Cliquez ici >>> 🐾 configuration nat et pat cisco pdf

Part2: Troubleshoot NAT Configuration. Step 1: View the NAT translations on R2. Step 2: Show the running configuration of R2. Step 3: Correct the Interfaces. Step 4: Ping Server1 from PC1, PC2, L1, L2, and R2. Step 5: View the NAT translations on R2. Step 6: Show Access-list 101 on R2. Step 7: Correct the Access-list. Part 3: Verify Connectivity PacketTracer PAT Configuration Example. In some cases there can be hundreds of inside local addresses and at the same time your Global IP Addresses can be limited. At this time you can use PAT instead of Static and Dynamic NAT translation. Here, we will learn PAT Configuration with Cisco Packet tracer. CommandesCisco CCNA Exploration Introduction Cette documentation regroupe toutes les commandes utilisées sur les routeurs et commutateurs CISCO et vues dans les cours du CCNA Exploration. En introduction seront présentées les commandes permettant de configurer les bases du routeur et du commutateur tels que nom de l'équipement, mots de passe, bannière, Savoirconfigurer un réseau sans fil « WLAN ». Être capable de dépanner un réseau et mettre en œuvre un plan de sauvegarde. Appréhender l’importance d’avoir un réseau sécurisé, et comment s’en protéger. Maîtriser les bases de IPv6. Savoir dimensionner une topologie réseau avec du LAN, WAN et en Cloud. Thiscompletes our VPN configuration. NAT Exemption. We now have a working configuration where we use PAT to translate traffic from our hosts and a site-to-site IPSec IKEv2 VPN tunnel. Without NAT Exemption. Let’s see what happens without NAT exemption. Let’s try what happens when we connect from S1 to S3: Les Site De Rencontre Non Payant En France. Ce tutoriel vous présente comment configurer un routeur Cisco. Cette configuration est celle de base, autrement dit, entre deux réseaux simplement. Livre complet sur la configuration du routeur Cisco Vous pouvez consulter la vidéo Ou le tutoriel écrit Mon réseau sera celui ci-dessous, donc d’un coté le réseau 1 en et de l’autre le réseau 2 en Ce test est réalisé sur Packet tracer car je n’avais pas de routeur Cisco physique sous la main mais les commandes sont les mêmes d’un routeur Cisco à l’autre. Pour le moment rien n’est configuré, même pas les deux PC, et pour communiquer entre les deux réseaux j’ai le routeur que je vais également devoir configurer. Dans un premier temps, je vais configurer le premier PC, je lui donne le nom de fafa-pc-1 Puis je configure son interface réseau. Je fais la même chose pour le second PC. Je tente un ping de la seconde machine sur la première, on ne sait jamais sur un malentendu. Comme prévu le ping échoue je ne peux pas communiquer avec l’autre réseau, normal le routeur n’est pas configuré. Le réseau ressemble à ceci pour le moment, les noms et interfaces réseaux des deux machines ont étés modifiés. Nous pouvons attaquer le routeur. Je me connecte sur le routeur, des informations m’attendent déjà. Je tape entrée pour que la console apparaisse, à partir de la je modifie le nom de routeur avec la commande hostname, je l’appelle rfafa. Je ne détaille pas les autres commandes qui permettent simplement de naviguer entre les modes du routeur. Maintenant je passe à la pratique, je vais configurer les mots de passes du routeur, par exemple quand je me connecte dessus. Je donne une bannière d’accueil à mon routeur. Ici se sera Bienvenue sur fafa-informatique » Je configure les deux interfaces réseaux du routeur, je fais bien attention à quel interface est sur quel réseau. Après chaque configuration d’interface je l’active avec la commande no shutdown. Mes interfaces sont prêtes. Je sauvegarde ma configuration, on ne sait jamais. Je vérifie que la configuration est bonne. La configuration du routeur apparaît, je peux la faire défiler avec entrée. Je vérifie les réseaux que connaît mon routeur. Je vérifie que les interfaces fonctionnent. Enfin, je vérifie en détail la configuration de mes interfaces. Je peux faire défiler les détail en appuyant sur entrée. En retournant sur mon réseau je constate immédiatement que les petits ronds sont désormais verts. Cela signifie que les connexions fonctionnent. Je vais néanmoins vérifier. Je ping depuis le PC fafa-pc-2 ayant pour IP vers l’interface réseau du routeur se situant dans son réseau. Le ping fonctionne parfaitement. Maintenant, je tente de pinger la machine sur l’autre réseau, ça fonctionne également. Nos deux réseaux peuvent donc communiquer. La première requête du ping n’est pas passée le temps qu’il trouve la route, mais toutes les requêtes passent. On le constate sur le deuxième ping. Ce tutoriel sur la configuration de base d’un routeur Cisco est maintenant terminé. NAT is a valuable tool for admins, both for conserving public IP addresses and securing internal resources. Several variations of NAT are available, including its cousin PAT. See the differences and learn how to set up PAT using the Cisco IOS. Port