Original subtitles

>> We move from concept to configuration.

NAT configuration is one of the more enjoyable on a Cisco router

because there's a few moving parts to it.

And you have to take some of the concepts that you've learned about,

most specifically access list which you just learned about

and apply it here to be successful.

So that just makes it kind of a neat thing to do.

For this configuration I am using real Cisco routers.

I moved out of GNS3 just because there's something lost.

I mean you can bridge GNS3 to a real network card and have it do NAT,

and that's definitely great if you don't have a Cisco router.

But there's something lost when you just can't open a web page and be like, oh look,

it's working and checking all the NAT translation.

Because obviously without getting virtual box set up

and all of that craziness there's no real way to do that inside of GNS3

at least easily, but it's possible.

So what I'm going to do is I'm going to build this router from scratch

because you can't see it enough, and as we're nearing the end of this series I'd love

to solidify a bunch of concepts in your head.

So we're going to name this router NAT.

And we're going to make this the fast ethernet 0/0 port

and give it the IP address 192.168.1.1/24.

Now, we're going to connect this to a real service provider,

and one of the reasons you might be like, wow, 192.168 that's kind of old school, right?

Instead of like your small environment, but I wanted to set this up to

where this is something that you could do at home.

I actually just answered an email from a student, the previous edition of this series,

this CCNA series, I recommended at the very end

of the series purchasing an 871W router for a lab.

And let me see if I can pull up a picture.

Here we go.

Now, don't look at the price and be like oh my goodness.

I mean go on eBay.

This thing hasn't been made for years.

Like it's out of production from Cisco.

I think these vendors are just trying to rake you over on the price.

You shouldn't pay more than $50 for this router.

But I got an email from a student saying do you still recommend the 871W,

or do you have something more recent that you recommend?

And I sat and I thought, you know what, I still recommend the 871W now

as a great little lab router to use at home.

The reason I say that, and that actually reminds me I'm going to add a nugget to the end

of this series where I add some home lab recommendations.

Hang on, I'm just going to write that down.

Okay. So the reason that I recommend this is because it's small enough

and it has the full IOS for you to play with that somebody would want to use this at home.

Now, would I recommend getting a 2800 series or 2900 series

or whatever big, classy brand of router?

I'm like, yeah, sure if you can afford it.

But what I found is people -- I actually had one student

who said I've bought a whole lab rack of equipment.

He bought like five or six different routers and switches.

He just built a whole rack of Cisco equipment that he used for a lab.

And I said, wow, what are you going to do with it?

He goes I don't know yet but I'm going to use it.

And I'm like, ah, because a lot of times if you build a lab

without a practical scenario behind you, you end up just making a pile of equipment

that you turn on every now and then.

You're like, oh well, I can type in host name.

But getting one of these little guys allows you to put it on your shelf and start using it

as your home router which immediately throws you into the fire.

Because you just took down your home internet connection, right?

There's motivation.

I want to watch TV.

I mean what doesn't come over the internet anymore?

So you now have instant motivation and instant real world situations where, okay,

you want to set up NAT for your house.

You want to set up a subnet.

With this router you can even do VLANS and set up VLANS inside of your house.

Maybe I want to create a VLAN and separate my WiFi from my LAN connection

so that I can have a public WiFi that's secured, ooh secured.

I can create an access list to make sure that the public WiFi I just set up can't get

into my house and make sure that -- you see what I mean?

It's just like it starts breeding these like, ooh, that's cool.

And I can put this on the shelf and it's small.

These guys they're going to make a lot of noise.

[Squealing Noise] And you're like shut that off.

And they're going to be hot, and they take up a lot of space.

Whereas this you get the full IOS.

I feel like I'm selling it but I'm not.

It's just a lab router.

So the reason that I'm setting this up, and I want to frame it this way, is I want to set it

up very similar to what one of you guys might do at home when you're setting this up.

So I'm connecting this to a real service router, and I'm going to say

at your house you probably don't have static IP addresses.

