WEBVTT

1
00:00.000 --> 00:03.870
So if you've done the lab and you are ready for a walk through of those lab

2
00:03.870 --> 00:05.600
tasks and confirmation of those tasks,

3
00:05.600 --> 00:08.360
this is the video for you because that's what we're going to do right now.

4
00:08.360 --> 00:11.200
So with these lab tasks in mind, let's get to work.

5
00:11.200 --> 00:14.850
So just as it heads up, I have reset the lab back to its base initial

6
00:14.850 --> 00:15.840
configuration.

7
00:15.840 --> 00:18.960
So let's open up the lab topology here on the desktop of the lab.

8
00:18.960 --> 00:23.620
Fantastic. And let's go ahead and go into server one nug by selecting it and

9
00:23.620 --> 00:24.640
then double clicking on it.

10
00:24.640 --> 00:27.840
Give that a moment to initialize and then we'll begin our configuration.

11
00:27.840 --> 00:30.960
All right. And here we go. So let's go to our four.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:27.840 --> 00:30.960
All right. And here we go. So let's go to our four.

12
00:30.960 --> 00:34.640
So interface F a four slash one and gig one zero are going to be inside and gig

13
00:34.640 --> 00:36.080
two zero is going to be outside.

14
00:36.080 --> 00:39.920
So on our four, we'll go into interface configuration mode for fast ethernet.

15
00:39.920 --> 00:44.770
In fact, let's do range interface range for fast ethernet four slash one comma

16
00:44.770 --> 00:47.120
as well as gigabit ethernet one slash zero.

17
00:47.120 --> 00:51.620
Enter and now in range configuration, we can say IP net inside and press center

18
00:51.620 --> 00:54.160
and then we'll go to interface gig two slash zero.

19
00:54.160 --> 00:58.800
And we'll say IP net. Whoa, look at that. It didn't like that all at once.

20
00:58.800 --> 01:03.270
Well, let's troubleshoot if we have to. Let's keep on going IP net outside and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
00:58.800 --> 01:03.270
Well, let's troubleshoot if we have to. Let's keep on going IP net outside and

21
01:03.270 --> 01:07.040
then gig two zero is to an IP net outside and press center.

22
01:07.040 --> 01:11.440
All right. Let's do a show process CPU and let's see how busy this is.

23
01:11.440 --> 01:14.770
Huh. Didn't look like that busy. So it did have a little bit of stress there

24
01:14.770 --> 01:15.200
for a moment.

25
01:15.200 --> 01:21.280
As I input both of those inside interface commands on gig one zero and four one

26
01:21.280 --> 01:22.640
, but looks like it's still going.

27
01:22.640 --> 01:26.570
So although tracebacks are not always a great sign, I'm going to go ahead and

28
01:26.570 --> 01:27.120
proceed.

29
01:27.120 --> 01:31.320
We can also verify what we've done with the show IP net statistics just to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
01:27.120 --> 01:31.320
We can also verify what we've done with the show IP net statistics just to

30
01:31.320 --> 01:35.360
verify that it knows that gig two zero is the outside interface and one zero

31
01:35.360 --> 01:37.840
and F a four slash one are inside fantastic.

32
01:37.840 --> 01:41.120
So let's create our static net and that's going to be for PC 30.

33
01:41.120 --> 01:45.980
So for PC 30, if we look at our topology here, it has the IP address of 10 30

34
01:45.980 --> 01:50.000
zero dot 51 and we want to map that to 23 dot 1 dot 2 dot 51.

35
01:50.000 --> 01:55.050
So in configuration, we'll say IP net inside source static and then we'll put

36
01:55.050 --> 01:59.120
the source address, which is 10 dot 30 dot zero dot 51 space question mark.

37
01:59.120 --> 02:04.470
And then the global, routable address is going to be 23 dot 1 dot 2 dot 51 and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:59.120 --> 02:04.470
And then the global, routable address is going to be 23 dot 1 dot 2 dot 51 and

38
02:04.470 --> 02:05.920
then let's go ahead and test that.

