SlideShare a Scribd company logo
1 of 4
Download to read offline
How to Configure Static NAT on Cisco Routers?
Network Address Translation (NAT) is an operation by which source and/or
destination IP addresses within a packet are replaced with different IP addresses.
NAT conserves available IP address space by allowing many private IP addresses to be
represented by some smaller number of public IP addresses. Private IP addresses are
defined in RFC 1918 and are addresses that cannot be used on the Internet. NAT is
most commonly performed by routers or firewalls; however this tutorial focuses on
NAT within Cisco routers. NAT can be performed both statically and dynamically.
Static NAT simply maps one private IP address to a single public IP address, and this is
the flavor of NAT we are discussing in this tutorial.
A Cisco router performing NAT divides its universe into the inside and the outside.
Typically the inside is a private enterprise, and the outside is the public Internet. In
addition to the notion of inside and outside, a Cisco NAT router classifies addresses
as either local or global. A local address is an address that is seen by devices on the
inside, and a global address is an address that is seen by devices on the outside.
Given these four terms, an address may be one of four types:
1. Inside local addresses are assigned to inside devices. These addresses are not
advertised to the outside.
2. Inside global are addresses by which inside devices are known to the outside.
3. Outside local are addresses by which outside devices are known to the inside.
4. Outside global addresses are assigned to outside devices. These addresses
are not advertised to the inside.
Let’s jump right into NAT configuration on a Cisco router as shown in the Figure
below:
R1 is the router performing Network Address Translation (NAT) and has two
interfaces: Fa0/0 on the inside and Fa0/1 on the outside. The specific IP addresses
involved are:
Table 1 NAT Addresses for Figure Above
NAT Address Type IP Address
Inside local 192.168.1.2
Inside global 89.203.12.47
Outside local 202.14.35.28
Outside global 202.14.35.28
You probably know very well how to configure IP addresses on router interfaces, so
we skip those configuration steps and move straight to the interesting stuff. First, we
have to assign Fa0/0 as NAT inside interface and Fa0/1 as NAT outside interface on R1.
This would tell the router that interesting traffic entering or exiting these two
interfaces will be subject to address translation.
R1#conf term
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#interface Fa0/0
R1(config-if)#ip nat inside
R1(config-if)#interface Fa0/1
R1(config-if)#ip nat outside
R1(config-if)#end
Now we would tell the router how to perform address translation and mention which
IP addresses (source or destination) to re-write in packets moving between the inside
and outside interfaces. Here we go:
R1(config)#ip nat inside source static 192.168.1.2 89.203.12.47
Here, we are telling the router to perform NAT on packets coming into the router on
the inside interface Fa0/0. More specifically the router would identify which of these
packets have a source IP address of 192.168.1.2 and would change it to 89.203.12.47
before forwarding the packet out the outside interface Fa0/1. Similarly, return
packets coming in at outside interface Fa0/1 would undergo translation of
destination IP address.
Let’s now verify if NAT is actually working as it is supposed to work. There are a
couple of very useful Cisco IOS commands that can be used to do just that.
Command show ip nat statisticsdisplays the number of static and dynamic NAT
translations, inside and outside interfaces, and the number of hits and misses.
R1#show ip nat statistics
Total active translations: 1 (1 static, 0 dynamic; 0 extended)
Outside interfaces:
FastEthernet0/1
Inside interfaces:
FastEthernet0/0
Hits: 0 Misses: 0
CEF Translated packets: 0, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
Appl doors: 0
Normal doors: 0
Queued Packets: 0
Command show ip nat translations displays the IP addresses for NAT translations.
R1#show ip nat translations
Pro Inside global Inside local Outside local Outside global
— 89.203.12.47 192.168.1.2 — —
As you see in the above output, we have one NAT entry configured with Inside
global address 89.203.12.47 and Inside local address 192.168.1.2 specified. Outside
local and Outside globaladdresses are blank because our NAT configuration does not
change those addresses.
Let’s now go to the PC and ping the Server before running the command show ip nat
translations again to see if it makes any difference.
R1#show ip nat statistics
Total active translations: 2 (1 static, 1 dynamic; 1 extended)
Outside interfaces:
FastEthernet0/1
Inside interfaces:
FastEthernet0/0
Hits: 10 Misses: 0
CEF Translated packets: 10, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
Appl doors: 0
Normal doors: 0
Queued Packets: 0
R1#show ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp 89.203.12.47:1 192.168.1.2:1 202.14.35.28:1 202.14.35.28:1
— 89.203.12.47 192.168.1.2 — —
As you can see in the above output, NAT is active as manifested by the appearance of
an additional dynamic entry for ICMP protocol and some additional hits,
corresponding to our ping attempt from PC to Server.
We just configured and verified a simple NAT scenario translating only the source or
destination (not both at the same time) IP addresses of packets moving between
inside and outside interfaces. This sort of NAT configuration is called static NAT as a
single inside local IP address is statically mapped to a single outside local IP address.
Another important feature of NAT is static Port Address Translation (PAT). Static PAT is
designed to allow one-to-one mapping between local and global addresses. A
common use of static PAT is to allow Internet users from the public network to access
a Web server located in the private network.
Let’s assume we intend to host a Web server on the inside on the same PC, that has
an IP address 192.168.1.2. The following configuration line would allow us to do just
that:
R1(config)#ip nat inside source static tcp 192.168.1.2 80 89.203.12.47 80
This configuration line performs the static address translation for the Web server.
With this configuration line, users that try to reach 89.203.12.47 port 80 (www) are
automatically redirected to 192.168.1.2 port 80 (www). In our case, 192.168.1.2 is
the IP address of the PC which is also the Web server. This configuration can be
verified using the same two NAT verification commands: show ip nat
translations and show ip nat statistics.
Notice that the address 89.203.12.47 with port number 80 (HTTP) translates to
192.168.1.2 port 80, and vice versa. Therefore, Internet users can browse the Web
server even though the Web server is on a private network with a private IP address.
More Related NAT Tips:
How to Configure Basic NAT with Overloading?
How to Configure Static NAT for Inbound Connections?
How to Configure NAT in Cisco IOS?
How to Set up NAT Using the Cisco IOS?