You may, great, good for you and go for it if you can.

But most of the time you're going to set this up for DHCP to get a dynamic address from the ISP,

so I'll put ISP connection right here.

One more thing let me just fill in.

This is fast ethernet 0/1 right here.

And I think that's about all the information we need.

Let's get going.

I'm going to bring up my router.

Which I told you I'm going to set this guy up from scratch.

So I've literally cleared the configuration off of this router.

Let's see if I squish it and see everything at the same time.

No, I do not want to enter the initial config dialogue.

So let's just mentally run through the checklist.

We're going to have to put a base configuration on there, assign the IP address,

give it a host name, set some of the console port settings that we all know and love

like log in synchronous and all that.

We'll have to I would say set up a DHCP scope.

I'm going to allow this guy to be a DHCP server for the LAN in handing out IP addresses there.

So a little bit to do to start off with.

So I'm going to go into global -- oh, no.

Have you ever done this before.

I think this is the first time in the series I've done it.

Because I usually turn it off.

This, by the way, if you mistype something in user mode or privilege mode,

what it's trying to do is telnet to a device named eb.

So it's trying to resolve eb to an IP address.

If you don't set up your server or your router

for DNS the first command you want to type is no IP domain-lookup.

And that's what keeps that from happening.

That's painful because you have to sit there and wait.

A lot of them don't even let you -- you can abort it by doing control shift 6

and just keep slamming the keyboard until it finally does that.

But a lot of them won't even let you do that, you're just stuck.

Alright, so let's get going.

We've got host name.

I'm going to give it the name of NAT.

Let's get into the interfaces.

Well, actually before I do that let's go line console 0

because what just happened there is not what I want to happen all the time.

Logging synchronous so those messages don't interrupt when I'm typing.

No exec-time out.

Let's go into line vty 0 4.

Log in password will be Cisco.

Just giving it some base passwords and telnet information, okay.

Exit out there.

Let's see, enable secret, password will be Cisco so we'll put that in there, okay.

Interface fast ethernet at 0/0.

IP address 192.168.1.1 class c, right?

So we're giving that an IP address no shut.

And I get that guy powered up and going.

Exit back out.

Let's go into interface.

Let's go to the ISP connection.

Fast ethernet 0/1.

And we'll do an IP address.

And this is going to be dynamic because we're connected to the service router.

So we'll say DHCP, we'll negotiate that, DHCP.

It's hanging there just because it's trying to enable that interface.

We'll do a no shut down as well.

Let's just see if we get anything.

Not yet and that's okay.

I may have to -- if I could type.

I may have to -- oh, look at that, it's going to say that I'll have

to reboot my cable modem, but I got one.

So we've got a DHCP address that's good.

It looks good to me.

So let's set up DHCP.

If you ever wonder what are these, by default Cisco routers broadcast to try

and find a config if they don't have one.

If you save you config and give it some time it will stop those messages.

You can also go into global config mode and type in no service config,

and most of the time that will work.

There's been sometimes it doesn't work.

It's just an annoyance until you save your config.

And even a little while after.

So I'm going to go in to set up a DHCP scope so our client on this LAN can get an IP address.

So we'll do IP DHCP -- you always when you're setting up a DHCP scope,

I mean the router's handing out IP address to the LAN, you always say what you don't want

to hand out first, because there's no easy way

of setting a range, like hand out from here to here.

So I'm going to exclude from 192.168.1.1 to 192.168.1.10.

We'll say those are reserved.

So the first address I'll hand out will be 1.11.

Following so far?

It's fast and furious, right?

IP DHCP pool, and we'll call in LAN, hit enter, and we will say the network

that I want to hand out is 192.168.1.0.

One of the few commands that will allow you to say /24,

or you can type in the full subnet mask if you want to.

DNS server will be let's use 4.2.2.2, 4.2.2.3, my two favorite DNS servers.

And then Google coming in at a far side lash,

just because 8.8.8 is just tougher to type on a keyboard.

I have to use two hands.