Address Translation PAT is a special kind of Network Address Translation NAT. It can provide an excellent solution for a company that has multiple systems that need to access the Internet but that has only a few public IP addresses. Let’s take a look at the distinctions between NAT and PAT and see how they are typically used. Then, I’ll show you how to configure PAT on a Cisco router. Understanding PAT and NATBefore discussing PAT, it will help to describe what NAT does in general. NAT was designed to be a solution to the lack of public IP addresses available on the Internet. The basic concept of NAT is that it allows inside/internal hosts to use the private address spaces 10/8, and networks—see RFC1918, go through the internal interface of a router running NAT, and then have the internal addresses translated to the router’s public IP address on the external interface that connects to the Internet. If you dig into NAT a little deeper, you will discover that there are really three ways to configure it. From these configurations, you can perform a variety of functions. The three configurations are PAT PAT is commonly known as “NAT overload” or sometimes just “overload”. In this configuration, you have multiple clients on your inside network wanting to access an outside network usually the Internet. You have few public IP addresses, many more than the number of clients, so you have to “overload” that real Internet IP address. In other words, you are mapping many inside clients to a single Internet IP address many to one. For an illustration of PAT, see Figure A. Figure A Pooled NAT Pooled NAT is similar to PAT except you have the luxury of having a one-to-one mapping of addresses. In other words, you have just as many inside network clients as you do outside network IP addresses. You tell the NAT router the pool of IP addresses that are available, and each client receives its own IP addresses when it requests a NAT translation. The client does not get the same address each time it requests a translation; it merely gets the next available address from the pool. In my article “Set up NAT using the Cisco IOS,” I explain how to configure Pooled NAT. For an illustration of Pooled NAT, see Figure B. Figure B Static NAT Static NAT is the simplest form of NAT. The most likely example is a mail server on the inside of a private network. The private network connects to the public Internet. In between the two networks, a router performs NAT. For a dedicated server, like a mail server, you would want a static not changing IP address. This way, every time someone on the Internet sends e-mail to the mail server, that server has the same public IP address. For an illustration of Static NAT, see Figure C. Figure C As I said, you can perform a variety of functions with these three configurations. For the purpose of this article, we will focus on configuring PAT. Configuring PATTo configure PAT/NAT correctly the first time, you need to understand the Cisco NAT terminology and how your IP networks/addresses map to each of the entities listed below Inside Local—This is the local IP address of a private host on your network a workstation’s IP address. Inside Global—This is the public IP address that the outside network sees as the IP address of your local host. Outside Local—This is the local IP address from the private network, which your local host sees as the IP address of the remote host. Outside Global—This is the public IP address of the remote host the IP address of the remote Web server that a workstation is connecting to. You’ll configure your Cisco router using seven commands. Let’s assume that your Internet service provider gave you a 30-bit network containing two public IP addresses. This configuration would allow one address for your router and one address for your internal clients and devices. The first command you’ll execute will tell the router which public IP address you want to use for PATip nat pool mypool prefix 30 This command configures a pool range of IP addresses to use for your translation. In this case, we want only one address in our pool, which we will overload. We do this by assigning the same IP address for the start and end of the pool. The next command will tell your router which IP addresses it is allowed to translateaccess-list 1 permit It’s not a good idea to put “permit any” in the access list, even though you will occasionally see that as a recommendation in some sample configurations. The next command isip nat inside source list 1 pool mypool overload This command puts the pool definition and the access list together. In other words, it tells the router what will be translated to what. The overload keyword turns this into a PAT configuration. If you left out overload, you would be able to translate only one IP address at a time, so only one client could use the Internet at a time. Next, you need to tell PAT/NAT what interfaces are the inside network