routers and switches. However, CPT does not run the same software that runs in real Cisco routers and switches. Instead, developers wrote CPT to predict the output a real router or switch would display given the same topology and configuration – but without performing all the same tasks, an actual device has to do. On a positive note, CPT requires far less CPU and RAM than a lab full of devices so that you can run CPT on your computer as an app. In addition, simulators like CPT help you learn about the Cisco router/switch user interface – the Command Line Interface CLI – without having to own real devices. CPT can have issues compared to real devices because CPT does not run the same software as Cisco devices. CPT does not support all commands or parameters of a command. CPT may supply output from a command that differs in some ways from what an actual device would give. Those differences can be a problem for anyone learning networking technology because you may not have experience with that technology on real gear – so you may not notice the differences. So this section lists differences and issues that we have seen when using CPT to do this lab. Verification Tips for CPT/CML Beyond comparing your answers to this lab’s Answers post, you can test in Cisco Packet Tracer CPT or Cisco Modeling Labs CML. In fact, you can and should explore the lab once configured. For this lab, once you have completed the configuration, try these verification steps. Verify the dynamic PAT configuration by checking the reachability from S1, S2, and S3 to R2 using ping. At router R1, using the show ip nat translations command to verify that the NAT table begins with no entries. From S1/S2/S3, try the ping command, pinging R2’s global address, which tests the static NAT configuration. At router R1, using the show ip nat translations command to verify a new NAT table entry appeared in support of each flow. Pay close attention to the port numbers used and the fact that all translation table entries use the same outside global address, just with different port numbers. Use a TCP or UDP app to test from S1/S2/S3 to router R2. For instance, use Telnet. Because the initial configuration did not prepare router R2 for inbound Telnet, add configuration on R2 as follows line vty 0 15 transport input all login password cisco From S1/S2/S3, try the telnet command, pinging R2’s global address, which tests the static NAT configuration. At router R1, using the show ip nat translations command to verify a new NAT table entry appeared in support of each flow. More Labs with Related Content! By Wendell Odom October 15, 2021 1305 Write a commentNo Comments View commentsWrite a comment

NATdynamique, PAT et NAT statique. CISCO FIREWALL ASA CONFIGURATION ET ADMINISTRATION 2/2 4. CONFIGURATION AAA Présentation de Cisco Secure ACS. Installation de Cisco Secure ACS. Configurer l'authentification et l'autorisation. Téléchargement des ACL. Dépannage AAA. 5. ROUTAGE ET COMMUTATION Rappels sur les VLAN.

We will begin by implementing Static NAT. Static NAT is used to do a one-to-one mapping between an inside address and an outside address. Static NAT also allows connections from an outside host to an inside host. Usually, static NAT is used for servers inside your network. For example, you may have a web server with the inside IP address and you want it to be accessible when a remote host makes a request to For this to work, you must do a static NAT mapping between those to IPs. In this example, we will use the FastEthernet 0/1 as the inside NAT interface, the interface connecting to our network, and the Serial 0/0/0 interface as the outside NAT interface, the one connecting to our service provider. Routerconfigip nat inside source static FastEthernet 0/1Routerconfig-ifip nat insideRouterconfig-ifinterface Serial 0/0/0Routerconfig-ifip nat outside Static NAT provides a permanent mapping between the internal and the public IP address. In our example the private IP address will always correspond to the public IP address Dynamic NAT is used when you have a “pool” of public IP addresses that you want to assign to your internal hosts dynamically. Don’t use dynamic NAT for servers or other devices that need to be accessible from the Internet. In this example, we will define our internal network as We also have the pool of public IP addresses from to and our assigned netmask is When