WEBVTT

1
00:00.000 --> 00:03.840
In a previous video, we configured the interfaces and set them up as inside or

2
00:03.840 --> 00:05.500
outside from the perspective of NAT.

3
00:05.500 --> 00:09.350
And then we also set up a static translation between PC30 and a static IP

4
00:09.350 --> 00:12.340
address on the outside of 23.1.2.51.

5
00:12.340 --> 00:15.700
So our next step is to go ahead and configure dynamic NAT.

6
00:15.700 --> 00:19.680
But before we do that, we are going to need a little bit of infrastructure in

7
00:19.680 --> 00:20.240
place.

8
00:20.240 --> 00:23.620
Specifically, we're going to need access controlists that identify who is

9
00:23.620 --> 00:25.000
allowed to be translated.

10
00:25.000 --> 00:31.440
So if we want the 1010 032/27 and the 1010 048/29 address spaces to be
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:25.000 --> 00:31.440
So if we want the 1010 032/27 and the 1010 048/29 address spaces to be

11
00:31.440 --> 00:32.300
translated,

12
00:32.300 --> 00:36.500
we need to create access controlists identifying those ranges of addresses.

13
00:36.500 --> 00:38.500
And the same thing for dynamic PAT.

14
00:38.500 --> 00:42.540
If we want to allow everybody else who doesn't match the dynamic NAT rule to

15
00:42.540 --> 00:43.000
use PAT,

16
00:43.000 --> 00:46.900
we also need to specify a access list that we can use in conjunction with that

17
00:46.900 --> 00:47.500
as well.

18
00:47.500 --> 00:50.780
So based on our game plan, we need to create some access controlists that can

19
00:50.780 --> 00:53.500
match on these two ranges of addresses,

20
00:53.500 --> 00:56.500
and then one that can match on 10 anything else.

21
00:56.500 --> 01:00.200
So in this video, let's go ahead and create the access controlists that will be
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:56.500 --> 01:00.200
So in this video, let's go ahead and create the access controlists that will be

22
01:00.200 --> 01:02.000
used to identify who can be translated.

23
01:02.000 --> 01:04.500
So back to our floor we go, and let's see what we have to work with.

24
01:04.500 --> 01:06.000
Let's do a show access list.

25
01:06.000 --> 01:09.500
Just to make sure we're not going to write on top of any existing access list.

26
01:09.500 --> 01:11.500
And there are no ACLs at the moment.

27
01:11.500 --> 01:12.500
So let's go ahead and create one.

28
01:12.500 --> 01:14.000
So we'll go in a configuration mode.

29
01:14.000 --> 01:15.000
And let's create a named access list.

30
01:15.000 --> 01:19.000
We'll use IP access list, standard.

31
01:19.000 --> 01:21.500
And let's go ahead and call this one dynamic NAT.

32
01:21.500 --> 01:24.000
As far as what we want to match on, let's take a look at our game plan.

33
01:24.000 --> 01:29.250
So in our game plan, if we want to match on 1010 032 with a such 27 and 10 12 0

34
01:29.250 --> 01:30.500
48 with a such 29,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:29.250 --> 01:30.500
48 with a such 29,

35
01:30.500 --> 01:33.830
we need to create two entries with permits statements that match on those

36
01:33.830 --> 01:35.000
ranges of addresses.

37
01:35.000 --> 01:38.700
And although we've taken a look at access controlists in our CCNA studies and

38
01:38.700 --> 01:39.500
other courses,

39
01:39.500 --> 01:43.060
I would also like to walk through what I would do if I was asked to do this

40
01:43.060 --> 01:43.500
right now

41
01:43.500 --> 01:46.950
and didn't have a calculator, how would I determine what the correct ACLs are

42
01:46.950 --> 01:47.500
for that?

43
01:47.500 --> 01:55.570
So the first thing I do is I write out my values of 8 bits, 128, 64, 32, 16, 8,

44
01:55.570 --> 01:56.500
4, 2, and 1.

45
01:56.500 --> 01:59.500
If you're saying key, you're double CCA, you still write that out.

46
01:59.500 --> 02:02.830
I'd say, well, if I'm being tested and I want to make sure it's right, yes I
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
01:59.500 --> 02:02.830
I'd say, well, if I'm being tested and I want to make sure it's right, yes I

47
02:02.830 --> 02:03.500
would.

48
02:03.500 --> 02:06.500
So I'm going to write out the values of the 8 bits there.

49
02:06.500 --> 02:09.000
And then I'm going to take a look at the slash 27 and slash 29.

50
02:09.000 --> 02:12.000
So for a slash 27 and a slash 29.

51
02:12.000 --> 02:14.500
So the slash 27 to be 25, 26, 27.

52
02:14.500 --> 02:16.500
So the block size will be 32.

53
02:16.500 --> 02:21.500
For a slash 27 and for a slash 29, it'll be 25, 26, 27, 28, 29.

