Network Address Translation
Network address translation (NAT) is a service or function that translating one or many IP to Single or Pool IP Addresses. The usefulness of this feature enabling private IP to be accessing the Internet, because the source Private IP can be translated into Public IP. The Router that perform this function usually occur at the edge private network to public or Internet network. By using this feature the organization can saving the utilization of IP Public. Because of NAT enable one single IP to be share by multiple host using port address translation (PAT).
NAT is a networking feature but enabling security function as well. By default, outside public IP cannot communicate to an internal private. So, NAT separate public and private networks. In terms of IPv6 transition, NAT also can help support in the coexistence and transition. Allowing IPV6 device to communicate with IPV4 device and vice versa using NAT. This translation is using NAT64 translation.
the large scale NAT implementation is Carrier-Grade Network Address Translation or CGNAT. Service Provide and large scale companies using CGN for providing internet access to customers. Service provide may also using a NAT 444 architecture as strategy to manage IPv4 supply. Using NAT 444 customers connections to Internet can pass through three different IPv4 domain, customers private network, service provide private network, and the public Internet.
The first step in configuring NAT in Cisco router is by defining the inside and outside interface. Inside nat means the interface that facing the local network. The outside nat means the interface that facing public or internet network. The configuration is done by adding ip nat inside or ip nat outside under specific interface that facing to local or interface the facing to public internet network.
The sample configuration Network Address Translation follow this network toplogy
Defining the nat inside and outside interfaces.
interface GigabitEthernet0/0/0
description To_Internet
ip address 192.168.146.62 255.255.255.252
ip nat outside
negotiation auto
end
interface GigabitEthernet0/0/1
description To_LAN
ip address 172.21.10.240 255.255.255.0
ip nat inside
negotiation auto
end
Creating access list as the source of IP
access-list 10 permit 172.21.10.0 0.0.0.255
The configuration above defining the IP Address 172.21.10.0 with wildcard Mask 0.0.0.255 that means the IP Address that belong to 172.21.10/24 will hit the access-list 10. for the easiness of using wildcard mask you can use this website
Creating NAT Configuration
ip nat pool PUBLIC 192.168.136.241 192.168.136.246 netmask 255.255.255.248
ip nat inside source list 10 pool PUBLIC overload
The configuration above creating the NAT Pool PUBLIC that consist of 192.168.136/29. This IP addresses as Outside NAT address translation that communicating with public internet network. The NAT Inside is based on access list number 10, will using IP 192.168.136/29 as Pool. the Overload configuration means to activate PAT function.
Verify NAT Function
In order to verify the NAT working properly, use command as show ip nat translation. This command will show the output the translation IP and Source Port, IP and Destination Port. Beside that command just do the PING to verify the connectivity.
Router#ping 88.8.88.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 88.8.88.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 5/84/389 ms
Router#show ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp 192.168.136.241:10 172.21.10.15:10 88.8.88.8:10 88.8.88.8:10
icmp 192.168.136.241:11 172.21.10.15:11 88.8.88.8:11 88.8.88.8:11
Total number of translations: 2
The show ip nat translations tell the source IP Address which is 172.21.10.15 initiate ICMP or ping packet using port 10 to Destionation 88.8.88.8. The source IP then translated into 192.168.136.241 port 10 in order to reach the destination IP, which is 88.8.88.8.