and what interfaces are the outside network. Here’s an exampleinterface ethernet 0ip nat insideinterface serial 0ip nat outside With these commands, your PAT configuration is finished. You have told the Cisco IOS you are translating your network A into a single IP address from network B, that network A is on the ethernet 0 interface and network B is on the serial 0 interface, and that you want to allow the inside network to overload the single IP address on the outside network. Finally, verify that NAT works. This can be as simple as doing a ping command from your inside local host to an outside global host. If the ping succeeds, chances are you have everything configured correctly. You can also use the following Cisco IOS commands to confirm and troubleshootshow ip nat translations [verbose]show ip nat statistics With the translations command, you should see the translation that was created from your ping test. But watch out The translations will disappear after their time-out expires. If you have configured overload, these time-outs are configurable by traffic type. SummaryYou should now understand the differences between PAT, Pooled NAT, and Static NAT, and you should be able to do a basic PAT configuration with the Cisco IOS. For more information, check out the links below. Additional resources TechRepublic “Learn why NAT can cause VPN connection problems” TechRepublic “Set up NAT using the Cisco IOS” TechRepublic “Use NAT to connect your network to the Internet” Cisco NAT Technical Tips Index Cisco How NAT Works Cisco Configuring Network Address Translation Getting Started Cisco Frequently Asked Questions about Cisco IOS NAT Cisco IOS Configuring Network Address Translation Cisco IOS Overloading an Inside Global Address PAT Cisco IOS IP Addressing Command Reference including NAT commands PCWebopedia NAT Definition RFC1631 The IP Network Address Translator NAT RFC1918 Address Allocation for Private Internets Network Computing Network Address Translation Hiding in Plain Sight Verizon How Network Address Translation Works Da Lan Tech Network Address Translation for Beginners Network Address Translation or NAT is a mechanism of mapping local address on the inside interface of a router with global address on the outside interface. For outgoing packets, router will translate the source local address to a global address. Reversely, router will forward incoming packets for a global address to its local address. This is usually the scenario to enable hosts on LAN to communicate with the internet. In Cisco device, there are several methods to configure NAT. One of the methods will be explained in this article is to configure static NAT in Cisco IOS router. Static NAT is a manual mapping of local and global address as defined by the network administrator. The way to configure static NAT in Cisco IOS router consists of two steps that will be explained using example scenario with given topology as below 1. Define the inside and outside interface Defining the inside and outside interface correctly is the key to make NAT mapping works. Simply go to the interface configuration mode and then use command ip nat inside to make the interface as an inside interface. In a similar way, use command ip nat outside to make the interface as an outside interface. For the above scenario, the way to make f0/0 on R1 as the inside interface and f0/1 as the outside interface is shown below assuming the IP address for each interface and default route to internet has been configured before R1configinterface f0/0 R1config-ifip nat inside R1config-ifexit R1configinterface f0/1 R1config-ifip nat outside R1config-ifexit 2. Configure the static NAT mapping The command to configure static NAT mapping is ip nat inside source static [local address] [global address]. The command can be repeated many times as required but note that in Cisco IOS router one local address can only be mapped to one global address and vice-versa. Additionally, note that the global address must be in range of the subnet on the outside interface. In real practice, the global address usually provided by the internet service provider. For the above scenario, the command to map Server1 IP address to one of the available global IP address R1configip nat inside source static Verifying the NAT sessions To see if static NAT works as expected, try to do a ping from Server1 to address on the internet. Before static NAT is applied, ping from Server1 to will not work because R1 will forward the packet with source address of and it is not known on the internet in this case. Server> ping icmp_seq=1 timeout After NAT is applied, the source address of is masked by and it is an address that is known on the internet in this case. Therefore, ping from Server1 is success. Server> ping 84 bytes from icmp_seq=1 ttl=252 time= ms Use command show ip nat translations on the router to see the NAT session. See this example output for the above scenario R1sh