54
02:21.500 --> 02:23.500
That'll be our block size for a slash 29.

55
02:23.500 --> 02:26.500
I'll make a little note there, slash 27, slash 29.

56
02:26.500 --> 02:29.760
And the reason that's helpful is that the wild card bits is one less than the

57
02:29.760 --> 02:30.500
block size.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:29.760 --> 02:30.500
block size.

58
02:30.500 --> 02:34.500
So the wild card bits for the slash 27 is going to be 31.

59
02:34.500 --> 02:38.180
And the wild card bits for the slash 29 is going to be one less than the block

60
02:38.180 --> 02:39.500
size, which is going to be a 7.

61
02:39.500 --> 02:43.500
And that's going to save us a lot of time in calculating those wild card bits

62
02:43.500 --> 02:48.500
because we can just put in 10, 10, 0, 32 with wild card bits of 0, 0, 0, 31.

63
02:48.500 --> 02:52.500
And 10, 12, 0, 48 with wild card bits of 0, 0, 0, 7.

64
02:52.500 --> 02:55.500
And we have then identified those ranges of addresses.

65
02:55.500 --> 02:57.500
So at that in mind, let's create the access control list entries.

66
02:57.500 --> 03:02.500
So here in our four, our first entry, let's go ahead and use permit 10.10.0.32.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:57.500 --> 03:02.500
So here in our four, our first entry, let's go ahead and use permit 10.10.0.32.

67
03:02.500 --> 03:06.500
And then for the wild card bits, we determined to be 0.0.0.31.

68
03:06.500 --> 03:07.500
Boom, done.

69
03:07.500 --> 03:09.500
We're proving that a source range.

70
03:09.500 --> 03:12.500
And then for the second entry, which is for the 10, 12, 0, 48 network,

71
03:12.500 --> 03:17.500
let's go ahead and put that in with the permit 10.12.0.48.

72
03:17.500 --> 03:21.500
And then based on what we just did for the wild card bits, it'd be 0.0.0.7.

73
03:21.500 --> 03:22.500
No type in exit.

74
03:22.500 --> 03:24.500
Let's create one more access control list.

75
03:24.500 --> 03:26.500
Let's call this one dynamic pat.

76
03:26.500 --> 03:28.500
And for this one, we'll simply permit 10 anything.

77
03:28.500 --> 03:32.500
And for this one, we put 255 for the second octet for the wild card bits.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
03:28.500 --> 03:32.500
And for this one, we put 255 for the second octet for the wild card bits.

78
03:32.500 --> 03:33.500
And 255 for the third octet.

79
03:33.500 --> 03:37.260
And 255 for the fourth octet because we don't care what those second, third and

80
03:37.260 --> 03:38.500
fourth octets are.

81
03:38.500 --> 03:39.500
I'll work care about as matching on the 10.

82
03:39.500 --> 03:42.500
And then we'll type in end as they show access list.

83
03:42.500 --> 03:43.500
And let's check our work.

84
03:43.500 --> 03:47.380
So for the access control list called dynamic net, we're matching on the 10, 10

85
03:47.380 --> 03:48.500
, 0, 32 network.

86
03:48.500 --> 03:50.500
And the 10, 12, 0, 48 network.

87
03:50.500 --> 03:54.500
And for the access is called dynamic pat, we're matching on 10 anything.

88
03:54.500 --> 03:57.500
So now that we have our access control list that we can use with dynamic net.

89
03:57.500 --> 04:00.500
And also the access control list we can use with dynamic pat.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
03:57.500 --> 04:00.500
And also the access control list we can use with dynamic pat.

90
04:00.500 --> 04:04.820
In the next video, let's go ahead and define the pool of addresses that we want

91
04:04.820 --> 04:08.500
to use for the translation for our dynamic net clients.

92
04:08.500 --> 04:12.990
So if this really is a slash 24, we could go ahead and use the addresses of dot

93
04:12.990 --> 04:15.500
64 all the way through 127.

94
04:15.500 --> 04:19.220
Or if you didn't want to use something that looked like the actual subnet

95
04:19.220 --> 04:24.500
itself, we could go ahead and do dot 65 all the way through, let's say, 126.

96
04:24.500 --> 04:27.500
If we don't want to use the dypedress that looked like the broadcast address.

97
04:27.500 --> 04:32.500
Now in reality, this is just a subblock of IP addresses on the slash 24.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
04:27.500 --> 04:32.500
Now in reality, this is just a subblock of IP addresses on the slash 24.

98
04:32.500 --> 04:37.580
So whether you want to use 64 through 127 or 65 through 126 for our purposes is

99
04:37.580 --> 04:40.500
going to give us plenty of IP addresses in that pool.

100
04:40.500 --> 04:43.750
So in the next video, let's go ahead and create that net pool that we can use

101
04:43.750 --> 04:45.500
for our dynamic net translations.

102
04:45.500 --> 04:47.500
So I'll see you in the next video in just a moment.