More Related Content

What's hot

Informe sobre Teamviewer
Informe sobre TeamviewerInforme sobre Teamviewer
Informe sobre TeamviewerMarcelo Herrera
 
CCNAv5 - S3: Chapter 7 EIGRP
CCNAv5 - S3: Chapter 7 EIGRPCCNAv5 - S3: Chapter 7 EIGRP
CCNAv5 - S3: Chapter 7 EIGRPVuz Dở Hơi
 
Instrumenting the real-time web: Node.js in production
Instrumenting the real-time web: Node.js in productionInstrumenting the real-time web: Node.js in production
Instrumenting the real-time web: Node.js in productionbcantrill
 
Ccna cheat sheet
Ccna cheat sheetCcna cheat sheet
Ccna cheat sheetaromal4frnz
 
1000 Ccna Questions And Answers
1000 Ccna Questions And Answers1000 Ccna Questions And Answers
1000 Ccna Questions And AnswersCCNAResources
 
11 Unit1 Chapter 1 Getting Started With Python
11   Unit1 Chapter 1 Getting Started With Python11   Unit1 Chapter 1 Getting Started With Python
11 Unit1 Chapter 1 Getting Started With PythonPraveen M Jigajinni
 
from Binary to Binary: How Qemu Works
from Binary to Binary: How Qemu Worksfrom Binary to Binary: How Qemu Works
from Binary to Binary: How Qemu WorksZhen Wei
 
IPv6 - Neighbour Discovery
IPv6 - Neighbour DiscoveryIPv6 - Neighbour Discovery
IPv6 - Neighbour DiscoveryHeba_a
 
Project ACRN Device Passthrough Introduction
Project ACRN Device Passthrough IntroductionProject ACRN Device Passthrough Introduction
Project ACRN Device Passthrough IntroductionProject ACRN
 
4章 Linuxカーネル - 割り込み・例外 5
4章 Linuxカーネル - 割り込み・例外 54章 Linuxカーネル - 割り込み・例外 5
4章 Linuxカーネル - 割り込み・例外 5mao999
 
Softwareentwickler - (Beruf / Berufsbild)
Softwareentwickler - (Beruf / Berufsbild)Softwareentwickler - (Beruf / Berufsbild)
Softwareentwickler - (Beruf / Berufsbild)ALPHAJUMP
 

What's hot (20)

Ipv4 & ipv6
Ipv4 & ipv6Ipv4 & ipv6
Ipv4 & ipv6
 
Informe sobre Teamviewer
Informe sobre TeamviewerInforme sobre Teamviewer
Informe sobre Teamviewer
 
CCNAv5 - S3: Chapter 7 EIGRP
CCNAv5 - S3: Chapter 7 EIGRPCCNAv5 - S3: Chapter 7 EIGRP
CCNAv5 - S3: Chapter 7 EIGRP
 
ccna cheat_sheet
ccna cheat_sheetccna cheat_sheet
ccna cheat_sheet
 
CCNP ROUTE V7 CH1
CCNP ROUTE V7 CH1CCNP ROUTE V7 CH1
CCNP ROUTE V7 CH1
 
Breaking DES
Breaking DESBreaking DES
Breaking DES
 
Instrumenting the real-time web: Node.js in production
Instrumenting the real-time web: Node.js in productionInstrumenting the real-time web: Node.js in production
Instrumenting the real-time web: Node.js in production
 
