WEBVTT

1
00:00.000 --> 00:04.060
So with this game plan in mind, our first step is to go ahead and implement

2
00:04.060 --> 00:06.000
static net on our four.

3
00:06.000 --> 00:11.730
And let's do that to map the address 1030.51, which is the IP address of PC30

4
00:11.730 --> 00:12.400
right here,

5
00:12.400 --> 00:17.730
over to 23.1.2.51. Also, before we set up the net rules here and specify these

6
00:17.730 --> 00:18.720
interfaces as inside

7
00:18.720 --> 00:22.690
or outside, I also want to take a moment and just verify it from PC30, then it

8
00:22.690 --> 00:25.840
actually can ping 23.1.2.4,

9
00:25.840 --> 00:29.020
the interface address here on gig 2.0. That will guarantee us that we have

10
00:29.020 --> 00:30.080
reachability back from
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:29.020 --> 00:30.080
reachability back from

11
00:30.080 --> 00:34.320
R4, the net device back to PC30. So let's do that first to verify connectivity

12
00:34.320 --> 00:34.880
and then we'll set up

13
00:34.880 --> 00:38.000
our static net rule. So here in the lab environment, let me go ahead and double

14
00:38.000 --> 00:39.360
click on our lab

15
00:39.360 --> 00:43.240
topology to go ahead and open it up. Fantastic. There it is. Let me scooch this

16
00:43.240 --> 00:45.040
down just a little bit.

17
00:45.040 --> 00:48.740
Next, let's select server one -nug and with this selected, we'll double click

18
00:48.740 --> 00:49.600
on that to open that

19
00:49.600 --> 00:53.300
up. And that's where we're going to get console access to each of our devices

20
00:53.300 --> 00:54.400
in our topology. So we'll

21
00:54.400 --> 00:59.130
give that a moment to open up and here it comes. Fantastic. So first, let's go

22
00:59.130 --> 01:02.160
to PC30, which is right here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

22
00:59.130 --> 01:02.160
to PC30, which is right here.

23
01:02.160 --> 01:07.840
And from PC30, I just want to validate that we can reach 23.1.2.4, which is the

24
01:07.840 --> 01:08.560
gig 2.0

25
01:08.560 --> 01:13.410
interface address up on R4. So we can verify that also on R4 by doing a show IP

26
01:13.410 --> 01:14.560
interface brief.

27
01:14.560 --> 01:18.210
And sure enough, gig 2.0 has that IP address right there. So we'll go ahead and

28
01:18.210 --> 01:19.520
just copy that address.

29
01:19.520 --> 01:25.440
And we'll go back to PC30 by clicking on the PC30 tab. And let's do a ping and

30
01:25.440 --> 01:26.640
paste in that address

31
01:26.640 --> 01:30.800
and press enter. And sure enough, we have connectivity up to R4. So here in R4,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
01:26.640 --> 01:30.800
and press enter. And sure enough, we have connectivity up to R4. So here in R4,

32
01:30.800 --> 01:31.600
before we set up

33
01:31.600 --> 01:36.510
the static net with a single IP address mapped to 1030-051, we also need to

34
01:36.510 --> 01:38.240
specify which interfaces

35
01:38.240 --> 01:43.690
on R4 are going to be inside interfaces, which is going to be FA4/1 and gig 1.0

36
01:43.690 --> 01:44.400
. And which interface

37
01:44.400 --> 01:47.410
is going to be the outside interface and that's gig 2.0. So we'll go ahead and

38
01:47.410 --> 01:48.480
make that configuration

39
01:48.480 --> 01:52.400
next. So we'll go to the right device. So that's R4 and we'll go to

40
01:52.400 --> 01:54.080
configuration mode, go to

41
01:54.080 --> 02:00.140
interface, not Gaff or /1, but FA4/1. And we'll say IP_NAT inside, just like
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:54.080 --> 02:00.140
interface, not Gaff or /1, but FA4/1. And we'll say IP_NAT inside, just like

42
02:00.140 --> 02:01.360
that. And then we'll go to

43
02:01.360 --> 02:07.210
interface_GIG 1/0. And it's also an inside interface with IP_NAT inside. And

44
02:07.210 --> 02:07.680
behind the scenes,

45
02:07.680 --> 02:10.930
this creates this virtual interface is going to be using as part of the address

46
02:10.930 --> 02:11.840
translation. And we

47
02:11.840 --> 02:15.200
have one more interface and that is the interface_GIG 2.0, which is just

48
02:15.200 --> 02:16.640
confirm the interface here.