39
02:05.920 --> 02:11.780
So if we go over to PC 30 and we do a ping to 23 dot 1 dot 2 dot 100 and press

40
02:11.780 --> 02:13.280
center that's working.

41
02:13.280 --> 02:17.600
And if we go back to our four and do a show IP net translations and press

42
02:17.600 --> 02:22.690
center, there is our static translation and ICMP is currently being used over

43
02:22.690 --> 02:24.520
that translation fantastic.

44
02:24.520 --> 02:25.600
So there's our static net.

45
02:25.600 --> 02:30.120
The next task is to use a nap pool with the range 23 dot 1 dot 2 dot 65 through
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
02:25.600 --> 02:30.120
The next task is to use a nap pool with the range 23 dot 1 dot 2 dot 65 through

46
02:30.120 --> 02:32.120
126 with this last 26.

47
02:32.120 --> 02:36.920
So we'll create that nap pool next so to create that will type in IP, not pool.

48
02:36.920 --> 02:41.840
Go ahead and name it and I call our pool space question mark and the started

49
02:41.840 --> 02:46.040
rest is 23 dot 1 dot 2 dot 65 space question mark.

50
02:46.040 --> 02:51.880
Any address is 23 dot 1 dot 2 dot 1 26 space and we use prefix in the demos.

51
02:51.880 --> 02:54.920
Let's go ahead and use net mask and that mask is going to be a slash 26 so it's

52
02:54.920 --> 02:55.680
255.

53
02:55.680 --> 02:56.240
There's eight.

54
02:56.240 --> 02:59.960
There's eight more and eight more and then we need two more and there we have

55
02:59.960 --> 03:00.320
it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
02:59.960 --> 03:00.320
it.

56
03:00.320 --> 03:00.720
Perfect.

57
03:00.720 --> 03:14.480
So we'll create the access list.

58
03:14.480 --> 03:16.040
Let's create access list.

59
03:16.040 --> 03:19.480
100 from it 10 dot 10 dot 0 dot 0.

60
03:19.480 --> 03:20.960
We only care about the first three octets.

61
03:20.960 --> 03:24.550
So the B zero dot 0 dot 0 for the wild carpets dot 25 meaning we don't care

62
03:24.550 --> 03:27.480
about the last octet and there's our access control list.

63
03:27.480 --> 03:33.520
Oh, you think that wouldn't happen after 20 plus years of working with us.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
03:27.480 --> 03:33.520
Oh, you think that wouldn't happen after 20 plus years of working with us.

64
03:33.520 --> 03:37.500
So because I'm making an extended access list, it needs to know for example

65
03:37.500 --> 03:38.360
what protocol.

66
03:38.360 --> 03:41.840
So I'm going to hit the upper key and I'm going to say let's use access list 10

67
03:41.840 --> 03:43.400
, a standard access list.

68
03:43.400 --> 03:46.370
And then we are only focusing on the source and it should be much happier with

69
03:46.370 --> 03:46.800
that.

70
03:46.800 --> 03:50.650
So it just goes to show that practice hands on over and over again is going to

71
03:50.650 --> 03:53.380
help make you better and better and better and refreshing those skills from

72
03:53.380 --> 03:55.480
time to time is not a bad idea as well.

73
03:55.480 --> 03:59.720
So there's our access control list that's matching on 10 10 zero anything.

74
03:59.720 --> 04:03.600
Next, let's create a net rule that's using that access control list.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
03:59.720 --> 04:03.600
Next, let's create a net rule that's using that access control list.

75
04:03.600 --> 04:07.860
And if it matches on the access control list, we'll use our pool and syntax to

76
04:07.860 --> 04:10.520
be IP that inside source list.

77
04:10.520 --> 04:13.560
And then we'll go ahead and put our access list number in there.

78
04:13.560 --> 04:17.760
So I'm going to go ahead and copy paste 10 space and it will specify pool.