you configure dynamic NAT, you have to define an ACL to permit only those addresses that are allowed to be translated. Routerconfigip nat pool NAT-POOL netmask 1 permit nat inside source list 1 pool NAT-POOLRouterconfiginterface FastEthernet 0/1Routerconfig-ifip nat insideRouterconfig-ifinterface Serial 0/0/0Routerconfig-ifip nat outside We used the same interface configuration as from our static NAT example. This configuration allows addresses in the to be translated to a public IP address in the – range. When an inside host makes a request to an outside host, the router dynamically assigns an available IP address from the pool for the translation of the private IP address. If there’s no public IP address available, the router rejects new connections until you clear the NAT mappings. However, you have as many public IP addresses as hosts in your network, you won’t encounter this problem. NAT Overload, sometimes also called PAT, is probably the most used type of NAT. You can configure NAT overload in two ways, depending on how many public IP address you have available. The first case, and one of the most often seen cases, is that you have only one public IP address allocated by your ISP. In this case, you map all your inside hosts to the available IP address. The configuration is almost the same as for dynamic NAT, but this time you specify the outside interface instead of a NAT pool. Routerconfigaccess list 1 permit nat inside source list 1 interface serial 0/0/0 overloadRouterconfiginterface FastEthernet 0/1Routerconfig-ifip nat insideRouterconfig-ifinterface Serial 0/0/0Routerconfig-ifip nat outside In this case, the router automatically determines what public IP address to use for the mappings by checking what IP is assigned to the Serial 0/0/0 interface. All the inside addresses are translated to the only public IP address available on your router. Routers are able to recognize the traffic flows by using port numbers, specified by the overload keyword. The second case is that your ISP gave you more than one public IP addresses, but not enough for a dynamic or static mapping. The configuration is the same as for dynamic NAT, but this time we will add overload for the router to know to use traffic flow identification using port numbers, instead of mapping a private to a public IP address dynamically. Routerconfigip nat pool NAT-POOL netmask 1 permit nat inside source list 1 pool NAT-POOL overloadRouterconfiginterface FastEthernet 0/1Routerconfig-ifip nat insideRouterconfig-ifinterface Serial 0/0/0Routerconfig-ifip nat outside If you feel sometimes works wrong in your configuration, you can always check the NAT translations and statistics with help of the show ip nat statistics Total translations 2 0 static, 2 dynamic; 0 extendedOutside interfaces Serial0Inside interfaces Ethernet1Hits 135 Misses 5Expired translations 2Dynamic mappings— Inside Sourceaccess-list 1 pool net-208 refcount 2pool net-208 netmask end generic, total addresses 14, allocated 2 14%, misses 0 Routershow ip nat translations Pro Inside global Inside local Outside local Outside global udp tcp tcp If you have to clear the NAT translation table, you can do it with clear ip nat ip nat translation *Routershow ip nat translations RouterWhen you begin to troubleshoot, first use the available show commands. If the show commands are not enough, you still have the debug. Careful when you use debug, because debug commands are using a lot of resource and you may end up disconnected from the router and being unable to reconnect. Router debug ip nat NAT s= d= NAT s= d= [21852] NAT s= d= [6826] NAT* s= d= [23311] NAT* s= d= [6827] NAT* s= d= [6828] NAT* s= d= [23313] NAT* s= d= [23325] An asterisk * next to NAT indicates that the translations occurs in the fast-switched path. The first packet of a connection is always process-switched, which is slower. The next packets go through the fast-switched path. s= indicates that the source s= IP address is translated to refers to the destination address. [6825] is the IP identification number, which is useful for debugging and it enables correlation with other protocol analyzers. This concludes our lesson. The information found here and in the other two articles is everything you need to know for passing the Cisco CCNA exam. You can also use this information for implementing NAT in real-life, in your home network, or at your job.