Ccna cheat sheet
Ccna cheat sheetCcna cheat sheet
Ccna cheat sheet
 
CCNA Lab Guide
CCNA Lab GuideCCNA Lab Guide
CCNA Lab Guide
 
1000 Ccna Questions And Answers
1000 Ccna Questions And Answers1000 Ccna Questions And Answers
1000 Ccna Questions And Answers
 
Router commands
Router commandsRouter commands
Router commands
 
IPv6
IPv6IPv6
IPv6
 
Ipv6
Ipv6Ipv6
Ipv6
 
11 Unit1 Chapter 1 Getting Started With Python
11   Unit1 Chapter 1 Getting Started With Python11   Unit1 Chapter 1 Getting Started With Python
11 Unit1 Chapter 1 Getting Started With Python
 
from Binary to Binary: How Qemu Works
from Binary to Binary: How Qemu Worksfrom Binary to Binary: How Qemu Works
from Binary to Binary: How Qemu Works
 
IPv6 - Neighbour Discovery
IPv6 - Neighbour DiscoveryIPv6 - Neighbour Discovery
IPv6 - Neighbour Discovery
 
Project ACRN Device Passthrough Introduction
Project ACRN Device Passthrough IntroductionProject ACRN Device Passthrough Introduction
Project ACRN Device Passthrough Introduction
 
4章 Linuxカーネル - 割り込み・例外 5
4章 Linuxカーネル - 割り込み・例外 54章 Linuxカーネル - 割り込み・例外 5
4章 Linuxカーネル - 割り込み・例外 5
 
Softwareentwickler - (Beruf / Berufsbild)
Softwareentwickler - (Beruf / Berufsbild)Softwareentwickler - (Beruf / Berufsbild)
Softwareentwickler - (Beruf / Berufsbild)
 
IS-IS vs OSPF
IS-IS vs OSPFIS-IS vs OSPF
IS-IS vs OSPF
 

Viewers also liked

2017 Volvo S60 Brochure | Orange County Volvo
2017 Volvo S60 Brochure | Orange County Volvo2017 Volvo S60 Brochure | Orange County Volvo
2017 Volvo S60 Brochure | Orange County VolvoVolvo Cars Mission Viejo
 
Assessment for learning meeting april 29th 2014
Assessment for learning meeting april 29th 2014Assessment for learning meeting april 29th 2014
Assessment for learning meeting april 29th 2014Mr Bounab Samir
 
Global IT Consulting Market
Global IT Consulting MarketGlobal IT Consulting Market
Global IT Consulting MarketJoyjeet Dan
 
Best practices multichannel-integration
Best practices multichannel-integrationBest practices multichannel-integration
Best practices multichannel-integrationGiuseppe Monserrato
 
Dantes Inferno Study Guide
Dantes Inferno Study GuideDantes Inferno Study Guide
Dantes Inferno Study Guidefollowthelamb
 
Finding the best Radio Network Planning and Radio Network Optimization software
Finding the best Radio Network Planning and Radio Network Optimization softwareFinding the best Radio Network Planning and Radio Network Optimization software
Finding the best Radio Network Planning and Radio Network Optimization softwareMuhammad Waqas Akram
 
Scaling with MongoDB
Scaling with MongoDBScaling with MongoDB
Scaling with MongoDBRick Copeland
 
Temperature Transducer
Temperature TransducerTemperature Transducer
Temperature TransducerAIT
 
Summary -First Break All The Rules
Summary -First Break All The RulesSummary -First Break All The Rules
Summary -First Break All The RulesGMR Group
 
Neonatal Emergencies
Neonatal EmergenciesNeonatal Emergencies
Neonatal EmergenciesLeeann Sills
 

Viewers also liked (13)

2017 Volvo S60 Brochure | Orange County Volvo
2017 Volvo S60 Brochure | Orange County Volvo2017 Volvo S60 Brochure | Orange County Volvo
2017 Volvo S60 Brochure | Orange County Volvo
 
Custom Courseware Development
Custom Courseware DevelopmentCustom Courseware Development
Custom Courseware Development
 
Assessment for learning meeting april 29th 2014
Assessment for learning meeting april 29th 2014Assessment for learning meeting april 29th 2014
Assessment for learning meeting april 29th 2014
 
Containerization and palletization
Containerization and palletizationContainerization and palletization
Containerization and palletization
 
Global IT Consulting Market
Global IT Consulting MarketGlobal IT Consulting Market
Global IT Consulting Market
 
Best practices multichannel-integration
Best practices multichannel-integrationBest practices multichannel-integration
Best practices multichannel-integration
 