79
04:17.760 --> 04:20.360
And then the name of our pool, which is our pool.

80
04:20.360 --> 04:21.320
I'll copy paste that.

81
04:21.320 --> 04:23.720
So I don't have a typo space question mark.

82
04:23.720 --> 04:24.400
And that looks good.

83
04:24.400 --> 04:25.280
And we'll press enter.

84
04:25.280 --> 04:28.640
So now our windows client, which is right here in the bottom left of our top

85
04:28.640 --> 04:29.960
ology.

86
04:29.960 --> 04:31.160
Should be able to go to the server.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
04:29.960 --> 04:31.160
Should be able to go to the server.

87
04:31.160 --> 04:32.560
So we go to that client and client.

88
04:32.560 --> 04:34.240
And I'll reach will up here in the upper right.

89
04:34.240 --> 04:35.760
So we'll go ahead and select client.

90
04:35.760 --> 04:37.360
Nug and double click on it to bring it up.

91
04:37.360 --> 04:38.160
So there's client.

92
04:38.160 --> 04:38.360
Nug.

93
04:38.360 --> 04:40.240
Let's bring up a command prompt on client.

94
04:40.240 --> 04:42.520
Nug gets it 10.10.0.50.

95
04:42.520 --> 04:44.800
And let's do it IP config just to confirm.

96
04:44.800 --> 04:46.600
So 1010.0.50.

97
04:46.600 --> 04:49.200
And let's do it IP config space slash all.

98
04:49.200 --> 04:53.320
And sure enough, it's using 23.1.2.100 our server as a DNS server.

99
04:53.320 --> 04:57.760
So if we used NS lookup and we looked up, for example, how about PC 20?

100
04:57.760 --> 04:59.800
And it didn't get a response.

101
04:59.800 --> 05:01.120
How about PC 30?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
04:59.800 --> 05:01.120
How about PC 30?

102
05:01.120 --> 05:05.100
So one question is, is it not making the request or is the request going out

103
05:05.100 --> 05:05.280
there,

104
05:05.280 --> 05:06.920
but the server doesn't have a configured.

105
05:06.920 --> 05:08.160
So let's go back to our four.

106
05:08.160 --> 05:09.480
So we'll back to server one.

107
05:09.480 --> 05:10.840
So we minimize our client.

108
05:10.840 --> 05:14.320
Let's go back to server one and let's go to our four.

109
05:14.320 --> 05:17.040
And on our four, let's just show IP NAT translations.

110
05:17.040 --> 05:20.680
So we should have those requests, even if they weren't responded to correctly.

111
05:20.680 --> 05:25.240
So those are going out to the server 23.1.2.100.53.

112
05:25.240 --> 05:28.120
And the source IP address was 10.10.0.50.

113
05:28.120 --> 05:29.360
And here's our source port.

114
05:29.360 --> 05:32.840
So because I'm here sitting at server one, let's kind of re-app server manager
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
05:29.360 --> 05:32.840
So because I'm here sitting at server one, let's kind of re-app server manager

115
05:32.840 --> 05:33.640
for a moment.

116
05:33.640 --> 05:35.000
And let's take a look at the DNS entry.

117
05:35.000 --> 05:37.560
It's just to verify we have a DNS entry we can pull back.

118
05:37.560 --> 05:40.000
So here in server manager, we'll go to tools.

119
05:40.000 --> 05:42.440
And oh, we don't have DNS setup.

120
05:42.440 --> 05:46.680
That would explain why DNS isn't performing for us because DNS isn't running on

121
05:46.680 --> 05:47.160
the server.

122
05:47.160 --> 05:49.040
So let me go ahead and close that.

123
05:49.040 --> 05:50.920
And let's use a different tact.

124
05:50.920 --> 05:54.560
So let's go back to our client PC, which is right here.

125
05:54.560 --> 05:56.320
And let's go ahead and close that.

126
05:56.320 --> 05:58.120
And let's open up a browser.