CiscoASA Series Firewall ASDM Configuration Guide 6 Network Object NAT (ASA 8.3 and Later) All NAT rules that are configured as a paramete r of a network object are considered to be network object NAT rules. Network object NAT is a quick and easy way to configure NAT for a single IP address, a range of addresses, or a subnet. After you
Configuring dynamic NAT in Cisco devices This article will help you through the steps to configure dynamic NAT on Cisco devices. You will be able to create the corresponding Configlet commands using Network Configuration Manager application. This will help you perform the same operation on multiple devices simultaneously. With dynamic NAT, you specify two sets of addresses on your Cisco router Inside addresses that will be translated. A pool of global addresses. Unlike with static NAT, where you had to manually define a static mapping between a private and a public address, with dynamic NAT the mapping of a local address to a global address happens dynamically. This means that the router dynamically picks an address from the global address pool that is not currently assigned. It can be any address from the pool of global addresses. The dynamic entry stays in the NAT translations table as long as the traffic is exchanged. The entry times out after a period of inactivity and the global IP address can be used for new translations. If you don't have NCM installed, please click here to download and install the application. To configure dynamic NAT, the following steps are required Configure the router’s inside interface using the ip nat inside command Configure the router’s outside interface using the ip nat outside command Configure an ACL that has a list of the inside source addresses that will be translated Configure the pool of global IP addresses using the ip nat pool NAME FIRST_IP_ADDRESS LAST_IP_ADDRESS netmask SUBNET_MASK command Enable dynamic NAT with the ip nat inside source list ACL_NUMBER pool NAME global configuration command Steps to configure dynamic NAT using CLI. Login to the device using SSH / TELNET and go to enable mode. Go into the config mode. Routerconfigure terminal Enter configuration commands, one per line. End with CNTL/Z. Routerconfig Configure the router's inside interface Routerconfiginterface fa0/0 Routerconfig-ifip nat inside Routerconfig-ifexit Configure the router's outside interface Routerconfiginterface eth0/0/0 Routerconfig-ifip nat outside Routerconfig-ifexit Configure an ACL that has a list of the inside source addresses that will be translated. Routerconfigaccess-list 1 permit NOTEThe access list configured above matches all hosts from the subnet. Configure the pool of global IP addresses Routerconfigip nat pool MY_POOL netmask NOTE The pool configured above consists of 5 addresses and Enable dynamic NAT Routerconfigip nat inside source list 1 pool MY_POOL NOTE The command above instructs the router to translate all addresses specified in the access list 1 to the pool of global addresses called MY_POOL. Exit config mode Routerconfigexit Router Execute show ip nat translations command to view the NAT configuration. Copy the running configuration into startup configuration using below command Routerwrite memory Building configuration... [OK] Router The corresponding configlet can be created in NCM application as shown in below screenshot. Also you can click the below button to download the Configlet as XML and import it into NCM application using file import option. Configlet Name Configure Dynamic NAT - Cisco Description This configlet is used to configure dynamic NAT on cisco devices Execution Mode Script Execution Mode Configlet Content configure terminal interface $INSIDE_INTF ip nat inside exit interface $OUTSIDE_INTF ip nat outside exit access-list $ACL_ID permit $SOURCE_ADDRESS $SUBNET_MASK ip nat pool $POOL_NAME $POOL_START_ADDRESS $POOL_END_ADDRESS netmask $NETMASK ip nat inside source list $ACL_ID pool $POOL_NAME exit show ip nat translations write memory Configurationrouteur cisco packet tracer pdf - Conseils pratiques - Routeurs; Configuration routeur cisco Problème configuration routeur cisco 887 VA, VDSL, NAT, DSLAM - Forum - CISCO; Problème de configuration routeur CISCO 3500 - Forum - CISCO; 11 réponses. Réponse 1 / 11. Meilleure réponse. rcd 9 mars 2012 à 18:17. bon ton problème c'est que le