ip nat trans Pro Inside global Inside local Outside local Outside global icmp - - - The output above shows the active sessions between local address and global address on the inside and outside interface complete with the protocol and port information. The inside global and outside global shows the IP address and ports as result of translation while the inside local and outside local shows the address and ports before the translation. From the output above we can see that static NAT mapping between local address of and global address on the inside interface has working successfully. One cool thing about static NAT is that it also works for incoming packets. To confirm this, do ping from the internet to Server1 global address. Internet>ping 84 bytes from icmp_seq=1 ttl=252 time= ms On R1, run command show ip nat translations again to see the session R1sh ip nat trans Pro Inside global Inside local Outside local Outside global icmp - - - And that’s how you configure static NAT in Cisco IOS Router. The following two tabs change content Posts I am IT practitioner in real life with specialization in network and server infrastructure. I have years of experience in design, analysis, operation, and optimization of infrastructure solutions for enterprise-scaled network. You can send me a message on LinkedIn or email to for further inquiry regarding stuffs that I wrote or opportunity to collaborate in a project. Routershow ip nat translations Displays the translation table Routershow ip nat statistics Displays NAT statistics Routerclear ip nat translations inside outside Clears a specific translation from the table before it times out Routerclear ip nat translations* Clears the entire translation table before entries time out Troubleshooting NAT and PAT Configurations Routerdebug ip nat Displays information about every packet that is translated. Be careful with this command. The router's CPU might not be able to handle this amount of output and might therefore hang the system. Routerdebug ip nat detailed Displays greater detail about packets being translated. Figure 23-1 shows the network topology for the PAT configuration that follows using the commands covered in this chapter. Figure 23-3 Port Address Translation Configuration ISP Router router>enable Moves to privileged mode. routerconfigure terminal Moves to global configuration mode. routerconfighost ISP Sets the host name. ISPconfigno ip domain-lookup Turns off Domain Name System DNS resolution to avoid wait time due to DNS lookup of spelling errors. ISPconfigenable secret cisco Sets the encrypted password to cisco. ISPconfigline console 0 Moves to line console mode. ISPconfig-linelogin User must log in to be able to access the console port. ISPconfig-linepassword class Sets the console line password to class. ISPconfig-linelogging synchronous Commands will be appended to a new line. ISPconfig-lineexit Returns to global configuration mode. Figure 23-3 Port Address Translation ConfigurationNetwork Network Network Network IP NAT IP NAT Inside Outside ISPconfiginterface serial 0/0/1 Moves to interface configuration mode. ISPconfig-ifip address Assigns an IP address and netmask. ISPconfig-ifclock rate 56000 Assigns the clock rate to the DCE cable on this side of the link. ISPconfig-ifno shutdown Enables the interface. ISPconfig-ifinterface loopback 0 Creates loopback interface 0 and moves to interface configuration mode. ISPconfig-ifip address Assigns an IP address and netmask. ISPconfig-ifexit Returns to global configuration mode. ISPconfigexit Returns to privileged mode. ISPcopy running-config startup-config Saves the configuration to NVRAM. Company Router nouten>enable Moves to privileged mode. routerconfigure terminal Moves to global configuration mode. routerconfighost Company Sets the host name. Companyconfigno ip domain-lookup Turns off DNS resolution to avoid wait time due to DNS lookup of spelling errors. Companyconfigenable secret cisco Sets the secret password to cisco. Companyconfigline console 0 Moves to line console mode. Companyconfig-linelogin User must log in to be able to access the console port. Companyconfig-linepassword class Sets the console line password to class. Companyconfig-linelogging synchronous Commands will be appended to a new line. Companyconfig-lineexit Returns to global configuration mode. Companyconfiginterface fastethernet 0/0 Moves to interface configuration mode. Companyconfig-ifip address Assigns an IP address and netmask. Companyconfig-ifno shutdown Enables the interface. Companyconfig-ifinterface serial 0/0/0 Moves to interface configuration mode. Companyconfig-ifip address Assigns an IP address and netmask. Companyconfig-ifno shutdown Enables the interface. Companyconfig-ifexit Returns to global configuration mode. Companyconfigip route Sends all packets not defined in the routing table to the ISP router. Companyconfigaccess-list 1 permit Defines which addresses are permitted