49
02:16.640 --> 02:20.510
So interface_GIG 2.0 is the interface on R4 facing out towards the internet.

50
02:20.510 --> 02:20.880
And that's going to be our

51
02:20.880 --> 02:27.860
outside interface. So we'll go to interface_GIG 2/0 and specify IP_NAT outside.

52
02:27.860 --> 02:28.800
And then we can

53
02:28.800 --> 02:33.760
verify our work by doing a show IP_NAT statistics. So here in the output of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
02:28.800 --> 02:33.760
verify our work by doing a show IP_NAT statistics. So here in the output of

54
02:33.760 --> 02:36.080
show IP_NAT statistics, it lets us

55
02:36.080 --> 02:40.980
know exactly which interfaces are outside interfaces. In this case, gig 2.0 and

56
02:40.980 --> 02:42.160
which interfaces are inside

57
02:42.160 --> 02:47.840
interfaces, including GIG 1/0 and also fast-eaten at 4/1. So so far, so good.

58
02:47.840 --> 02:48.960
Let's look at our game plan.

59
02:48.960 --> 02:52.210
So now that we have labeled these interfaces, next, let's go ahead and specify

60
02:52.210 --> 02:52.960
that we want a static

61
02:52.960 --> 02:59.760
mapping for inside source_NAT from 1030-051, which is PC30's address, 223.1.2.

62
02:59.760 --> 03:01.760
51. So here on R4, we'll go
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
02:59.760 --> 03:01.760
51. So here on R4, we'll go

63
03:01.760 --> 03:07.080
into configuration mode, and we'll type in IP_NAT inside source_Static because

64
03:07.080 --> 03:08.880
we're doing static mapping.

65
03:08.880 --> 03:13.980
And we want first the internal address, the inside local address of PC30, which

66
03:13.980 --> 03:14.960
is, let's take a look at

67
03:14.960 --> 03:22.260
our graphics here, we have 10.30.0.51. So we'll put that in 10.30.0.51 space,

68
03:22.260 --> 03:23.200
and then the address that we want

69
03:23.200 --> 03:26.510
to translate that to, which is going to be, and based on our game plan, that's

70
03:26.510 --> 03:33.760
going to be 23.1.2.51. So we'll put that in 23.1.2.51 for a center,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
03:26.510 --> 03:33.760
going to be 23.1.2.51. So we'll put that in 23.1.2.51 for a center,

71
03:33.760 --> 03:37.920
and then we'll actually configuration mode, let's do a show IP_NAT translation.

72
03:37.920 --> 03:39.120
So now with a static mapping

73
03:39.120 --> 03:42.780
like that, we don't have to have any traffic from that client going through

74
03:42.780 --> 03:43.840
that router to make the

75
03:43.840 --> 03:47.600
translation. That static NAT is right there. There's the hard-coded mapping

76
03:47.600 --> 03:48.880
between the inside local

77
03:48.880 --> 03:52.730
address 1030-051, and the source address that it's going to use as that traffic

78
03:52.730 --> 03:53.520
is sent out to the

79
03:53.520 --> 03:56.910
Internet. So let's test it. Let's go to PC30, and what I like to do is from PC

80
03:56.910 --> 03:58.240
30, which is right here,

81
03:58.240 --> 04:03.810
let's go ahead and let's do a ping out to the server at 23.1.2.100, and if the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
03:58.240 --> 04:03.810
let's go ahead and let's do a ping out to the server at 23.1.2.100, and if the