Dantes Inferno Study Guide
Dantes Inferno Study GuideDantes Inferno Study Guide
Dantes Inferno Study Guide
 
Finding the best Radio Network Planning and Radio Network Optimization software
Finding the best Radio Network Planning and Radio Network Optimization softwareFinding the best Radio Network Planning and Radio Network Optimization software
Finding the best Radio Network Planning and Radio Network Optimization software
 
Scaling with MongoDB
Scaling with MongoDBScaling with MongoDB
Scaling with MongoDB
 
Temperature Transducer
Temperature TransducerTemperature Transducer
Temperature Transducer
 
Camels approach
Camels approachCamels approach
Camels approach
 
Summary -First Break All The Rules
Summary -First Break All The RulesSummary -First Break All The Rules
Summary -First Break All The Rules
 
Neonatal Emergencies
Neonatal EmergenciesNeonatal Emergencies
Neonatal Emergencies
 

Similar to How to configure static nat on cisco routers

Similar to How to configure static nat on cisco routers (20)

NAT- Network Address Translation
NAT- Network Address TranslationNAT- Network Address Translation
NAT- Network Address Translation
 
Nat 07
Nat 07Nat 07
Nat 07
 
Network address translations
Network address translations Network address translations
Network address translations
 
Nat 03
Nat 03Nat 03
Nat 03
 
Day 17.1 nat pat (2)
Day 17.1 nat pat  (2)Day 17.1 nat pat  (2)
Day 17.1 nat pat (2)
 
Chapter11ccna
Chapter11ccnaChapter11ccna
Chapter11ccna
 
Chapter11ccna
Chapter11ccnaChapter11ccna
Chapter11ccna
 
Nat cisco
Nat ciscoNat cisco
Nat cisco
 
NAT and PAT
NAT and PATNAT and PAT
NAT and PAT
 
Icnd210 s07l01
Icnd210 s07l01Icnd210 s07l01
Icnd210 s07l01
 
Configuring a Cisco Router as a PPPoE Client for DSL Connectivity
 Configuring a Cisco Router as a PPPoE Client for DSL Connectivity Configuring a Cisco Router as a PPPoE Client for DSL Connectivity
Configuring a Cisco Router as a PPPoE Client for DSL Connectivity
 
Day 17 nat and pat
Day 17 nat and patDay 17 nat and pat
Day 17 nat and pat
 
Ccna 2 chapter 11 2014 v5
Ccna 2 chapter 11 2014 v5Ccna 2 chapter 11 2014 v5
Ccna 2 chapter 11 2014 v5
 
NAT_Final
NAT_FinalNAT_Final
NAT_Final
 
Module (10) NAT for IPV4.pptx
Module (10) NAT for IPV4.pptxModule (10) NAT for IPV4.pptx
Module (10) NAT for IPV4.pptx
 
Day 17.1 nat pat
Day 17.1 nat pat Day 17.1 nat pat
Day 17.1 nat pat
 
Packet Tracer: Nat protocol
Packet Tracer: Nat protocolPacket Tracer: Nat protocol
Packet Tracer: Nat protocol
 
Nat
NatNat
Nat
 
How to configure a router
How to configure a router How to configure a router
How to configure a router
 
CCNA CHAPTER 12 BY jetarvind kumar madhukar
CCNA CHAPTER 12 BY jetarvind kumar madhukarCCNA CHAPTER 12 BY jetarvind kumar madhukar
CCNA CHAPTER 12 BY jetarvind kumar madhukar
 

More from IT Tech

Cisco ip phone key expansion module setup
Cisco ip phone key expansion module setupCisco ip phone key expansion module setup
Cisco ip phone key expansion module setupIT Tech
 
Cisco catalyst 9200 series platform spec, licenses, transition guide
Cisco catalyst 9200 series platform spec, licenses, transition guideCisco catalyst 9200 series platform spec, licenses, transition guide
Cisco catalyst 9200 series platform spec, licenses, transition guideIT Tech
 
Cisco isr 900 series highlights, platform specs, licenses, transition guide
Cisco isr 900 series highlights, platform specs, licenses, transition guideCisco isr 900 series highlights, platform specs, licenses, transition guide
Cisco isr 900 series highlights, platform specs, licenses, transition guideIT Tech
 
Hpe pro liant gen9 to gen10 server transition guide
Hpe pro liant gen9 to gen10 server transition guideHpe pro liant gen9 to gen10 server transition guide
Hpe pro liant gen9 to gen10 server transition guideIT Tech
 
The new cisco isr 4461 faq
The new cisco isr 4461 faqThe new cisco isr 4461 faq
The new cisco isr 4461 faqIT Tech
 
