WEBVTT

1
00:00.000 --> 00:04.160
So now's the opportunity to test and verify and validate that the translations

2
00:04.160 --> 00:06.000
are working as expected.

3
00:06.000 --> 00:09.680
So with that in mind, and this game plan that's been implemented, let's do some

4
00:09.680 --> 00:10.160
testing.

5
00:10.160 --> 00:16.000
Here on R4, I'm going to start off by doing a clear IP NAT translations and an

6
00:16.000 --> 00:16.800
asterisk.

7
00:16.800 --> 00:20.020
Now behind the scenes, the Windows client, especially, is making lots of

8
00:20.020 --> 00:21.200
requests for DNS and other

9
00:21.200 --> 00:25.120
things out to that server. So it's going to create some translations right away

10
00:25.120 --> 00:26.000
. But let's just

11
00:26.000 --> 00:29.970
look at the configurations as we did them. So for static NAT, that's PC30, if

12
00:29.970 --> 00:31.280
we go to PC30,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:29.970 --> 00:31.280
we go to PC30,

13
00:31.280 --> 00:37.820
and do a show IP, that has the IP address of 10.30.0.51. And so if we did a

14
00:37.820 --> 00:38.960
ping, for example,

15
00:38.960 --> 00:43.630
to 23.1.2.100, and this is confirmed that address as well, that's the IP

16
00:43.630 --> 00:45.280
address here of our server,

17
00:45.280 --> 00:50.230
just off of R4, and we press Enter. That works. Great, great, great. And we

18
00:50.230 --> 00:51.440
should see some ICMP

19
00:51.440 --> 00:57.600
based translations between the client at 10.30.0.51 using the translation we

20
00:57.600 --> 00:58.400
set up for it

21
00:58.400 --> 01:02.990
with a static translation. So if we go back to R4 and we do a show IP NAT
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:58.400 --> 01:02.990
with a static translation. So if we go back to R4 and we do a show IP NAT

22
01:02.990 --> 01:05.040
translations and press Enter,

23
01:05.040 --> 01:10.400
there is our static translation right there for 10.30.0.51. And these represent

24
01:10.400 --> 01:10.880
the individual

25
01:10.880 --> 01:15.050
pings that were used between that client 1030.0.51 as it communicated out to

26
01:15.050 --> 01:17.200
the server at 23.1.2.100.

27
01:17.200 --> 01:24.010
And if we went back into trace to 23.1.2.100, and let's use -p for 6. Let's use

28
01:24.010 --> 01:25.200
-p6 for protocol 6.

29
01:25.200 --> 01:29.600
There will be TCP based. Then we can go back to R4, use that same command again

30
01:29.600 --> 01:29.600
,

31
01:29.600 --> 01:33.120
and we should see some TCP based traffic. And there is that session right there
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
01:29.600 --> 01:33.120
and we should see some TCP based traffic. And there is that session right there

32
01:33.120 --> 01:33.360
.

33
01:33.360 --> 01:37.920
Next, let's go ahead and verify our dynamic NAT. And one way of doing that is

34
01:37.920 --> 01:38.560
to double click here

35
01:38.560 --> 01:43.390
on clientnug, go to a command prompt. And here, let's do an IP config to verify

36
01:43.390 --> 01:45.440
its IP address at 10.10.0.50.

37
01:45.440 --> 01:51.810
And let's do a ping out to 23.1.2.100. So in our topology, that's from this

38
01:51.810 --> 01:52.320
windows client

39
01:52.320 --> 01:54.930
machine in the bottom left going to the server on the top right. And we are

40
01:54.930 --> 01:55.760
getting a response.

41
01:55.760 --> 01:59.770
Let's also go ahead and let's open up a browser. So if you open up a browser

42
01:59.770 --> 02:00.560
here on our little
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
01:59.770 --> 02:00.560
here on our little

43
02:00.560 --> 02:03.840
windows client, so I'm going to do that by clicking on the shortcut for Google

44
02:03.840 --> 02:04.960
Chrome right there.

45
02:04.960 --> 02:09.230
And then once Google Chrome comes up, I have a shortcut for the server at 23.1.

46
02:09.230 --> 02:10.000
2.100.