Or not two hands but it's just the period, the 8, for no other reason it's just weird for me

to type 8.8.8 and I can't even say it.

So default, we want a default router.

We want to give the default router 192.168.1.1 to the clients

on the internal network, and that should be it.

Let's do a quick show run, let me do a section IP DHCP.

And just verify we've got excluded address there.

We've got the LAN subnet

there, DNS server, default router.

That looks good, alright.

One of the things that you'll find is when a Cisco router gets an IP address via DHCP,

if that ISP is assigning it a default gateway,

and it doesn't have a default router already set up,

a lot of times it will accept the DHCP assigned default gateway as its own default route.

Essentially it's going to say, oh okay, well, I don't have a default gateway so I will use you.

And that's nice because it makes it versatile.

You can move your Cisco router wherever and plug it into a connection.

If it's enabled for DHCP it will pick it up

and then start doing what it does best which is router and do net.

So at this point I just want to test and see where we're at.

I'm going to go here and do a ping.

Let's do a ping.

Oh, let's do a show IP interface brief.

We've got 208.92.153.6.

Let's do a show IP route, and I see it's already set up, a nice little gateway

of last resort because it got that via DHCP.

So let's just do a ping 4.2.2.2.

Let's ee if we can reach the DNS server.

Good, and we do.

So this router now has internet access.

Now, my computer happens to be, the one that I'm recording on right now, happens to be this guy.

So actually what I need to do is go into the control panel

because I've got my own connection,

my own network that I save my recordings and everything like that.

I'm going to actually go in and disable that one which will not work well when I finish this

because it's going to say where do you want to save this, and I won't have a place.

Let's get rid of virtual box as well.

It's a little free VM ware kind of thing.

So all that's left is my little apple USB ethernet is after.

That's what I have connected to SLAV network.

So I'll open a comment prompt and do an IP config.

And there it is, look at that.

We've already got a dynamic address assigned from our pool 192.168.1.11.

Let's actually jump back here and line it all up.

Here, I'll scoot this over a little bit.

I'm going to do a show IP DHCP binding which shows what IP addresses have been handed out.

We're going back in time man.

So 192.168.1 -- whoa see, that's what happens when I disconnect my network adapter.

There we go.

So where were we?

Okay, so I've got the 192.168.1.11 that's now assigned.

But let me just see if I can ping from here, 4.2.2.2 even though I've got a default gateway.

The reason for that is because the router it's got an IP address and it can do routing.

It's got a [inaudible] but it's not configured for NAT.

So my feeble attempts to open a web browser will fail

because it will say, sorry, we're not connected.

Let's go to Google.

Let's see if we can get there.

Hold on, secure browsing to Google.

Nope, nothing.

I mean we're just hung.

We're not getting anywhere.

So what we want to do, let's get this browser out of here, is start configuring NAT.

Basic steps.

Number one.

Let me get back to the white board.

Number one we need to identify our interfaces meaning we need to go in there and identify

that this one is connected to the inside of the network like fast ethernet 0/0.

Yeah, this is on the inside of my net.

And fast ethernet at 0/1 that's on the outside of my net.

I need to identify that.

And the good news is it's very simple to do this.

Watch this.

It's going to be logical.

Show IP interface brief.

Have you got the feel that I like this command?

So there's my interfaces.

I'm going to go into fast ethernet 0/0.

IP net inside.

Now, you will find out it's common for it to hang, and don't panic.

Usually when you hang a router like that something bad is

about to happen, crash or something.

But it's just enabling the net process behind the scenes.

It's creating these virtual interfaces that it needs to do NAT.

It's only on the first command.

When I come in here and do fast ethernet at 0/1 IP net outside is the other command,

you can see that goes through right away.

Okay, good.

Step one is done.

Step two is to identify our inside IP addresses.

So we actually need to be able to say this inside of our network is going

to be translated to the outside world.

Now, the way I'm going to do that is I'm going to say essentially anything starting

with 192.168.1.anything/24 is valid to be translated out.

