CCNA 200-301 Chapter 4 IP Services Lab 039 Configure and Verify Dynamic NAT

Watch Full Demo on YouTube:

Lab Objective:

In this lab, we will configure and verify Dynamic NAT (Network Address Translation) on a router. Dynamic NAT is a method used to translate private IP addresses to a pool of public IP addresses dynamically.
Unlike Static NAT, which has a one-to-one mapping between a private and a public IP address, Dynamic NAT allows multiple private IP addresses to be translated to a pool of public addresses. This is commonly used when there are fewer public IP addresses than internal devices requiring access to external networks.

The purpose of this lab is to help you understand how Dynamic NAT works, configure it, and verify that the configuration is working correctly.
By the end of the lab, you will have a solid understanding of how to set up Dynamic NAT and troubleshoot common issues.

By the end of this lab, you will be able to:

• Configure Dynamic NAT on Router1 (R1) using a pool of public IP addresses.
• Verify that Dynamic NAT is working by testing connectivity from internal hosts to external networks.
• Understand and analyze the NAT translations using verification commands.
• Troubleshoot common issues related to Dynamic NAT and ensure the correct operation of the configuration.

Lab Topology:

Equipment Required:

• 2 x Cisco Router (e.g., Cisco ISR4331/K9)
• 1 x Cisco Switch (e.g. Catalyst 3750)
• 4 x Laptops with Ethernet Interface Card
• 1 x Server with Ethernet interface
• Console Cable
• Ethernet Cable for connections between devices
• Computer with Terminal emulation software e.g. PuTTY

IPv4 Address Table:

A. IPv4 Address Table:

Device Name	Interface ID	IP Address	Subnet-Mask
R1	Gig0/0/1	10.0.0.254	255.255.255.0
R1	Gig0/0/0	203.0.113.1	255.255.255.248

B. Hosts IP Address Table:

Device Name	Interface ID	IPv4 Address/Subnet-Mask	Default Gateway
PC1	Fa0	10.0.0.10/24	10.0.0.254
PC2	Fa0	10.0.0.20/24	10.0.0.254
PC3	Fa0	10.0.0.30/24	10.0.0.254
IEE-Server	Fa0	10.0.0.100/24	10.0.0.254
Internet Host	Fa0	198.51.100.0/30	198.51.100.2

List of Command Summary:

Command	Command Description
enable	enters privileged EXEC mode.
configure terminal	enters global configuration mode from privileged EXEC mode.
hostname [hostname]	assign a device name to router.
show interfaces status	provides a summary of the current status of all interfaces on a Cisco switch. This command displays important information about each interface, including: Port: The interface identifier (e.g., Gi1/0/1). Name: The name or description assigned to the interface, if any. Status: The operational status of the interface (e.g., connected, notconnect, err-disabled). Vlan: The VLAN that the interface is assigned to. Duplex: The duplex mode of the interface (e.g., full, half, auto). Speed: The speed of the interface (e.g., 10, 100, 1000 Mbps, auto). Type: The type of interface (e.g., 10/100/1000BaseTX, SFP). This command is useful for quickly assessing the operational state and configuration details of all interfaces on the switch.
ip route [Destination prefix] [Destination prefix mask] [Forwarding router’s address]	used in Cisco IOS configuration mode on routers and Layer 3 switches to manually configure static routes. Command Description: • Command: ip route [Destination prefix] [Destination prefix mask] [Forwarding router’s address] • Purpose: This command configures a static route on the device, specifying how to reach a specific destination network or host. • Usage: Used to define a route for traffic destined to a particular IP network or subnet. • Parameters: o [Destination prefix]: Specifies the destination network or host IP address in IPv4 format (e.g., 192.168.1.0). o [Destination prefix mask]: Specifies the subnet mask for the destination network (e.g., 255.255.255.0). o [Forwarding router’s address]: Specifies the next-hop IP address where packets should be forwarded to reach the destination network.
ip nat inside	used on a Cisco router to specify that an interface is part of the inside network for Network Address Translation (NAT). It designates the interface connected to the internal or private network, where private IP addresses are used. For example: interface GigabitEthernet0/1  ip nat outside This command is applied under an interface configuration mode, indicating that the traffic entering or exiting through this interface will be considered as coming from or going to the outside network for NAT purposes. It is typically paired with ip nat inside on the internal interface to properly configure NAT
ip nat outside	used on a Cisco router to specify that an interface is part of the outside network for Network Address Translation (NAT). It designates the interface that connects to the external network, such as the Internet, where the translated (public) IP addresses will be used. For example: interface GigabitEthernet0/1  ip nat outside This command is applied under an interface configuration mode, indicating that the traffic entering or exiting through this interface will be considered as coming from or going to the outside network for NAT purposes. It is typically paired with ip nat inside on the internal interface to properly configure NAT
ip nat inside source static 10.0.0.100 203.0.113.3	used in Cisco routers to create a static Network Address Translation (NAT) entry. In a scenario where a web server located on the internal network has a private IP address (10.0.0.100), using this command allows users on the Internet to access the web server by its public IP address (203.0.113.3). Any incoming traffic to 203.0.113.3 will be translated to the local IP address (10.0.0.100), allowing communication between the internal device and external clients
show ip nat statistics	used on Cisco routers to display information about the Network Address Translation (NAT) configuration and its current operational statistics
show ip access-lists [ACL ID]	displays details of the specified Access Control List (ACL) on the device. It includes information about each ACL entry (ACE), such as permitted or denied conditions, protocol, source and destination IPs, port numbers, and hit counts (number of matches) for each ACE. This command is useful for verifying and troubleshooting ACL configurations and understanding how traffic is being filtered.
ip nat pool [Pool name] [Start IP address] [End IP address] netmask [Network mask]	The command ip nat pool [Pool name] [Start IP address] [End IP address] netmask [Network mask] defines a pool of public IP addresses to be used for Network Address Translation (NAT). Here’s a breakdown: Pool name: Assigns a name to the NAT pool. Start IP address: Specifies the starting IP address of the pool. End IP address: Specifies the ending IP address of the pool. Netmask: Defines the subnet mask for the pool of addresses. This pool can then be used in NAT configurations (e.g., dynamic NAT or PAT) to map private IP addresses to the available public IPs in the pool. This is particularly useful when multiple internal hosts need to share a smaller range of external IPs for outbound connections.
ip nat inside source list [Access list number for local addresses] pool [Name pool of global addresses]	The command configures dynamic NAT by translating private IP addresses (inside local) to a pool of public IP addresses (inside global). Here’s how it works: Access list number: Identifies the access list containing private IP addresses that need translation. Pool name: Specifies the NAT pool name that contains the public IP addresses to which private addresses will be mapped. With this configuration, whenever a host with an IP that matches the access list makes an outbound connection, NAT dynamically assigns an IP from the pool for the duration of the session. This allows multiple private addresses to share a smaller set of public IP addresses.
ip nat inside source static [Inside local IP address] [Inside global IP address]	used to configure Static NAT on a router. Here’s a brief breakdown of its components: Inside local IP address: The private IP address of the internal host (e.g., 10.0.0.10) that needs to be accessible from the outside network. Inside global IP address: The public IP address (e.g., 203.0.113.3) that will be used by external devices to reach the internal host. This command creates a one-to-one mapping between the specified private IP address and a specific public IP address. This is useful when a particular device (like a server) inside the network needs to be reachable from the outside, as the public IP address remains constant.
show ip nat tranlations	used on Cisco routers to display the current Network Address Translation (NAT) translations. It provides a detailed view of how IP addresses are mapped from the inside (private) network to the outside (public) network and vice versa.
clear ip nat translation	used on Cisco routers to remove existing Network Address Translation (NAT) mappings from the NAT table. This can be useful for troubleshooting or when you want to reset the NAT translations for various reasons
ping [ip-address] -n 100	used to send a series of Internet Control Message Protocol (ICMP) Echo Request packets to a specified IP address, with the option to specify the number of packets to send.
description “DESCRIPTION OF SOME SORT”	used to assign a descriptive text label to a network interface on a device such as a router or switch. This description helps administrators to identify the purpose or details of the interface more easily when managing and troubleshooting the network.
show ip interface brief | include lan	used on Cisco devices to display a summarized list of all IP interfaces configured on the device and filter the output to only show interfaces that contain the keyword “lan” in their configuration. This command is helpful for quickly identifying and troubleshooting interfaces related to LAN (Local Area Network) configurations within the device’s network environment
ipconfig /all	used in Windows operating systems to display detailed information about all network interfaces and their configurations.
no shutdown	enables an interface.
show running-config	save the running configuration to the startup-configuration file.
show running-config | section interface GigabitEthernet0/*	used to display the configuration details of a specific GigabitEthernet interface (interface GigabitEthernet0/) within the running configuration of a Cisco device. This command allows you to view the configuration settings related to the specified interface only, filtering out other configuration sections. It provides a focused view of the configuration parameters associated with the specified interface, including its IP address, VLAN membership, trunking settings, and any other relevant configuration details. The asterisk (*) is a wildcard character that matches any character or sequence of characters. In this context, it is used to match any subinterface under GigabitEthernet0.
show running-config | section interface FastEthernet0/1$	The “show running-config | section interface FastEthernet0/1$” command is similar to the previous one, but it focuses specifically on the FastEthernet0/1 interface. The “$” symbol at the end of the interface name indicates that the command will match only the interface that ends with “FastEthernet0/1”. This command is helpful when you want to view the configuration details of a specific FastEthernet interface without displaying configurations for other interfaces.
copy running-config startup-config	used to save the currently running configuration (stored in the RAM) to the startup configuration (stored in the NVRAM)
end	exit configuration mode.
exit	exits one level in the menu structure command.