47
02:10.000 --> 02:14.200
I hear in the bookmarks. So if we click on that 23.1.2.100, that should bring

48
02:14.200 --> 02:15.200
us to the server.

49
02:15.520 --> 02:19.230
And, yeah, there we go. So it took a moment. And here it comes. So while that's

50
02:19.230 --> 02:20.080
happening,

51
02:20.080 --> 02:22.890
let me go back to our four. And here we do show IP NAT translation. Here we

52
02:22.890 --> 02:25.120
have the IP address 10.10.0.50

53
02:25.120 --> 02:29.570
being mapped out to an IP address from the pool of 23.1.2.65. So based on the

54
02:29.570 --> 02:30.720
ports involved here,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
02:29.570 --> 02:30.720
ports involved here,

55
02:30.720 --> 02:35.110
there's tons of UDP traffic that is DNS. For example, right here, that's the

56
02:35.110 --> 02:36.080
DNS request.

57
02:36.080 --> 02:39.910
But based on the TCP session that we just did with HTTP, there should also be

58
02:39.910 --> 02:40.960
some TCP as well.

59
02:40.960 --> 02:44.110
And here's an example of one of those right here, where it was attempting,

60
02:44.110 --> 02:44.960
based on the port,

61
02:44.960 --> 02:48.980
there was attempting to go to the server at 4.4.3. And then it fell back to

62
02:48.980 --> 02:50.560
port 80, because I don't have

63
02:50.560 --> 02:54.640
HTTP has services running on that server. So the source address was 10.10.0.50.

64
02:54.640 --> 02:57.520
The source port was 56,690.

65
02:57.520 --> 03:02.750
The source address got translated to 23.1.2.65. The source port was left the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:57.520 --> 03:02.750
The source address got translated to 23.1.2.65. The source port was left the

66
03:02.750 --> 03:03.520
same. And then it went

67
03:03.520 --> 03:07.870
out to the server 23.1.2.100 to the destination port of 80. And the reason

68
03:07.870 --> 03:08.800
these two columns here

69
03:08.800 --> 03:12.050
are the same is because we weren't on that initial flow of traffic. We're not

70
03:12.050 --> 03:12.960
doing destination

71
03:12.960 --> 03:17.320
that. So the original and final destination regarding the IP address in the

72
03:17.320 --> 03:18.480
port that didn't get changed.

73
03:18.480 --> 03:23.680
So we've tested static that we've tested dynamic that coming in from client.nug

74
03:23.680 --> 03:25.120
here 10.10.0.50.

75
03:25.120 --> 03:30.800
Let's also test from PC 12 as well. So let me go ahead and do a clear IP net
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
03:25.120 --> 03:30.800
Let's also test from PC 12 as well. So let me go ahead and do a clear IP net

76
03:30.800 --> 03:31.760
translation just to go

77
03:31.760 --> 03:34.940
ahead and make a little bit cleaner and then we'll do a show IP net

78
03:34.940 --> 03:36.480
translations. And this new one

79
03:36.480 --> 03:40.000
right here is from our Windows client making a DNS request. So currently though

80
03:40.000 --> 03:41.520
we have 10.10.0.50,

81
03:41.520 --> 03:46.710
but we don't have 10.12.0.51. That's PC 12. That's because PC 12 hasn't sent

82
03:46.710 --> 03:48.160
traffic yet. Let's go ahead and

83
03:48.160 --> 03:54.010
change that by going to PC 12. And let's go ahead and do a ping to 23.1.2.100

84
03:54.010 --> 03:55.360
as a test. And this also

85
03:55.360 --> 04:00.620
do a trace that same address 23.1.2.100 that'll use UDP. And then we go back to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
03:55.360 --> 04:00.620
do a trace that same address 23.1.2.100 that'll use UDP. And then we go back to

86
04:00.620 --> 04:01.520
our four. Hit the

87
04:01.520 --> 04:05.900
upper key to a show IP net translations. And as now that we have a translation

88
04:05.900 --> 04:08.320
for 10.12.0.51,

89
04:08.320 --> 04:12.160
mapping over to another IP address in the pool, which is 66. And here's an

90
04:12.160 --> 04:13.600
example of it translating

91
04:13.600 --> 04:17.920
with UDP. And here is an example of it translating for the ICMP traffic based

92
04:17.920 --> 04:19.360
on the ping. And the last

93
04:19.360 --> 04:24.100
one we have that we haven't tested yet is the dynamic pat for everybody else.