Now, it just so happens that the way that I do that is by using an access list.

You see some of those concepts come wrapping back around.

So here's what I can do.

Let's exist back out.

Now the beauty is for basic NAT configurations I can use just the standard access list.

I go in there and do IP access list, and it's going to be standard.

And we'll call this NAT addresses, how's that?

How about we do this because there's a lot of NAT addresses inside.

That's a long access list name but we'll go with it.

Inside NAT addresses, okay.

And so I will say permit 192.168.1.0 with a wild card mask of 000255.

I can log it if I want but I don't need to.

And that's it.

That's all there is to it.

Because remember I said access list, when we were talking about access lists,

they're not just for access control.

In this case I'm going to use this access list to permit these addresses

and only these addresses to be NAT-ed.

Okay, step three.

We're going to use our IP NAT connection command.

What I mean by that is I'm going to go in and say I want to NAT from this to that.

Now, this command can do a lot of stuff for us.

I'm going to show you the first thing right now.

I'm going to NAT -- so first off the way the syntax works is I type IP NAT,

so I'll translate that into English.

IP NAT means I want a NAT, right?

Now, I hit question mark and it's like an interview.

I want to NAT from the inside of my network out.

This is going to be a source.

Let me identify the source addresses to you.

So I want to NAT from the inside of my network out.

The source addresses that are going to be translated are going to be identified

in access list number -- well actually not number in this case.

What did I name it?

Inside NAT addresses, right, right there.

Highlight copy.

Yeah, let me back up here.

There we go.

IP NAT. Okay, so I want to NAT from the inside of my network out.

The source addresses are going to be identified in access list inside NAT addresses.

So that's the source.

And I'm going to be going to the destination of, and now we have the option.

We can either go to an interface as the destination or a pool of addresses.

So here's the idea.

I can either say I just want to take all of these guys and NAT them out this interface,

or I can create a pool of addresses which is possible,

and I can say maybe 208.53.91.1-9 is going to be the pool of addresses.

So I'm going to NAT all of these guys out to that pool of addresses.

Now, you having that being dynamic NAT, remember we were talking

in the concepts how dynamic NAT does that one-to-one mapping if you will.

But then you'd only have nine people able to get to the internet at the same time.

You don't want that.

So we would usually use PAT in combination with those.

But in this case the reason the interface command is so handy is because I don't need

to know what my outside address is to use that command.

Let me type the command and I'll explain it.

So let me get back here.

Interface fast ethernet 0/1.

I know some of you are like blah, blah, blah.

That's a big command.

It is, it is.

There's a lot to that command.

But let me just read it.

I'll hit the up arrow and go back to the beginning

of the line and read it again in English.

IP NAT, I want a NAT is what that means.

From the inside of my network out the source addresses that I want to NAT are identified

by access list inside NAT addresses.

And what's in there?

192.168.1, right?

We said permit those addresses.

So NAT from that source to the destination of interface, and let me go fast ethernet 0/1 and,

oh, actually I forgot a key word on there.

And I want to add on the key word overload.

Not just L, overload.

So the command just got bigger.

I mean what do you think overload does?

I know you're like, well, it says right there an overloads an address translation.

What's that mean?

Overload enables PAT.

So when I typed the command the first time and press enter it would work,

but it would only work for one IP address.

Whoever got there first would use up the outside address

because it's a one-to-one mapping if I don't have that keyboard.

But I'm putting overload on there.

That's when it says, oh, you want me to use PAT,

so that way I'll translate addressed dynamically using port numbers,

and everybody can share the IP address of whatever is on fast ethernet 0/1.

The beauty of using that command is I can now use this versatilely.

I can move it to whatever internet connection I want, plug it in,

and then whatever IP address is received via DHCP

on that fast ethernet 0/1 will now be used for all of my NAT settings.

I think, I'm hesitating, I think that's everything that we need.

Oh, look at that, it's saying I can't change this, dynamic mappings are already in use.

That's funny.