New nexus 400 gigabit ethernet (400 g) switches
New nexus 400 gigabit ethernet (400 g) switchesNew nexus 400 gigabit ethernet (400 g) switches
New nexus 400 gigabit ethernet (400 g) switchesIT Tech
 
Tested cisco isr 1100 delivers the richest set of wi-fi features
Tested cisco isr 1100 delivers the richest set of wi-fi featuresTested cisco isr 1100 delivers the richest set of wi-fi features
Tested cisco isr 1100 delivers the richest set of wi-fi featuresIT Tech
 
Aruba campus and branch switching solution
Aruba campus and branch switching solutionAruba campus and branch switching solution
Aruba campus and branch switching solutionIT Tech
 
Cisco transceiver module for compatible catalyst switches
Cisco transceiver module for compatible catalyst switchesCisco transceiver module for compatible catalyst switches
Cisco transceiver module for compatible catalyst switchesIT Tech
 
Cisco ios on cisco catalyst switches
Cisco ios on cisco catalyst switchesCisco ios on cisco catalyst switches
Cisco ios on cisco catalyst switchesIT Tech
 
Cisco's wireless solutions deployment modes
Cisco's wireless solutions deployment modesCisco's wireless solutions deployment modes
Cisco's wireless solutions deployment modesIT Tech
 
Competitive switching comparison cisco vs. hpe aruba vs. huawei vs. dell
Competitive switching comparison cisco vs. hpe aruba vs. huawei vs. dellCompetitive switching comparison cisco vs. hpe aruba vs. huawei vs. dell
Competitive switching comparison cisco vs. hpe aruba vs. huawei vs. dellIT Tech
 
Four reasons to consider the all in-one isr 1000
Four reasons to consider the all in-one isr 1000Four reasons to consider the all in-one isr 1000
Four reasons to consider the all in-one isr 1000IT Tech
 
The difference between yellow and white labeled ports on a nexus 2300 series fex
The difference between yellow and white labeled ports on a nexus 2300 series fexThe difference between yellow and white labeled ports on a nexus 2300 series fex
The difference between yellow and white labeled ports on a nexus 2300 series fexIT Tech
 
Cisco transceiver modules for compatible cisco switches series
Cisco transceiver modules for compatible cisco switches seriesCisco transceiver modules for compatible cisco switches series
Cisco transceiver modules for compatible cisco switches seriesIT Tech
 
Guide to the new cisco firepower 2100 series
Guide to the new cisco firepower 2100 seriesGuide to the new cisco firepower 2100 series
Guide to the new cisco firepower 2100 seriesIT Tech
 
892 f sfp configuration example
892 f sfp configuration example892 f sfp configuration example
892 f sfp configuration exampleIT Tech
 
Cisco nexus 7000 and nexus 7700
Cisco nexus 7000 and nexus 7700Cisco nexus 7000 and nexus 7700
Cisco nexus 7000 and nexus 7700IT Tech
 
Cisco firepower ngips series migration options
Cisco firepower ngips series migration optionsCisco firepower ngips series migration options
Cisco firepower ngips series migration optionsIT Tech
 
Eol transceiver to replacement model
Eol transceiver to replacement modelEol transceiver to replacement model
Eol transceiver to replacement modelIT Tech
 

More from IT Tech (20)

Cisco ip phone key expansion module setup
Cisco ip phone key expansion module setupCisco ip phone key expansion module setup
Cisco ip phone key expansion module setup
 
Cisco catalyst 9200 series platform spec, licenses, transition guide
Cisco catalyst 9200 series platform spec, licenses, transition guideCisco catalyst 9200 series platform spec, licenses, transition guide
Cisco catalyst 9200 series platform spec, licenses, transition guide
 
Cisco isr 900 series highlights, platform specs, licenses, transition guide
Cisco isr 900 series highlights, platform specs, licenses, transition guideCisco isr 900 series highlights, platform specs, licenses, transition guide
Cisco isr 900 series highlights, platform specs, licenses, transition guide
 
Hpe pro liant gen9 to gen10 server transition guide
Hpe pro liant gen9 to gen10 server transition guideHpe pro liant gen9 to gen10 server transition guide
Hpe pro liant gen9 to gen10 server transition guide
 
The new cisco isr 4461 faq
The new cisco isr 4461 faqThe new cisco isr 4461 faq
The new cisco isr 4461 faq
 
New nexus 400 gigabit ethernet (400 g) switches
New nexus 400 gigabit ethernet (400 g) switchesNew nexus 400 gigabit ethernet (400 g) switches
New nexus 400 gigabit ethernet (400 g) switches
 
Tested cisco isr 1100 delivers the richest set of wi-fi features
Tested cisco isr 1100 delivers the richest set of wi-fi featuresTested cisco isr 1100 delivers the richest set of wi-fi features
Tested cisco isr 1100 delivers the richest set of wi-fi features
 