127
05:58.120 --> 06:00.080
And let's go to the web server.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
05:58.120 --> 06:00.080
And let's go to the web server.

128
06:00.080 --> 06:01.680
And let's go to the web server showing on that server.

129
06:01.680 --> 06:02.840
So we'll launch Chrome.

130
06:02.840 --> 06:07.850
And here in Chrome, I'm going to click on the bookmark there for HTTP 23.1.2.

131
06:07.850 --> 06:08.560
100.

132
06:08.560 --> 06:11.800
And I'm going to hit a five a few times to refresh that.

133
06:11.800 --> 06:12.800
That's looking good.

134
06:12.800 --> 06:15.560
And as that loads, let's go back to server one.

135
06:15.560 --> 06:18.000
And at server one, let's go to the tab for our four.

136
06:18.000 --> 06:20.120
And do a show IP NAT translations.

137
06:20.120 --> 06:23.650
So now in addition to a whole bunch of DNS requests that are not being

138
06:23.650 --> 06:24.600
responded to, we

139
06:24.600 --> 06:27.440
now are going to have some port 80 requests as well.

140
06:27.440 --> 06:29.400
So here's an example of that right here.

141
06:29.400 --> 06:32.080
So the source address is 1010-050.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

141
06:29.400 --> 06:32.080
So the source address is 1010-050.

142
06:32.080 --> 06:34.560
The translated address going out is 2312-65.

143
06:34.560 --> 06:39.520
And it's going to the server at 23.1.2.100-2.80.

144
06:39.520 --> 06:41.800
So where are we in our configuration?

145
06:41.800 --> 06:44.080
So we do a show run pipe, including that.

146
06:44.080 --> 06:45.680
As well as see what rules we have in place.

147
06:45.680 --> 06:47.560
So here is our pool we created.

148
06:47.560 --> 06:50.920
Here's our rule that says if you match access to 10 as a source address, you

149
06:50.920 --> 06:51.440
can use an IP

150
06:51.440 --> 06:52.800
address from that pool.

151
06:52.800 --> 06:53.920
And here's our static mapping.

152
06:53.920 --> 06:58.240
But what we haven't done is the dynamic mapping for 10, everything else.

153
06:58.240 --> 07:00.400
So let's go ahead and fix that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

153
06:58.240 --> 07:00.400
So let's go ahead and fix that.

154
07:00.400 --> 07:02.520
So let's do a do show access list.

155
07:02.520 --> 07:04.640
And let's create an access list that matches on 10, anything.

156
07:04.640 --> 07:09.700
So access list, let's call this 11, permit 10, anything, with the first octet

157
07:09.700 --> 07:10.560
matching and

158
07:10.560 --> 07:13.480
wild card bits for the second, third and fourth octet.

159
07:13.480 --> 07:17.520
So with this access list 11, let's make a new rule with IP NAT inside source.

160
07:17.520 --> 07:19.400
The keyword list we'll put in 11.

161
07:19.400 --> 07:22.260
And if traffic matches that, we want to use interface gig and let's take a look

162
07:22.260 --> 07:22.500
at our

163
07:22.500 --> 07:23.500
topology here.

164
07:23.500 --> 07:27.020
We want to use interface gig 2,0 that outside interface and the IP address

165
07:27.020 --> 07:28.120
sitting on that.

166
07:28.120 --> 07:29.480
And we want to overload that.

167
07:29.480 --> 07:33.240
So interface gig 2 slash 0, space overload.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

167
07:29.480 --> 07:33.240
So interface gig 2 slash 0, space overload.

168
07:33.240 --> 07:34.240
And now let's test that out.

169
07:34.240 --> 07:38.070
So we should be able to go to anything else other than the 10, 10 address space

170
07:38.070 --> 07:38.480
and trigger

171
07:38.480 --> 07:40.400
that dynamic pat rule.

172
07:40.400 --> 07:47.440
So let's go to PC, let's go to PC 12 because that's on the 10, 12 subnet.