So let me just do a quick show run, include IP NAT.

I want to make sure that it took that command.

But all we did is identify inside and outside interfaces, create an access list

that said these are the inside addresses, these are the source addresses,

and then we combined them all with this IP NAT connection command.

And so this is the biggest command of all, probably the most confusing.

But, again, it's kind of like an access list.

You're just saying I want a NAT, here's my source, here's my destination,

and in this case we overloaded it.

So I want to test it.

Come on, let's bring up, oh, this was here before, cbtnuggets, right?

I was like that's not cool.

Woo hoo, it worked.

So, anyhow, I want to make sure it's not in cache or something like that.

What's a website I haven't gone to?

Let's do USA Today.

I know I haven't gone there.

USA Today, wow, look at that, Hall of Fame, no one elected.

Bad. So now I can -- okay, the reason I'm doing this and going to a couple websites,

let me just go to one more, let's go to amazon.com.

Get a nice little Amazon splash page up there.

The reason I'm going this is I now want to go in there and do -- let's make this a little bigger,

we'll want it big, do a command to verify.

I'm going to do a show IP NAT translation.

Look at that, yeah.

We've got a massive amount of translations going through.

Remember in the last nugget when I said, yeah,

theoretically you could share one IP address for 65,000 people?

This shows exactly why that theory would never prove true in reality.

Just by going to three websites, count them, three websites, cbtnuggets,

USA Today and amazon.com, literally let's just keep the scrolling going.

Okay, I reached the end.

These were all the translations that were built.

First off, you see all these guys?

These are all DNS translations.

Notice, let's read it here, and this is where I want to get into some of the terminology.

The inside local address is where I'm coming from.

So let me go to this network diagram, change pen colors real quick.

According to the router inside local addresses are those that are inside of the network

like the position they are on your inside network, and they are local.

You can kind of translate that to be a private address kind of in your mind.

Now, some of these terms I will tell you before we even write them all out they are confusing

because they follow the industry standard.

NAT is an RFC standard, and so Cisco said, okay, we'll follow the naming

that they say in there, but it is confusing.

So inside local means it's inside my network, like it's mine,

I own it, and it's a private address.

That's the local.

Now, this one, the public address, is actually identified as the inside global.

Now, that doesn't make sense initially because you're like, well, inside, no it's outside.

Well, it is, but think of the word inside of who owns that address.

You just kind of think of it that way.

Like inside means me, outside means somebody else owns that address.

So when you put it that way it's like okay, okay I own these addresses inside,

and I own this address because it's assigned to my router.

Not literally I own it from my service router,

but I own it because it's assigned to my router so it's inside.

Global essentially means public.

Now, you'll see some other terms here like outside global.

Outside global is essentially the IP address of the outside server.

Outside meaning I don't own it, it belongs to somebody else.

Global meaning it's public.

So when you go to a website that's going to be how they show up in this table.

So notice all of these.

What's port 53?

And notice the protocol, UDP port 53.

Anyone remember?

Raise your hand.

Yes, you?

>> DNS.

>> DNS, yeah, exactly right.

DNS these are all the DNS lookups that were necessary to go to three websites.

Now, again, I want to make sure everybody gets -- you're like this is crazy, why would you need

that many DNS lookups to go to three website?

Remember, again, amazon.com, this picture right here is one server.

This picture is another server.

This picture another server.

This picture another server.

There's so much stuff on this website.

And every time you introduce another server like Discover Card, something new in your city,

or it's not even Discover Card, discover something new in your city,

anytime you go to a new server it's like, oh well,

that ad right there is actually fed from AWS9.amazon.local.

blah, blah, blah.

So your computer has to go, well, who is that?

And go do a DNS lookup just to find out who that's from.

That's why sometimes pages take a while to load because it's grabbing all this information

from all these different servers.

Okay, so back to the configuration.

So outside global says, okay, I access this DNS server on port 53 all kinds of stuff.

And notice all these source port numbers are where it came from.