Lab Task:

1. Configure IP Address on R1:
   1. Configure interfaces Gig0/0/0 and Gig0/0/1 with the appropriate IPv4 addresses. Include an interface description and enable the interfaces.
   2. Perform pre-checks.
2. On R1, configure a default route with the next-hop address set to the ISP IP address 203.0.113.2.
3. Initiate a ping request from Internet Host PC to IEE-Server, is the ping successful?
4. Specify which interfaces will participate in NAT:
   1. Designate interface Gig0/0/1 as a NAT inside interface. Execute the appropriate command to accomplish this.
   2. Designate interface Gig0/0/0 as a NAT outside interface. Execute the appropriate command to accomplish this.
   3. Perform post-checks.
5. Configure Static NAT:
   1. Configure a static NAT mapping for the IEE-Server, mapping 10.0.0.100 to 203.0.113.3.
   2. Perform post-checks.
6. Configure Dynamic NAT Pool:
   1. Configure/define a standard access list and permit the LAN network from R1, please use this access list id 10
   2. Create a dynamic NAT pool with this name “INTERNET” and use the following public IPs
      1. 203.0.113.4
      2. 203.0.113.5
      3. 203.0.113.6
   3. Bind the local network (defined by access list 10) with the NAT pool you just created
   4. Perform post-checks.
7. Connectivity Test:
   1. From the Internet Host PC, try to access https://203.0.113.3 and http://203.0.113.3. You should be able to see the IEE web page. If not, troubleshoot the issue.
   2. On R1 and issue the command to view the NAT translation. Examine and observe the output.
   3. Initiate a ping from PC1 to the Internet Host PC, is the ping successful? If not then troubleshoot the issue and try again.
   4. Now, return to R1 and look at the NAT translation output again once you executed the appropriate command.
   5. From the Internet Host PC try and ping PC1, PC2 and PC3, is the ping successful?
   6. Now initiate a ping from the Internet Host PC to IEE-Server Server, is the ping successful?
8. Save your configurations.

Lab Solution:

1- Configure IP Address on R1:
a. Configure interfaces Gig0/0/0 and Gig0/0/1 with the appropriate IPv4 addresses. Include an interface description and enable the interfaces.

R1:
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#interface GigabitEthernet0/0/0
R1(config-if)#description “Link to ISP”
R1(config-if)#ip address 203.0.113.1 255.255.255.248
R1(config-if)#no shutdown
R1(config-if)#exit

R1(config)#interface gigabitEthernet 0/0/1
R1(config-if)#description “Link to SW1”
R1(config-if)#ip address 10.0.0.254 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#end
R1#

b. Perform pre-checks.