94
04:24.100 --> 04:25.360
So by that, if we took

95
04:25.360 --> 04:29.660
an example of let's say PC 20 as this sends traffic out to that server in that

96
04:29.660 --> 04:30.720
direction, because it's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
04:29.660 --> 04:30.720
direction, because it's

97
04:30.720 --> 04:35.230
not going to match the rules for dynamic net. And there's no static net

98
04:35.230 --> 04:36.640
configured for it. It's

99
04:36.640 --> 04:39.980
going to fall into the bucket of dynamic pat because it's going to match 10

100
04:39.980 --> 04:41.360
anything. And it should

101
04:41.360 --> 04:46.560
get a translation dynamically to the IP address on gig 2 0 here on our four,

102
04:46.560 --> 04:48.560
which is 23.1.2.4. So

103
04:48.560 --> 04:52.220
let's go to PC 20 and generate some traffic out to the server. So we'll go to

104
04:52.220 --> 04:53.360
PC 20. And there we

105
04:53.360 --> 04:58.800
are. There's the IP address 10.20.0.51. And I want to generate some TCP traffic

106
04:58.800 --> 04:59.360
. If we

107
04:59.360 --> 05:03.050
under that with a trace, we can do trace from this little virtual machine. We
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
04:59.360 --> 05:03.050
under that with a trace, we can do trace from this little virtual machine. We

108
05:03.050 --> 05:05.760
can do a trace to 23.1.2.100.

109
05:05.760 --> 05:10.260
That's the server's address space dash capital P. And then we can use six. And

110
05:10.260 --> 05:10.960
that's the protocol

111
05:10.960 --> 05:14.720
number for TCP. So we'll go ahead and generate that trace that trace is working

112
05:14.720 --> 05:16.640
. Let's go back to R4

113
05:16.640 --> 05:21.630
and do a show IP net translations once again. So PC 20 is right here. That's 10

114
05:21.630 --> 05:24.240
.20.0.51. And notice

115
05:24.240 --> 05:28.250
that it didn't give it a static mapping. And that's because it's dynamically

116
05:28.250 --> 05:29.360
mapped to the outside

117
05:29.360 --> 05:35.040
IP address, the 23.1.2.4 with ported rest translation. So there's the pat for
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
05:29.360 --> 05:35.040
IP address, the 23.1.2.4 with ported rest translation. So there's the pat for

118
05:35.040 --> 05:35.520
PC 20's

119
05:35.520 --> 05:38.990
address. And as a further test, what we could do is we could send traffic out

120
05:38.990 --> 05:39.920
to that server. And we

121
05:39.920 --> 05:44.670
could source it from gig 2 0, which is 10.20.0.2. We could also send some

122
05:44.670 --> 05:47.360
traffic source from R2's gig 0 0,

123
05:47.360 --> 05:51.790
which is 1023 0.2. And we can see that both of the addresses as they go through

124
05:51.790 --> 05:53.040
the pat device with

125
05:53.040 --> 05:57.510
dynamic pat that they're both being translated to the same external address of

126
05:57.510 --> 05:59.920
23.1.2.4 with pat.

127
05:59.920 --> 06:05.360
So let's do that next. So here on R2, let's go into a show IP interface brief.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
05:59.920 --> 06:05.360
So let's do that next. So here on R2, let's go into a show IP interface brief.