So let's start putting these pieces together.

Inside local so this is me.

Excuse me, I've got 192.168.1.11.

I generated a DNS request from the source port 53582.

Now, that was translated to the inside global

or essentially the outside public IP address of 208.92.153.6.

Now, who's that?

That's my router, remember?

We actually got assigned that address dynamically.

It was 208.92.153.6.

So that's me.

So what this is saying is I've translated from this to this.

And notice what it did with the port number.

It actually said, okay, I'm going to retain your source port number

and now so that's what you look like to the outside world.

So it went out and talked to this IP address, the outside global.

Now, I know some of you are like, well, what's this?

I don't even want to tell you.

Honestly I don't.

But let me just say this.

That is outside local.

You might say, okay, so outside means it belongs to somebody else, right?

Yup. Local means it's a private address?

Huh? Well, essentially what this means, and trust me my public, private it's just kind

of a rough analogy, but what this means is it belongs to somebody else,

but this is how my network sees it.

I will say for 95, 99, 98 percent of you out there it will always be the same.

Essentially the outside global which is what it really is will be the outside local

which is how your network sees it.

What you can do, let me give you this example, and I really don't want to tell you

because it might confuse some, but I just want to show it to you.

You can do NAT translations the other way.

Here's what I mean.

I could go in here on this router, and I could say, well, I want to create a NAT translation

that when somebody accesses 192.168.1.52 it actually translates to 4.2.2.2.

Weird, right?

It's doable but very strange.

So what you could do is you could make 4.2.2.2, we'll just say this DNS server out here,

appear as 192.168.1.52 to the internal network.

In that case if you did that kind of translation then you would see outside local

at 192.168.1.52, outside global is 4.2.2.2.

So, again, it's kind of like a backwards net.

So if that confuses you forget I ever said it and just say all these will always be the same,

outside local and outside global always the same.

Honestly I've done this once, and it was a whacked out situation

where I couldn't assign a default gateway to this PC.

So I had to be able to get it to an outside server, it wasn't even a DNS server,

but an outside server without a default gateway.

And the way I did it was by saying, okay, I'm going to set up a NAT

so this guy will arp [phonetic] for this,

and it will actually translate out to the public address.

So that will be where it actually looks for that server.

So, again, weird situation, forget I ever said it.

Okay. So all of this -- now let me hit the up arrow, do a show IP NAT translations.

Look at that, look at that, that's it right there.

They're all gone.

So all of these initial translations, [rotating sound],

all of those [rotating sound] all the way down have now consolidated down to this.

Why? Because the sessions have begun to close.

When I did my DNS lookups they show up in th table but they quickly go under way,

because I know -- I'm sure many of you are like, well good grief, if one computer going

to three websites can consume that many port numbers, I mean look at all that,

can consume that many port numbers, I mean it's not going

to be long before one public IP address runs out of port numbers, right?

Well, yeah, but the good news is they time out very quickly.

After they're used they stay there for a few seconds longer and then, shoop, they're gone.

So now, just because I have my web browser open, I still see these that are established,

but for the most part they've all closed down and consolidated down to a smaller amount.

Okay, so we have the NAT overload or PAT version of NAT working.

What if, let's change it a little.

I just gave you a scenario that works very well.

That whole config that we just did works very well for

small office or home office environments.

But what if I do have static IP addresses here?

What if I'm a real business and maybe I have even a pool of addresses available to me.

What about that situation?

Well, in that circumstances you want to squeeze in one more command between two and three,

and that will create a pool of outside addresses.

Here's what I mean.

I can go into the router, and let's first off do a show run, include IP NAT.

And we want to remove the existing configuration.

So I'm going to say I just want to yank this one out.

I'm going to get rid of that command in there.

And it says, hey, you've still got dynamic mapping, are you sure?

Yeah, sure, that's fine.

So I've got the dynamic mapping or I should say mappings deleted.

That just means all of the, oop, now I've done it, cleared it off.