Aruba campus and branch switching solution
Aruba campus and branch switching solutionAruba campus and branch switching solution
Aruba campus and branch switching solution
 
Cisco transceiver module for compatible catalyst switches
Cisco transceiver module for compatible catalyst switchesCisco transceiver module for compatible catalyst switches
Cisco transceiver module for compatible catalyst switches
 
Cisco ios on cisco catalyst switches
Cisco ios on cisco catalyst switchesCisco ios on cisco catalyst switches
Cisco ios on cisco catalyst switches
 
Cisco's wireless solutions deployment modes
Cisco's wireless solutions deployment modesCisco's wireless solutions deployment modes
Cisco's wireless solutions deployment modes
 
Competitive switching comparison cisco vs. hpe aruba vs. huawei vs. dell
Competitive switching comparison cisco vs. hpe aruba vs. huawei vs. dellCompetitive switching comparison cisco vs. hpe aruba vs. huawei vs. dell
Competitive switching comparison cisco vs. hpe aruba vs. huawei vs. dell
 
Four reasons to consider the all in-one isr 1000
Four reasons to consider the all in-one isr 1000Four reasons to consider the all in-one isr 1000
Four reasons to consider the all in-one isr 1000
 
The difference between yellow and white labeled ports on a nexus 2300 series fex
The difference between yellow and white labeled ports on a nexus 2300 series fexThe difference between yellow and white labeled ports on a nexus 2300 series fex
The difference between yellow and white labeled ports on a nexus 2300 series fex
 
Cisco transceiver modules for compatible cisco switches series
Cisco transceiver modules for compatible cisco switches seriesCisco transceiver modules for compatible cisco switches series
Cisco transceiver modules for compatible cisco switches series
 
Guide to the new cisco firepower 2100 series
Guide to the new cisco firepower 2100 seriesGuide to the new cisco firepower 2100 series
Guide to the new cisco firepower 2100 series
 
892 f sfp configuration example
892 f sfp configuration example892 f sfp configuration example
892 f sfp configuration example
 
Cisco nexus 7000 and nexus 7700
Cisco nexus 7000 and nexus 7700Cisco nexus 7000 and nexus 7700
Cisco nexus 7000 and nexus 7700
 
Cisco firepower ngips series migration options
Cisco firepower ngips series migration optionsCisco firepower ngips series migration options
Cisco firepower ngips series migration options
 
Eol transceiver to replacement model
Eol transceiver to replacement modelEol transceiver to replacement model
Eol transceiver to replacement model
 

Recently uploaded

GenAI and AI GCC State of AI_Object Automation Inc
GenAI and AI GCC State of AI_Object Automation IncGenAI and AI GCC State of AI_Object Automation Inc
GenAI and AI GCC State of AI_Object Automation IncObject Automation
 
Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.YounusS2
 
Computer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and HazardsComputer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and HazardsSeth Reyes
 
Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™Adtran
 
Empowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership BlueprintEmpowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership BlueprintMahmoud Rabie
 
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...Will Schroeder
 
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyesHow to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyesThousandEyes
 
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...UbiTrack UK
 
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IES VE
 
Introduction to Matsuo Laboratory (ENG).pptx
Introduction to Matsuo Laboratory (ENG).pptxIntroduction to Matsuo Laboratory (ENG).pptx
Introduction to Matsuo Laboratory (ENG).pptxMatsuo Lab
 
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdfIaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdfDaniel Santiago Silva Capera
 
NIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopNIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopBachir Benyammi
 
UiPath Solutions Management Preview - Northern CA Chapter - March 22.pdf
UiPath Solutions Management Preview - Northern CA Chapter - March 22.pdfUiPath Solutions Management Preview - Northern CA Chapter - March 22.pdf
UiPath Solutions Management Preview - Northern CA Chapter - March 22.pdfDianaGray10
 
Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Commit University
 
Videogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdfVideogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdfinfogdgmi
 
AI Fame Rush Review – Virtual Influencer Creation In Just Minutes
AI Fame Rush Review – Virtual Influencer Creation In Just MinutesAI Fame Rush Review – Virtual Influencer Creation In Just Minutes
AI Fame Rush Review – Virtual Influencer Creation In Just MinutesMd Hossain Ali
 
UiPath Studio Web workshop series - Day 6
UiPath Studio Web workshop series - Day 6UiPath Studio Web workshop series - Day 6
UiPath Studio Web workshop series - Day 6DianaGray10
 
Digital magic. A small project for controlling smart light bulbs.
Digital magic. A small project for controlling smart light bulbs.Digital magic. A small project for controlling smart light bulbs.
Digital magic. A small project for controlling smart light bulbs.francesco barbera
 
