Embedded Files
Lab Overview
In this lab, I configured Network Address Translation (NAT) on two edge routers to provide controlled communication between private networks and external networks.
On the first router, I configured PAT (NAT overload) so clients on the 192.168.10.0/24 network can access external networks using the router’s public IP address. DHCP was also configured to provide IP addressing and DNS information to the clients.
On the second router, I configured static NAT for HTTP and HTTPS traffic. This allows an internal web server to be accessed from an external network through the router’s public IP address.
Objectives
Configure NAT and PAT on Cisco routers.
Configure static NAT for web services.
Configure DHCP for client address assignment.
Configure default routes toward the ISP.
Use inside and outside NAT interfaces.
Publish an internal web server using HTTP and HTTPS.
Verify connectivity using ping and tracert.
Test internal and external web access.
Lab Scenario
The lab represents two organization connected to an ISP through their edge routers. The first company contains client devices that use private IP addresses. PAT allows these clients to access external services, such as google.com, through the edge router.
The second company contains an internal web server. Static NAT maps the server's private IP address to the router's public IP address, allowing external users to access the company website using HTTP or HTTPS.
This demonstrates two common NAT use cases: allowing internal clients to initiate outbound connections and publishing an internal server for external access.
Topology
IP Addressing and Network Plan
Device Interface IP Address Purpose
ISP G0/0/0 5.1.1.1/30 Link to client edge router
ISP G0/1/0 5.1.2.1/30 Link to web-server edge router
ISP G0/0 2.2.2.1/30 External/Internet-side network
Router-1 G0/0/0 5.1.1.2/30 Outside/NAT interface
Router-1 G0/0 192.168.10.1/24 Inside/client LAN
Client LAN — 192.168.10.0/24 Private client network
Router-3 G0/0/0 5.1.2.2/30 Outside/NAT interface
Router-3 G0/0 10.1.1.1/24 Inside/web-server LAN
Web Server — 10.1.1.2/24 Internal HTTP/HTTPS server
Configuration
ISP
conf t
hostname ISP
interface gig0/0/0
ip address 5.1.1.1 255.255.255.252
no shutdown
exit
interface gig0/1/0
ip address 5.1.2.1 255.255.255.252
no shutdown
exit
interface gig0/0
ip address 2.2.2.1 255.255.255.252
no shutdown
exit
do write
Router-1
conf t
hostname RT-2
interface gig0/0/0
ip address 5.1.1.2 255.255.255.252
ip nat outside
no shutdown
exit
interface gig0/0
ip address 192.168.10.1 255.255.255.0
ip nat inside
no shutdown
exit
ip dhcp excluded-address 192.168.10.1 192.168.10.9
ip dhcp pool vlan10
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 192.168.10.2
exit
access-list 1 permit 192.168.10.0 0.0.0.255
ip nat inside source list 1 interface gig0/0/0 overload
ip route 0.0.0.0 0.0.0.0 5.1.1.1
do write
Router-3
conf t
hostname RT-3
interface gig0/0/0
ip address 5.1.2.2 255.255.255.252
ip nat outside
no shutdown
exit
interface gig0/0
ip address 10.1.1.1 255.255.255.0
ip nat inside
no shutdown
exit
ip nat inside source static tcp 10.1.1.2 80 5.1.2.2 80
ip nat inside source static tcp 10.1.1.2 443 5.1.2.2 443
ip route 0.0.0.0 0.0.0.0 5.1.2.1
do write
Testing & Verification
To test this network, I used the commands and actions below:
From PC-1, I pinged the networks to make sure they are accessible:
ping 192.168.10.1
Pinging 192.168.10.1 with 32 bytes of data:
Reply from 192.168.10.1: bytes=32 time<1ms TTL=255
Reply from 192.168.10.1: bytes=32 time<1ms TTL=255
Reply from 192.168.10.1: bytes=32 time<1ms TTL=255
Reply from 192.168.10.1: bytes=32 time<1ms TTL=255
Ping statistics for 192.168.10.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
ping 5.1.2.1
Pinging 5.1.2.1 with 32 bytes of data:
Request timed out.
Reply from 5.1.2.1: bytes=32 time=12ms TTL=254
Reply from 5.1.2.1: bytes=32 time<1ms TTL=254
Reply from 5.1.2.1: bytes=32 time=10ms TTL=254
Ping statistics for 5.1.2.1:
Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 12ms, Average = 7ms
ping 5.1.2.2
Pinging 5.1.2.2 with 32 bytes of data:
Request timed out.
Reply from 5.1.2.2: bytes=32 time=11ms TTL=253
Reply from 5.1.2.2: bytes=32 time=11ms TTL=253
Reply from 5.1.2.2: bytes=32 time=12ms TTL=253
Ping statistics for 5.1.2.2:
Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
Minimum = 11ms, Maximum = 12ms, Average = 11ms
Then tracerouted the webservers using their domain name:
tracert remote.xco.com
Tracing route to 5.1.2.2 over a maximum of 30 hops:
1 0 ms 0 ms 0 ms 192.168.10.1
2 0 ms 11 ms 0 ms 5.1.1.1
3 11 ms 11 ms 0 ms 5.1.2.2
Trace complete.
tracert google.com
Tracing route to 2.2.2.2 over a maximum of 30 hops:
1 0 ms 0 ms 0 ms 192.168.10.1
2 0 ms 11 ms 0 ms 5.1.1.1
3 0 ms 12 ms 11 ms 2.2.2.2
Trace complete.
Then tested whether the webpages will be loaded on this client:
google.com site:
Company’s remote server webpage:
I also tested the NAT status on Router-1 using the command below:
show ip nat translations
Pro Inside global Inside local Outside local Outside global
tcp 5.1.1.2:1025 192.168.10.10:1025 2.2.2.2:80 2.2.2.2:80
tcp 5.1.1.2:1026 192.168.10.10:1026 2.2.2.2:80 2.2.2.2:80
tcp 5.1.1.2:1027 192.168.10.10:1027 5.1.2.2:80 5.1.2.2:80
Results
The lab successfully demonstrated both outbound and inbound NAT scenarios.
Client devices on the private 192.168.10.0/24 network were able to access external services through PAT. The internal web server on 10.1.1.2 was also published externally through static NAT for HTTP and HTTPS access.
The successful ping, traceroute, and web browser tests confirmed the NAT configuration and end-to-end connectivity.
Resources
The startup configuration files for all devices and the Packet Tracer simulation file are published on my GitHub for reference.
Google Sites
Report abuse