Off of these previous mappings these were all dynamic, those are all wiped out now

because I deleted the command so I've removed that.

And now what I can do is create a pool.

So I'll say IP NAT pool, and I'll say, okay,

the pool of addresses let's just say this is my outside public addresses.

And I would say the start IP address, and that's why I'd come back here,

let's just say we started from 208.92.153.5, 208.92.153.5,

and we go through 208.92.153.6, right?

So we've got the start and the end.

If we need to add what subnet mask is there for that subnet we'll say net mask 255.255.255.248,

that's just what the service provider has given us and hit enter.

So now I've created this pool of addresses that we call outside public.

It's not doing anything yet, it's just there until I do IP NAT inside source.

And I'll say this time, again, the same command as before.

This is the same exact one I just removed.

Inside source.

So I'm going to map from the inside of my network out.

The source addresses are in access list number 5, that's the one we created before.

And instead of going out the interfaces, that was the previous command,

I'm going to go to the pool of address that is defined as outside public.

So I'm going to say the outside public pool of addresses,

and then I'm going to add on overload.

Otherwise, now I have more IP addresses, I have 2, 5 and 6 right there that I can use.

But I'm going to overload them so I'm going to max this one out.

And once this 5 runs out of port numbers then I'm going to go over to 6 and max that one out.

So as we start growing and we start requiring more public IP addresses

that we can overload and share we can do that.

So that would be -- now, this is still PAT.

But if you wanted to do that as dynamic you would just leave overload off.

Remember dynamic NAT, doing the dynamic one-to-one mappings.

But then you would only get two people able to surf the internet at a time

because they would eat up the outside addresses since we only created a pool of two.

Now, what if you only had one address?

Like same story as before, but instead of being a DHCP it's static

and we only have one static address.

Well, easy enough, you would do the same thing but create a pool of just one address.

Just say we're going out at .5.

You can see it starts at .5 and ends at .5.

So we create an outside pool of one address, that's fine, and then we go in and overload it.

Now, we don't have to redo this command.

Let me just do a quick show run include IP NAT.

We don't need to redo the command.

We can change kind of pieces of that command out.

Like I can change out this pool, and I don't have to redo that IP NAT inside source command.

So that's a way to do it if you have a static IP address on the outside.

Okay. The last one what about doing a static translation?

So we've seen remember the three modes of NAT, we have static,

we had dynamic which is dynamically doing a bunch of -- you get it, dynamic, right?

Hard to talk.

And then we had PAT.

So we've done PAT.

We've even done dynamic which you saw the config just now,

we would just leave off the overload command.

And then now static.

What if we have servers running on that inside network that I want

to allow access to from the outside?

That's where you need static NAT mappings.

The way we do this is go into global and type in IP NAT, again inside source.

So if you get used to this, I mean it's the same commands over and over and over.

It always starts IP NAT inside source, and then we either say I want to go to an access list

or see what I see, right, static.

And now we can do it the simple way.

I can say, okay, the inside local IP address is 192.168.1.51.

We'll say that's our email server, right?

Then it's going to say, okay, what's the inside global?

Remember the terms I talked about, inside local,

so they're saying inside global where was that on our picture?

That was the public IP address that belongs to us that goes to the interface right there.

So it says, okay, this inside local or private IP address is going to translate to,

and that's where I would type in 208.53.

What was it?

208. I don't even remember.

Oh, okay, I was trying to figure out what that was.

208.92.153.

let's just say 7, alright, and hit the enter key.

That's one way of doing it.

That's the simplest way.

So that says any time somebody accesses this IP address on the outside I will translate it

to this IP address on the inside and vice versa.

I will take this IP address when I see it on the inside and translate it

to that IP address on the outside.

This is actually a two way street, a two way translation.

A lot of people say, okay, well now do we have to create a second one that says 208.92 is here

and 192.168 is here to kind of do both ways?

No. This is a two way street.

So as this one goes out you will always be that 208.92.153.5 address that I just defined.

And as people come in on that -- you get the point, right?