2- On R1, configure a default route with the next-hop address set to the ISP IP address 203.0.113.2.

R1:
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#ip route 0.0.0.0 0.0.0.0 203.0.113.2
R1(config)#end
R1#

3- Initiate a ping request from Internet Host PC to IEE-Server, is the ping successful?

The ping has failed because the public IP address has not yet been assigned to a host.

4- Specify which interfaces will participate in NAT:
a. Designate interface Gig0/0/1 as a NAT inside interface. Execute the appropriate command to accomplish this.

R1:
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#interface GigabitEthernet0/0/1
R1(config-if)#ip nat inside
R1(config-if)#end
R1#

b. Designate interface Gig0/0/0 as a NAT outside interface. Execute the appropriate command to accomplish this.

R1#configure ter
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#interface GigabitEthernet0/0/0
R1(config-if)#ip nat outside
R1(config-if)#end
R1#

c. Perform post-checks.

The ping has failed because the public IP address has not yet been assigned to a host.

4- Specify which interfaces will participate in NAT:
a. Designate interface Gig0/0/1 as a NAT inside interface. Execute the appropriate command to accomplish this.

R1:
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#interface GigabitEthernet0/0/1
R1(config-if)#ip nat inside
R1(config-if)#end
R1#

b. Designate interface Gig0/0/0 as a NAT outside interface. Execute the appropriate command to accomplish this.

R1#configure ter
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#interface GigabitEthernet0/0/0
R1(config-if)#ip nat outside
R1(config-if)#end
R1#

c. Perform post-checks.

5- Configure Static NAT:
a. Configure a static NAT mapping for the IEE-Server, mapping 10.0.0.100 to 203.0.113.3.

R1:
R1#configure terminal
R1(config)#ip nat inside source static 10.0.0.100 203.0.113.3
R1(config)#end
R1#

b. Perform post-checks.

This time we can see that there are a couple of Static NAT being configured are ready for NAT translation

6- Configure Dynamic NAT Pool:
a. Configure/define a standard access list and permit the LAN network from R1, please use this access list id 10

R1#configure terminal
R1(config)#access-list 10 permit 10.0.0.0 0.0.0.255
R1(config)#end
R1#

b. Create a dynamic NAT pool with this name “INTERNET” and use the following public IPs
1) 203.0.113.4
2) 203.0.113.5
3) 203.0.113.6

R1#configure terminal
R1(config)#ip nat pool INTERNET 203.0.113.4 203.0.113.6 netmask 255.255.255.248
R1(config)#end
R1#

c. Bind the local network (defined by access list 10) with the NAT pool you just created

R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#ip nat inside source list 10 pool INTERNET
R1(config)#end
R1#

d. Perform post-checks.

7- Connectivity Test:
a. From the Internet Host PC, try to access https://203.0.113.3 and http://203.0.113.3. You should be able to see the IEE web page. If not, troubleshoot the issue.

We are able to access the site via both protocols HTTP and HTTPS:

b. On R1 and issue the command to view the NAT translation. Examine and observe the output.

c. Initiate a ping from PC1 to the Internet Host PC, is the ping successful? If not then troubleshoot the issue and try again.

The ping is successful as shown above

d. Now, return to R1 and look at the NAT translation output again once you executed the appropriate command.

The output from the show ip nat translations command displays the current NAT (Network Address Translation) table on router R1. Each row represents a translation entry for connections between internal and external devices. Let’s break down each column and row:

• Columns Explained:
  • Pro: The protocol in use (e.g., ICMP, TCP).
  • Inside global: The public IP address (and port) that represents the internal device on the internet.
  • Inside local: The private IP address (and port) of the internal device within the local network.
  • Outside local and Outside global: These both represent the external device’s IP address (and port). In this case, they are often the same, as the external device’s IP usually doesn’t change.
• Rows Explained:
  • ICMP 203.0.113.4:10 10.0.0.10:10 198.51.100.1:10 198.51.100.1:10:
    • An ICMP connection is mapped from 10.0.0.10 (internal address) to 198.51.100.1 (external address).
    • The ICMP request is originating from 10.0.0.10 and using the IP 203.0.113.4 when visible on the public network.
  • — 203.0.113.3 10.0.0.100 — —:
    • This entry is a static NAT mapping without any active session traffic.
    • The internal address 10.0.0.100 is mapped to 203.0.113.3 on the outside.
  • TCP 203.0.113.3:443 10.0.0.100:443 198.51.100.1:1037 198.51.100.1:1037:
    • A TCP session is mapped from 10.0.0.100 on port 443 (usually HTTPS) to 198.51.100.1.
    • The public IP 203.0.113.3 is used to represent 10.0.0.100 externally.
  • TCP 203.0.113.3:80 10.0.0.100:80 198.51.100.1:1036 198.51.100.1:1036:
    • A TCP session is mapped from 10.0.0.100 on port 80 (typically HTTP) to 198.51.100.1.
    • The same public IP 203.0.113.3 is used to represent the internal server 10.0.0.100 on port 80 for this connection.

e. From the Internet Host PC try and ping PC1, PC2 and PC3, is the ping successful?

In Dynamic NAT, the private IP addresses are translated to public IP addresses dynamically only when an internal host initiates traffic toward the outside network. This means that Dynamic NAT creates translation entries temporarily and only on an as-needed basis, triggered by outbound traffic. Here’s why this setup prevents an outside host from initiating a ping to the public IP address:

1. No Pre-existing Translation Entry: Dynamic NAT doesn’t reserve or permanently map a public IP to an internal host. Instead, it assigns a public IP address from a pool only when the internal host initiates communication with the outside. If no internal traffic has started, the router doesn’t create a NAT translation entry, so the outside host has no valid destination to reach.
2. Lack of Bidirectional Flow: Because Dynamic NAT is designed primarily for outbound traffic, it doesn’t allow unsolicited inbound connections from outside hosts to the dynamically assigned public IP. This is unlike static NAT, where a permanent one-to-one mapping is created, making the internal device consistently accessible via its public IP.
3. Security Measures: This design inherently enhances security by preventing external devices from accessing internal resources unless the internal host has first initiated communication. Without this safeguard, dynamic IP addresses would create vulnerabilities, as external entities could potentially access internal systems.
4. ICMP and Connection Tracking: For protocols like ICMP (used by ping), NAT would need an active session to translate responses correctly. In Dynamic NAT, ICMP replies can only return to the internal host if it first initiated the ping. Without an initial outbound request, there’s no translation entry for the response to find its way to the internal network.

f. Now initiate a ping from the Internet Host PC to IEE-Server Server, is the ping successful?

8- Save your configurations.

Troubleshooting steps:

1. Verify the Configuration:
   • Check the NAT Rules: Make sure that the static NAT rules are correctly configured on the router/firewall. Verify the internal (private) IP and external (public) IP mappings.
     • For example, on a Cisco router, use:
       show run | include ip nat
     • This command shows the NAT configurations, allowing you to confirm that the mappings are correct.
     • Check Interface Configurations: Ensure that the interfaces are designated as inside and outside correctly. On Cisco devices, use:
       • show ip nat statistics
       • This will display the number of active translations and which interfaces are involved in NAT.
     • Verify the ACLs (Access Control Lists): If access lists are applied to filter traffic, make sure they are not blocking NAT traffic.
2. Test Connectivity
   • Ping Tests:
     • Ping the public IP address from an external device (e.g., an Internet Host) to ensure that the traffic reaches the device.
     • Ping the internal (private) IP from the router/firewall to confirm that the device is reachable internally.
     • Use traceroute to check the path the packets take to reach the internal or external destination.
   • Use Diagnostic Commands:
     • On Cisco routers, use the following command to check real-time translations:
       • debug ip nat
     • This command will show you how NAT translations are applied to traffic in real-time, helping you to see if the packets are being translated correctly.
     • To stop debugging, use:
       • undebug all
3. Check NAT Translations
   • View Active Translations:
     • On Cisco routers, use:
       • show ip nat translations
     • This command shows the NAT translation table. Verify if the translations for the static mappings are appearing as expected. You should see a mapping between the internal and external IP addresses.
   • Check for Overlapping NAT Rules:
     • Ensure that there are no overlapping NAT rules that might be causing conflicts with the static NAT configuration.
     • If dynamic NAT or PAT (Port Address Translation) is also configured, make sure they don’t conflict with the static NAT mappings.
4. Check for Routing Issues
   • Verify Routing Table:
     • Make sure that the router has the correct routes to the internal network where the NAT destination resides.
     • On a Cisco router, use:
       • show ip route
     • Ensure that the route to the internal network is correct and not pointing to an incorrect next-hop.
   • Check Gateway Settings: Ensure that the internal devices (e.g., servers) have their default gateway set to the internal IP address of the NAT device (router/firewall). This is crucial for ensuring that responses are routed back correctly.
5. Check Firewall or Security Settings
   • Firewall Rules: If there is a firewall between the internal network and the NAT device, make sure that it allows the traffic between the devices.
   • Security Policies: Check if there are any security policies on the NAT device that might be blocking the traffic (e.g., access rules or firewall settings on a FortiGate).
6. Test Application Connectivity
   • If the NAT rule is for a specific service (e.g., HTTP/HTTPS), ensure that the application is running correctly on the internal server.
   • Check Application Logs: Look at the web server logs to see if the incoming connection attempts are reaching the server. This can help identify if the NAT device is forwarding the traffic but the application is failing to respond.
7. Use Packet Capture/Logging
   • Packet Capture on NAT Device:
     • If the above steps do not reveal the issue, you may need to capture packets on the router/firewall to analyze traffic.
     • This helps you verify if the packets are arriving at the NAT device and whether they are being translated and sent to the correct destination.
     • For example, on a Cisco device, you can use:
       • monitor capture
     • On FortiGate devices, you can use:
       • diagnose sniffer packet any ‘host 203.0.113.3’ 4
     • Replace 203.0.113.3 with the public IP you’re testing.
8. Clear NAT Translations
   • In some cases, clearing NAT translations can help resolve stale or incorrect entries.
     clear ip nat translation *
   • After clearing, try generating new traffic from the internal network to see if the NAT translations are recreated correctly.
9. Verify Inside and Outside Interfaces
   • Check that interfaces are correctly designated as inside and outside for NAT. Incorrect interface configurations prevent NAT from translating traffic properly.
     show ip nat statistics
     show ip interface brief
   • Confirm that the ip nat inside and ip nat outside configurations are applied to the appropriate interfaces.
10. Confirm NAT Pool Availability
    • For Dynamic NAT to function, there must be available IP addresses in the NAT pool.
    • If all addresses in the NAT pool are in use, additional connections will fail. Adjust the pool size if needed.
11. Common Issues and Solutions
    • Issue: NAT is Not Translating Traffic
      • Solution: Verify that the NAT rule is properly applied, check the ACLs and interface configurations, and confirm that the correct interfaces are designated as inside and outside.
    • Issue: Traffic Reaches the NAT Device but Does Not Reach the Internal Server
      • Solution: Check the internal routing, ensure the server has the correct gateway, and verify any firewall settings between the NAT device and the internal network.
    • Issue: Connections Time Out When Accessing the Public IP
      • Solution: Verify that the server is listening on the correct port and that the service is running. Ensure the NAT rule is correctly forwarding traffic to the right internal IP and port.

Conclusion:

In this lab, we successfully configured and verified Dynamic NAT on R1, allowing internal hosts PC1 and PC2 to access external networks using a pool of public IP addresses. We tested the configuration using ping commands, verified the translations using “show ip nat translations”, and reviewed NAT statistics.

Additionally, we explored troubleshooting techniques to resolve common issues with Dynamic NAT configurations, including checking access lists and using debug commands.

This lab provided a hands-on understanding of how Dynamic NAT operates, its configuration, and verification. With Dynamic NAT, we are able to efficiently use a limited number of public IP addresses while maintaining internal network privacy and enabling secure external communication.

Packet Tracer Lab (Pre/Post configuration):

Download the file below and open the word document to access the Packet Tracer labs.