through; these addresses are those that will be allowed to be translated with NAT. Companyconfigip nat inside source list 1 interface serial 0/0/0 overload Creates NAT by combining list 1 with the interface serial 0/0/0. Overloading will take place. Companyconfiginterface fastethernet 0/0 Moves to interface configuration mode. Companyconfig-ifip nat inside Location of private inside addresses. Companyconfig-ifinterface serial 0/0/0 Moves to interface configuration mode. Companyconfig-ifip nat outside Location of public outside addresses. Companyconfig-if[email protected] Returns to privileged mode. Companycopy running-config startup-config Saves the configuration to NVRAM. This chapter provides information and commands concerning the following topics • Configuring DHCP • Verifying and troubleshooting DHCP configuration • Configuring a DHCP helper address • DHCP client on a Cisco IOS Software Ethernet interface • Configuration example DHCP Continue reading here Configuration Example DHCP Was this article helpful? When a Windows client connects to an IPsec-enabled Cisco IOS LNS router through a NAT or PAT server and another Windows client connects to the same Cisco IOS LNS router, the first client's connection is terminated. Note If IPsec is not enabled or there is no NAT or PAT server, multiple Windows clients can connect to the Cisco IOS LNS router. L2TP IPsec Support for NAT and PAT Windows Clients Feature not Enabled The figure below shows two Windows 2000 clients that are trying to connect to an end host through a router running NAT or PAT and IPsec-enabled Cisco IOS LNS router. Figure 1. Multiple Windows 2000 Clients, NAT Router, and Cisco IOS LNS Router The Windows 2000 Client 1 establishes an IPsec-protected L2TP tunnel to the Cisco IOS LNS router. The Windows 2000 Client 1 and the Cisco IOS LNS router recognize that there is a NAT router located between them and the NAT router is enabled with IPsec and NAT-Traversal NAT-T. The Windows 2000 Client 1 attempts to establish an IPsec security association SA and requests a transport mode which it does by default with proxies from its local address, to the Cisco IOS LNS router’s address. In transport mode, NAT, running on the router, translates all outgoing connections including to its outside IP address at which the address the traffic arrives. However, NAT cannot modify the L2TP port designation 1701, which is protected by the IPsec encrypted area. So, the local address now is the remote address the and the remote port is 1701. The traffic that matches the tunnel port 1701 is sent to the Windows 2000 Client 1. Windows 2000 Client 2 establishes an IPsec-protected L2TP tunnel to the Cisco IOS LNS router and NAT translates outgoing connections to its outside IP address again, NAT cannot modify the L2TP port designation 1701 similar to Windows Client 1. The traffic that matches tunnel port 1701 is now sent to Windows 2000 Client 2. which ends Windows Client 1’s connection with the Cisco IOS LNS router since it is no longer receiving traffic. L2TP IPsec Support for NAT and PAT Windows Clients Feature Enabled When the L2TP IPsec Support for NAT and PAT Windows Clients feature is enabled, IPsec can translate the L2TP ports after decryption. This feature allows IPsec to map traffic from different hosts to different source ports. L2TP can now distinguish between traffic destined for multiple Windows 2000 clients. When an security association SA is created, a translated port is assigned to the SA. This port is client-specific. The same port is used for any new SA created by that client. When an encrypted request is received and decrypted, the source port is translated from the standard value 1701 to a client specific value. The request with the translated port is then forwarded to L2TP. As shown in the above figure, with port address translation enabled, the Windows 2000 Client 1 is assigned to the translated port number 1024, and Windows 2000 Client 2 is assigned to the translated port number 1025. When L2TP sends the reply packet, it uses the translated port number and creates a packet to that destination port. IPsec uses the destination port number to select the SA with which to encrypt the packet. Before encrypting the packet, IPsec translates the destination port back to the standard port number 1701, which the Windows 2000 client expects. IPsec encrypts the packet either with the SA to Windows 2000 Client 1 if the destination port is 1024 or with the SA to Windows 2000 Client 2 if the destination port is 1025. The traffic is now sent to the appropriate client, and multiple Windows clients can be connected to a Cisco IOS LNS router through a NAT server at the same time. The connection is maintained until one of the following actions occurs The IPsec connection is closed. The NAT or PAT router ends the session. The Cisco IOS LNS router closes the session. A Windows client closes the session.

configuration nat et pat cisco pdf