PicPay - GenAI Finance Assistant - ChatGPT for Customer Service
PicPay - GenAI Finance Assistant - ChatGPT for Customer ServicePicPay - GenAI Finance Assistant - ChatGPT for Customer Service
PicPay - GenAI Finance Assistant - ChatGPT for Customer ServiceRenan Moreira de Oliveira
 
UiPath Platform: The Backend Engine Powering Your Automation - Session 1
UiPath Platform: The Backend Engine Powering Your Automation - Session 1UiPath Platform: The Backend Engine Powering Your Automation - Session 1
UiPath Platform: The Backend Engine Powering Your Automation - Session 1DianaGray10
 

Recently uploaded (20)

GenAI and AI GCC State of AI_Object Automation Inc
GenAI and AI GCC State of AI_Object Automation IncGenAI and AI GCC State of AI_Object Automation Inc
GenAI and AI GCC State of AI_Object Automation Inc
 
Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.
 
Computer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and HazardsComputer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and Hazards
 
Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™
 
Empowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership BlueprintEmpowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership Blueprint
 
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
 
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyesHow to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
 
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
 
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
 
Introduction to Matsuo Laboratory (ENG).pptx
Introduction to Matsuo Laboratory (ENG).pptxIntroduction to Matsuo Laboratory (ENG).pptx
Introduction to Matsuo Laboratory (ENG).pptx
 
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdfIaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
 
NIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopNIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 Workshop
 
UiPath Solutions Management Preview - Northern CA Chapter - March 22.pdf
UiPath Solutions Management Preview - Northern CA Chapter - March 22.pdfUiPath Solutions Management Preview - Northern CA Chapter - March 22.pdf
UiPath Solutions Management Preview - Northern CA Chapter - March 22.pdf
 
Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)
 
Videogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdfVideogame localization & technology_ how to enhance the power of translation.pdf
Videogame localization & technology_ how to enhance the power of translation.pdf
 
AI Fame Rush Review – Virtual Influencer Creation In Just Minutes
AI Fame Rush Review – Virtual Influencer Creation In Just MinutesAI Fame Rush Review – Virtual Influencer Creation In Just Minutes
AI Fame Rush Review – Virtual Influencer Creation In Just Minutes
 
UiPath Studio Web workshop series - Day 6
UiPath Studio Web workshop series - Day 6UiPath Studio Web workshop series - Day 6
UiPath Studio Web workshop series - Day 6
 
Digital magic. A small project for controlling smart light bulbs.
Digital magic. A small project for controlling smart light bulbs.Digital magic. A small project for controlling smart light bulbs.
Digital magic. A small project for controlling smart light bulbs.
 
PicPay - GenAI Finance Assistant - ChatGPT for Customer Service
PicPay - GenAI Finance Assistant - ChatGPT for Customer ServicePicPay - GenAI Finance Assistant - ChatGPT for Customer Service
PicPay - GenAI Finance Assistant - ChatGPT for Customer Service
 
UiPath Platform: The Backend Engine Powering Your Automation - Session 1
UiPath Platform: The Backend Engine Powering Your Automation - Session 1UiPath Platform: The Backend Engine Powering Your Automation - Session 1
UiPath Platform: The Backend Engine Powering Your Automation - Session 1
 