173
07:47.440 --> 07:50.240
And that should fall under the umbrella of 10, anything.

174
07:50.240 --> 07:55.920
And it should be a dynamic translation to the outside address of 23 at 1.2.4.

175
07:55.920 --> 08:01.480
So let's hit over to PC 12 and let's do a ping out to 23 at 1.2.100.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

175
07:55.920 --> 08:01.480
So let's hit over to PC 12 and let's do a ping out to 23 at 1.2.100.

176
08:01.480 --> 08:03.280
Press enter that ping is working.

177
08:03.280 --> 08:07.760
Let's go to our four and do a show IP NAT translations and press enter.

178
08:07.760 --> 08:09.840
So I'll go down a few pages and here we go.

179
08:09.840 --> 08:13.970
So there's our 10 dot 12 dot 0 dot 51 and it's being mapped to the outside

180
08:13.970 --> 08:14.640
address at

181
08:14.640 --> 08:19.240
23124 which is the interface address on gig 2, 0, 0.

182
08:19.240 --> 08:23.080
So we've just confirmed that our port address translation is also working.

183
08:23.080 --> 08:26.670
And if we went back to PC 12 and let's do a question mark to see what options

184
08:26.670 --> 08:27.080
exist here

185
08:27.080 --> 08:28.600
on this little virtual PC.

186
08:28.600 --> 08:32.200
We've got ping and we have trace.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

186
08:28.600 --> 08:32.200
We've got ping and we have trace.

187
08:32.200 --> 08:36.200
So let's do a trace to 23 dot 1 dot 2 dot 100.

188
08:36.200 --> 08:40.080
And for the protocol, use dash capital P to specify the protocol.

189
08:40.080 --> 08:42.880
And let's go ahead and use protocol TCP.

190
08:42.880 --> 08:45.840
So we'll do that by specifying a six here, press enter.

191
08:45.840 --> 08:49.060
And now if we go back to our four and hit the up arrow key and do a show IP NAT

192
08:49.060 --> 08:49.760
translations

193
08:49.760 --> 08:53.790
once again and then space party to the bottom here once again is 10 dot 12 dot

194
08:53.790 --> 08:54.640
0 dot 51

195
08:54.640 --> 08:57.400
mapped out to the IP address that's on gig 2, 0 of our four.

196
08:57.400 --> 09:01.440
And this is the TCP session that we're currently tracking at the pat device.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

196
08:57.400 --> 09:01.440
And this is the TCP session that we're currently tracking at the pat device.

197
09:01.440 --> 09:04.040
And again, depending on the protocol and the version of software that you're

198
09:04.040 --> 09:04.600
running,

199
09:04.600 --> 09:09.270
it's often common to see the source port that the client used with pat be also

200
09:09.270 --> 09:09.920
changed

201
09:09.920 --> 09:10.920
here.

202
09:10.920 --> 09:13.500
And if it's being translated, if it's the IP address, it's being translated on

203
09:13.500 --> 09:14.080
the reply

204
09:14.080 --> 09:15.920
that is going to be untranslated.

205
09:15.920 --> 09:20.260
And if the pat device did a translation of the source port as well, that also

206
09:20.260 --> 09:20.920
would be

207
09:20.920 --> 09:24.000
untranslated for the return traffic coming back to the client.

208
09:24.000 --> 09:27.360
So thanks for joining me in this set of videos in this skill regarding working

209
09:27.360 --> 09:28.160
with, configuring

210
09:28.160 --> 09:32.160
and verifying NAT and its little cousin, Pat in a Cisco environment.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

210
09:28.160 --> 09:32.160
and verifying NAT and its little cousin, Pat in a Cisco environment.

211
09:32.160 --> 09:35.610
And I look forward to seeing you, my friend, in another set of videos very,

212
09:35.610 --> 09:36.320
very soon.

213
09:36.320 --> 09:40.410
Until then, I hope this has been informative and I'd like to thank you for

214
09:40.410 --> 09:40.840
viewing.