82
04:03.810 --> 04:04.800
response comes back,

83
04:04.800 --> 04:08.270
that implies that the NAT's working because the server does not have a default

84
04:08.270 --> 04:09.120
gateway that goes

85
04:09.120 --> 04:12.840
back to R4. So let's do a ping, and that would use ICMP, and let's also do a

86
04:12.840 --> 04:14.320
trace, and by default,

87
04:14.320 --> 04:18.770
the trace is going to be using UDP. So let's go ahead and generate some traffic

88
04:18.770 --> 04:20.080
from PC30 up to the

89
04:20.080 --> 04:24.080
server, and then we can look at the resulting NAT translations here on R4. And

90
04:24.080 --> 04:25.200
here at PC30, let's do a

91
04:25.200 --> 04:31.680
ping to 23.1.2.100, and let's also go ahead and do a trace. And by default, the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
04:25.200 --> 04:31.680
ping to 23.1.2.100, and let's also go ahead and do a trace. And by default, the

92
04:31.680 --> 04:32.720
little trace command

93
04:32.720 --> 04:36.270
here on this little virtual PC is going to use UDP by default. So let's do a

94
04:36.270 --> 04:38.640
trace to 23.1.2.100,

95
04:38.640 --> 04:41.820
and if we want to, we can also swap out the protocol. So if we want to go ahead

96
04:41.820 --> 04:43.360
and say -p,

97
04:43.360 --> 04:47.550
and let's go ahead and use 6, that's TCP, they'll do the same trace, but use

98
04:47.550 --> 04:49.040
TCP at layer 4. So let's go

99
04:49.040 --> 04:54.600
back to R4, and if we do a show IP NAT translations in press center, check it

100
04:54.600 --> 04:56.640
out. There's our static mapping

101
04:56.640 --> 05:00.040
that hasn't changed, and we should have some ICMP that was from our ping, and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
04:56.640 --> 05:00.040
that hasn't changed, and we should have some ICMP that was from our ping, and

102
05:00.040 --> 05:01.280
we should have some UDP

103
05:01.280 --> 05:05.090
that was from our initial trace, and then when we change the protocol to TCP,

104
05:05.090 --> 05:05.840
there's our TCP

105
05:05.840 --> 05:10.690
session right there. All using that mapping from 10.30.0.51, which is the

106
05:10.690 --> 05:11.600
inside local address,

107
05:11.600 --> 05:18.480
the real address of the PC30, and the map address of 23.1.2.51. And notice here

108
05:18.480 --> 05:18.880
that

109
05:18.880 --> 05:22.560
the router, because we're doing NAT, 1 to 1 mapping at layer 3, it left the

110
05:22.560 --> 05:24.000
original port. So the client

111
05:24.000 --> 05:29.190
for this session used source port 55905, and as that went out towards the

112
05:29.190 --> 05:30.400
server, it maintained
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
05:29.190 --> 05:30.400
server, it maintained

113
05:30.400 --> 05:35.050
that same initial source port of 55905. And with NAT, 1 to 1 mapping, we're not

114
05:35.050 --> 05:35.760
going to be messing

115
05:35.760 --> 05:40.110
with the layer 4 ports, because every inside address has its own global map

116
05:40.110 --> 05:41.520
address at layer 3.

117
05:41.520 --> 05:45.810
All right, so now that we've implemented a static NAT between one inside host,

118
05:45.810 --> 05:46.640
going to the outside

119
05:46.640 --> 05:51.090
world in the next video, I'd like to begin the preparation for doing dynamic N

120
05:51.090 --> 05:52.000
AT and dynamic

121
05:52.000 --> 05:56.040
path, and that's going to begin by creating access control lists that identify

122
05:56.040 --> 05:56.720
the traffic

123
05:56.720 --> 06:00.610
that is allowed to be translated. So we'll set up those ACLs in the next video,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
05:56.720 --> 06:00.610
that is allowed to be translated. So we'll set up those ACLs in the next video,

124
06:00.610 --> 06:01.360
and I'll see you there