M0w a écrit Mon but est de sécuriser, en empêchant l'accès à toutes les autres adresses depuis redirige le port vers un équipement basique par ex. un arduino, il n'a donc pas de parfeu règle NAT suffit amplementToutes les connexions sur le port en question aboutiront à ton ne connaissais pas, mais c'est du styke raspberry et donc là tu peux être certain que même si explicitement il n'a pas de pare feu, c'est exactement comme s'il en avait devrais n'accepter que les connexions firmware que tu installes dedans est nécessairement très compact, il n'a pas besoin de pare-feu, car il n'est pas une machine universelle et il n'accepte que les connexions dont il a besoin, si une connexion entrante ne contient pas les bonnes données elles est tout simplement les réglage du pare-feu de la boxTu peux le faire toi-même voilà les données à remplir Ne compte pas sur moi pour t'en expliquer le remplissage, je ne prendrai pas le risque de te faire planter ton réseau dans le terreau de mon as de quoi décrire adresse et port source - adresse et port destination et l' à l'adresse destination, si tu la spécifie, c'est l'adresse Wan de ta box ; tu commences à le voir le problème ? Que se passe t-il quand ta box change d'adresse IP. Tes règles deviendront l'asress dets en blanc ets probablement le plutôt du côté des experts arduino ils ont un forum du support et de la Faites confiance aux produits libres Firefox, Thunderbird, LibreOffice, Irfanview, VLC, 7-zip, FileZillaVotre machine vous en remerciera
Décrireles concepts du routage et les éléments à prendre en Décrire quand utiliser NAT et PAT et comment les configurer sur les compte lors de la mise en œuvre du routage sur le r éseau
Le Port Address Translation, ou surcharge de NAT, ou NAT Overload, permet de traduire beaucoup d’IP du réseau local en une IP publique ou plusieurs. Au contraire des NAT statiques et dynamiques dont le nombre de sessions simultanées se limitent au nombre d’IP publiques disponibles. Avec le PAT, toutes les IP qui sortent du réseau le feront avec la même IP. Par contre, chaque session se verra attribuer un numero de port TCP ou UDP, couche 4, de transport. Si vous envoyez une requête vers un serveur Internet, votre IP privée sera donc flanquée d’un numero désignant que cette session vous appartient et le routeur vous la retournera correctement. Le numero de port agit comme un identifiant qui indique que cette session a été initiée par telle ou telle ip du réseau local. Je rappelle que dans cet exemple, on va NATER » nos IP privées en IP publiques, mais que le NAT/PAT peut très bien impliquer seulement des IP privées à l’intérieur d’un réseau local. Nous allons voir ici comment mettre en place la surcharge de NAT à l’aide d’un routeur Cisco, et avec à notre disposition un pool d’adresses IP Publiques. Dans une configuration où nous n’aurions qu’une seule IP Publique à NATER, ce n’est pas bien différent, nous le verrons ici aussi. ————————————- -Un petit schéma de topologie pour aider à la reflexion -Dans cette histoire, le but est d’activer le PAT au niveau de R2, afin que tous les PC du réseau local de PC1 à PC9, sortent sur Internet en utilisant un pool d’IP Publiques associées à des ports TCP et UDP. -On considère que le serveur est sur Internet, car même si dans ce schéma tout est routé et tout se pingue, ça revient au même. -Nous n’avons donc rien à faire sur R1 puisqu’il ne sert qu’à router les trois réseaux locaux. Tout se passera donc au niveau de R2. -Notre pool d’IP Publiques contient deux IP de à -Vous pouvez télécharger le fichier Packet Tracer histoire de faire vos propres simulations de requêtes et ainsi vous assurer que les IP sont bien traduites Télécharger le fichier Packet Tracer ————————————- -On prend donc la main sur R2 –>On défini le pool d’adresses publiques qui sera utilisé. Ne tapez cette commande que si vous avez un pool d’IP publiques. Si vous n’avez qu’une IP publique ce n’est pas nécessaire. R2configip nat pool PAT-POOL netmask le nom PAT-POOL est choisi par moi-même, notez bien le nom que vous choisissez car il servira pour lier une ACL. ————————————- –>On créer une liste ACL qui autorisera seulement nos trois réseaux à passer par le NAT. R2configaccess-list 1 permit La donnée représente le masque de sous réseau Pour les ACL on donne en fait les bits d’hôtes, c’est comme ça. Un masque en 24 bits ne laisse que 8 bits d’hôtes, soit Le masque semble donc inversé. R2configaccess-list 1 permit on fait donc la même chose pour chaque réseau local. R2configaccess-list 1 permit *ATTENTION Même dans le cas où vous n’avez qu’une seul IP publique à NATER, vous devez entrer ces commandes puisque vous aurez besoin de cette liste ACL.————————————- –>Puis on paufine la règle NAT en y associant l’ACL et en activant la surcharge NAT. R2configip nat inside source list 1 pool PAT-POOL overload on indique donc que l’on souhaite utiliser la liste ACL numero 1, sur le pool PAT-POOL, et que le NAT doit être en mode overload, autrement dit surcharge, ou PAT. *ATTENTION Si vous n’avez qu’une seule IP Publique à NATER, la manipulation est un peu différente. Dans le cas d’une IP publique unique, on s’y prend un peu différemment -Avec une seule IP Publique, je dois configurer l’interface externe du routeur et lui donner cette IP publique. -Par exemple, je possède l’IP publique -Je vais configurer l’interface G0/0 de R2 pour qu’elle possède cette IP. R2configinterface g0/0 je sélectionne l’interface. R2config-ifip addr je lui assigne mon unique IP publique avec son masque. -Puis j’entre la règle de NAT R2configip nat inside source list 1 interface g0/0 overload On crée la règle NAT en mode overload et qui est basée sur l’IP unique de l’interface G0/0. ————————————- –>Puis on spécifie