I'm like I could fumble over my words or you got it, right.

So, another way I can do this.

I could do IP NAT inside sources, and you saw this when I first typed it, so I'll do static.

I could type the inside local IP address, but I can also specify TCP or UDP.

So this would be useful if I want to break this into multiple port numbers.

So let me show you.

Let's say I want to do TCP, and I'll say the inside local address, 192.168.1.

let's say 53, but it's going to be on port 80.

This is a web server.

And I will go on the outside that really goes to 208.92.153.8 on the outside on port 80 as well.

So what this does is say now if I get -- I'm running out of space to scribble.

Let's use orange.

If I get a request on the outside and it's directed to 208.92.153.8 on port 80 and only

on port 80, it won't work for any other port right now, then I will send it to the inside

of my network to the mysterious server that showed up that is 192.168.1.

what did I say, 53?

Yeah, 53 on port 80, alright?

So I could hit the up arrow.

Let's say this is where I can split this one IP address to multiple destinations.

I could say, well, maybe if they do 21 which is FTP I'll send it in on port 21, 192.168.1.67.

That's an FTP server on my network.

Early on, this is long before go to my PC and log me in and all these things

that let you access your computer from home, long before that I actually had a router set

up at my house, let's get that orange color off of there, router set up at my house

that was connected to an ISP, and I would use Microsoft Remote Desktop.

It's been around for a long time.

And Microsoft Remote Desktop uses TCP port 3389.

And I had actually a bunch of computers inside of my house

that I would access when I'm the road.

If I'm traveling or if I'm at the office or something like that I could actually sit

out here and use Microsoft Remote Desktop.

You know what I mean when I'm talking about Remote Desktop, right?

You go to all programs.

Of course, you can't see it.

How about you just do start run, you actually type in MSTSC.

And that will bring up a remote desktop connection to where I can type in I want to go

to this computer home.jeremy or whatever the computer is.

And I can open a remote screen.

So I would sit out here and remote to my computer because I would map port 3389

into my main PC which was actually 172.30.1.50 was my main PC IP address.

But the problem is now I've eaten up that port number 3389.

On the outside it's eaten up.

So I wanted to remote desktop to these guys as well.

What I would do is I would play this game.

I would say, okay, well I want to actually map 3389 to let's just say 1.67.3389,

and then I would say I want to actually map 3390 to the inside,

let's just say this is the second IP address right there.

Let me get that all on the screen.

It's not quite fitting.

But you see what I'm doing here.

I would say 3390

on the outside actually translates to 3389 on the inside.

Now, whenever I would be somewhere I would say I want to go to jeremy.home.com

or whatever my domain -- I actually use the dynamic DNS service and all that.

And if I wanted to connect to my main computer I would just hit enter and connect.

If I wanted to connect to a secondary computer I would put colon 3390.

You can do that, and it will say okay, well, I'll use port 3390 which now hits this

and translates to a completely different computer.

And then I did the same thing for the third computer, 3391, and I would come over here

and map 3391 to whatever, 192.168.1.5 on 3389.

And that would work out perfectly well.

So it's saying if it receive it on this port

on the outside I'll actually translate it to this port on the side.

So there's a lot of cool stuff that you can do.

You can either statically translate the whole IP address in and out,

or you can statically translate port numbers and even change port numbers

when you're translating in and out.

Okay, so we have now seen the three flavors or NAT.

This was my only slide for this because we're so into the live configuration.

Obviously with all the scribbles on the screen you can see it builds on itself.

But we've seen configuring PAT, sending it to go out to a specific interface

or to a specific pool of addresses.

Configuring dynamic NAT from one pool of addresses to another.

And then we saw it configuring static mappings from either a whole IP address

or individual ports on an IP address into different servers.

So by the time you're done now you should be able to go out and configure NAT for just

about any environment that you can encounter.

I wasn't hiding anything.

You've now seen all the flavors of NAT that exist.

I hope this has been informative for you, and I'd like to thank you for viewing.