How to configure static nat on cisco routers

  • 1. How to Configure Static NAT on Cisco Routers? Network Address Translation (NAT) is an operation by which source and/or destination IP addresses within a packet are replaced with different IP addresses. NAT conserves available IP address space by allowing many private IP addresses to be represented by some smaller number of public IP addresses. Private IP addresses are defined in RFC 1918 and are addresses that cannot be used on the Internet. NAT is most commonly performed by routers or firewalls; however this tutorial focuses on NAT within Cisco routers. NAT can be performed both statically and dynamically. Static NAT simply maps one private IP address to a single public IP address, and this is the flavor of NAT we are discussing in this tutorial. A Cisco router performing NAT divides its universe into the inside and the outside. Typically the inside is a private enterprise, and the outside is the public Internet. In addition to the notion of inside and outside, a Cisco NAT router classifies addresses as either local or global. A local address is an address that is seen by devices on the inside, and a global address is an address that is seen by devices on the outside. Given these four terms, an address may be one of four types: 1. Inside local addresses are assigned to inside devices. These addresses are not advertised to the outside. 2. Inside global are addresses by which inside devices are known to the outside. 3. Outside local are addresses by which outside devices are known to the inside. 4. Outside global addresses are assigned to outside devices. These addresses are not advertised to the inside. Let’s jump right into NAT configuration on a Cisco router as shown in the Figure below: R1 is the router performing Network Address Translation (NAT) and has two
  • 2. interfaces: Fa0/0 on the inside and Fa0/1 on the outside. The specific IP addresses involved are: Table 1 NAT Addresses for Figure Above NAT Address Type IP Address Inside local 192.168.1.2 Inside global 89.203.12.47 Outside local 202.14.35.28 Outside global 202.14.35.28 You probably know very well how to configure IP addresses on router interfaces, so we skip those configuration steps and move straight to the interesting stuff. First, we have to assign Fa0/0 as NAT inside interface and Fa0/1 as NAT outside interface on R1. This would tell the router that interesting traffic entering or exiting these two interfaces will be subject to address translation. R1#conf term Enter configuration commands, one per line. End with CNTL/Z. R1(config)#interface Fa0/0 R1(config-if)#ip nat inside R1(config-if)#interface Fa0/1 R1(config-if)#ip nat outside R1(config-if)#end Now we would tell the router how to perform address translation and mention which IP addresses (source or destination) to re-write in packets moving between the inside and outside interfaces. Here we go: R1(config)#ip nat inside source static 192.168.1.2 89.203.12.47 Here, we are telling the router to perform NAT on packets coming into the router on the inside interface Fa0/0. More specifically the router would identify which of these packets have a source IP address of 192.168.1.2 and would change it to 89.203.12.47 before forwarding the packet out the outside interface Fa0/1. Similarly, return packets coming in at outside interface Fa0/1 would undergo translation of destination IP address. Let’s now verify if NAT is actually working as it is supposed to work. There are a couple of very useful Cisco IOS commands that can be used to do just that. Command show ip nat statisticsdisplays the number of static and dynamic NAT translations, inside and outside interfaces, and the number of hits and misses. R1#show ip nat statistics Total active translations: 1 (1 static, 0 dynamic; 0 extended) Outside interfaces: FastEthernet0/1 Inside interfaces:
  • 3. FastEthernet0/0 Hits: 0 Misses: 0 CEF Translated packets: 0, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: Appl doors: 0 Normal doors: 0 Queued Packets: 0 Command show ip nat translations displays the IP addresses for NAT translations. R1#show ip nat translations Pro Inside global Inside local Outside local Outside global — 89.203.12.47 192.168.1.2 — — As you see in the above output, we have one NAT entry configured with Inside global address 89.203.12.47 and Inside local address 192.168.1.2 specified. Outside local and Outside globaladdresses are blank because our NAT configuration does not change those addresses. Let’s now go to the PC and ping the Server before running the command show ip nat translations again to see if it makes any difference. R1#show ip nat statistics Total active translations: 2 (1 static, 1 dynamic; 1 extended) Outside interfaces: FastEthernet0/1 Inside interfaces: FastEthernet0/0 Hits: 10 Misses: 0 CEF Translated packets: 10, CEF Punted packets: 0 Expired translations: 0 Dynamic mappings: Appl doors: 0 Normal doors: 0 Queued Packets: 0 R1#show ip nat translations Pro Inside global Inside local Outside local Outside global icmp 89.203.12.47:1 192.168.1.2:1 202.14.35.28:1 202.14.35.28:1 — 89.203.12.47 192.168.1.2 — — As you can see in the above output, NAT is active as manifested by the appearance of an additional dynamic entry for ICMP protocol and some additional hits, corresponding to our ping attempt from PC to Server.
  • 4. We just configured and verified a simple NAT scenario translating only the source or destination (not both at the same time) IP addresses of packets moving between inside and outside interfaces. This sort of NAT configuration is called static NAT as a single inside local IP address is statically mapped to a single outside local IP address. Another important feature of NAT is static Port Address Translation (PAT). Static PAT is designed to allow one-to-one mapping between local and global addresses. A common use of static PAT is to allow Internet users from the public network to access a Web server located in the private network. Let’s assume we intend to host a Web server on the inside on the same PC, that has an IP address 192.168.1.2. The following configuration line would allow us to do just that: R1(config)#ip nat inside source static tcp 192.168.1.2 80 89.203.12.47 80 This configuration line performs the static address translation for the Web server. With this configuration line, users that try to reach 89.203.12.47 port 80 (www) are automatically redirected to 192.168.1.2 port 80 (www). In our case, 192.168.1.2 is the IP address of the PC which is also the Web server. This configuration can be verified using the same two NAT verification commands: show ip nat translations and show ip nat statistics. Notice that the address 89.203.12.47 with port number 80 (HTTP) translates to 192.168.1.2 port 80, and vice versa. Therefore, Internet users can browse the Web server even though the Web server is on a private network with a private IP address. More Related NAT Tips: How to Configure Basic NAT with Overloading? How to Configure Static NAT for Inbound Connections? How to Configure NAT in Cisco IOS? How to Set up NAT Using the Cisco IOS?