quelles interfaces du routeur sont à l’intérieur et à l’extérieur R2configinterface s0/0/0 on sélectionne l’interface. R2config-ifip nat inside on spécifie qu’elle est interne à notre réseau privé. R2configinterface g0/0 on sélectionne l’interface. R2config-ifip nat outside on spécifie qu’elle est externe à notre réseau privé. *Pour info, dans le cadre de sous-interfaces, il faut définir ce paramètre sur chaque sous-interface et non sur l’interface réelle. ————————————- –>La surcharge NAT est configurée ! ————————————- -Pour en avoir le cœur net, voyons le résultat d’une simulation -L’enveloppe bleue est un PING envoyé à partir de PC1 qui possède l’adresse source -L’IP de destination du paquet est celle du serveur Internet -Le paquet a traversé le réseau local, toujours en possédant comme IP source. -Comme on peut le voir dans le cadre rouge, en arrivant dans R2 In Layers, le paquet avait l’IP source -Comme on peut le voir dans le cadre rouge, en sortant de R2 Out Layers, le paquet aura l’IP Source *Vous constatez probablement qu’aucun port n’est attribué à notre paquet, la couche de transport n’entre pas en jeu Layer 4. C’est parce qu’il s’agit ici d’un PING, le PING fait partie du protocole ICMP qui n’utilise pas la couche transport, donc pas de port attribué. Il faut savoir que cela est une situation bien spécifique à ICMP et probablement d’autres protocoles. Avec une requête HTTP, le paquet aurait un numero de port source et de destination. A la place, le Ping possède un numéro de séquence dans sa la simulation dans Packet Tracer, en utilisant une requête HTTP au lieu d’une ICMP. Envoyez une requête HTTP simultanément depuis PC1 et PC2 vers le Serveur, vous constaterez que leurs ports seront différent. ————————————- Je vous invite à utiliser le simulateur dans Packet Tracer si vous voulez vous familiarisez avec le processus.
Toconfigure Port Address Translation, you must specify the inside and outside NAT interfaces as with any NAT configuration. Afterward you’ll need to create an access control list to will be referenced by the NAT translation statement to match inside networks and/or host machines to be translated. If you have multiple public IP addresses and you wish to port address translate to
Configuring NAT for multiple Vlans on a Cisco router is a challenge that many inexperienced Cisco network engineers have had to contend with at one stage of their careers or the other. While NAT implementation is really not a big deal, its successful implementation on a Cisco router configured for multiple vlans can give you a grief, if you do not know what you are doing. In my previous post, I shared with us on how to configure dhcp on a Cisco router with multiple vlans. You can find it here. In this post, using a slightly modified version of the previous network topology, I will share with us on how to configure NAT for multiple vlans on a Cisco router. Network topology Objective Our objective in this lab is to configure NAT for the three vlans represented in the network topology. We can NAT all three vlans to one public IP or to separate public IPs. For this demonstration, each vlan will be NATed to the public IP on the WAN interface of the router. Public IPs to be used in the NAT for multiple vlans Vlan 10 private subnet= Public IP= Vlan 20 private subnet= Public IP= Vlan 30 private subnet= Public IP= You may also like How to redistribute static routes into eigrp using Cisco Packet Tracer Configuring NAT for multiple vlans First, we create three access-lists to match the private subnets. Routerconfigaccess-list 10 permit Routerconfigaccess-list 20 permit Routerconfigaccess-list 30 permit Next, we create pools for the vlans. Routerconfigip nat pool timigate netmask Configure the NAT statement. Each statement will reference corresponding access-list and NAT pool for that vlan. See below. Routerconfigip nat inside source list 10 pool timigate overload Routerconfigip nat inside source list 20 pool timigate overload Routerconfigip nat inside source list 30 pool timigate overload The final step is to define the inside and outside interfaces. This is where most people run into trouble. They use the physical interface instead of the sub-interfaces. Where sub-interfaces are used for vlans, these sub-interfaces must be defined and used as the NAT inside interfaces. See below. Routerconfigint f0/1 Routerconfig-ifip nat outside Routerconfigint f0/ Routerconfig-subifip nat inside Routerconfig-subifint f0/ Routerconfig-subifip nat inside Routerconfig-subifint f0/ Routerconfig-subifip nat inside Routerconfig-subif Verification To verify that NAT is working as it should, we turn on debug on the router, using the debug ip nat command. After that, we run a ping from the computers on the LAN to the ISP router. The output below will be displayed on the core router. From the output above, we can see the source address being translated to as it heads out to destination and on the second link we see the reverse process of going to destination before it gets directed to
0akJ.