128
06:05.360 --> 06:05.760
So let's send some

129
06:05.760 --> 06:10.920
traffic. We'll source some of it from gig 2 slash 0, which is at 10.20.0.2. And

130
06:10.920 --> 06:11.840
we'll source some

131
06:11.840 --> 06:17.420
other traffic from gig a bit 0 0, which is 10.23.0.2. Let's do a trace because

132
06:17.420 --> 06:19.200
they'll use UDP by default

133
06:19.200 --> 06:23.710
here on a Cisco router. Let's do a trace to 23.1.2.100 press center. And I

134
06:23.710 --> 06:24.960
forgot to say source it from

135
06:24.960 --> 06:29.810
which address. And so I'll say source from the IP address on gig 2 slash 0. And

136
06:29.810 --> 06:30.880
I'll do it again,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
06:29.810 --> 06:30.880
I'll do it again,

137
06:30.880 --> 06:35.100
but I'll source it from interface gig 0 slash 0. And then let's take a look at

138
06:35.100 --> 06:36.080
the NAT translation

139
06:36.080 --> 06:40.340
table over on R4 with a show IP NAT translations. So this here we have the IP

140
06:40.340 --> 06:42.960
address 10.20.0.2 being

141
06:42.960 --> 06:48.250
translated to 23.1.2.4. That's the outside address on R4. And then down here we

142
06:48.250 --> 06:50.320
have 10.23.0.2,

143
06:50.320 --> 06:54.000
which is the gig 0 0 interface, also being mapped to that same address of 23.1.

144
06:54.000 --> 06:54.880
2.4. Now

145
06:54.880 --> 06:59.470
depending on the version of iOS and what's going on with that router with port

146
06:59.470 --> 07:00.400
address translation
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

146
06:59.470 --> 07:00.400
address translation

147
07:00.400 --> 07:04.260
with overload, it also may swap out the original source port. So if the client

148
07:04.260 --> 07:05.200
was using for example

149
07:05.200 --> 07:10.470
49,181, the router doing port address translation can swap that source port

150
07:10.470 --> 07:11.360
along with the source

151
07:11.360 --> 07:15.320
IP address over to a different source port. And that way if you have a conflict

152
07:15.320 --> 07:15.920
, for example,

153
07:15.920 --> 07:20.280
if two or three devices inside that all happen to use the same source port, the

154
07:20.280 --> 07:20.960
path device has

155
07:20.960 --> 07:24.520
the ability to swap out that port information as well. So whatever it

156
07:24.520 --> 07:25.600
translates on the initial

157
07:25.600 --> 07:29.460
flow of traffic going out, it'll un-translate that on the way coming back. So

158
07:29.460 --> 07:30.480
that includes the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

158
07:29.460 --> 07:30.480
that includes the

159
07:30.480 --> 07:34.540
layer 3 IP address. And if it manipulates the port information, it'll un-trans

160
07:34.540 --> 07:35.360
late the port

161
07:35.360 --> 07:39.570
information as well. Also, if we do a show IP NAT statistics one more time,

162
07:39.570 --> 07:40.080
here we can confirm

163
07:40.080 --> 07:43.150
not only what the interfaces are with network address translation and also what

164
07:43.150 --> 07:43.760
the rules are,

165
07:43.760 --> 07:47.060
but we could also get a feel for the hit counts as far as how often they've

166
07:47.060 --> 07:47.760
been used.

167
07:47.760 --> 07:51.870
Also, if we do a show access list and press center, it also have matches

168
07:51.870 --> 07:52.640
regarding when those

169
07:52.640 --> 07:56.740
access lists were hit as part of the NAT rules and path rules. And for the

170
07:56.740 --> 07:58.320
dynamic NAT, because once

171
07:58.320 --> 08:02.080
we have a NAT translation in place and until it times out, that layer 3 mapping
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

171
07:58.320 --> 08:02.080
we have a NAT translation in place and until it times out, that layer 3 mapping

172
08:02.080 --> 08:02.800
that one to one

173
08:02.800 --> 08:06.260
mapping is simply going to stay. Where on the other hand, with dynamic pad, it

174
08:06.260 --> 08:06.800
's going to simply

175
08:06.800 --> 08:11.120
map it to the outside address in our case. That's the outside interface gig 2,0

176
08:11.120 --> 08:12.640
interface on our 4.

177
08:12.640 --> 08:16.310
And then once that individual translation times out, if that client goes out

178
08:16.310 --> 08:17.440
again, it'll rematch

179
08:17.440 --> 08:20.560
on that access control list and as a result, it'll create the new translation.

180
08:20.560 --> 08:21.680
So another we have

181
08:21.680 --> 08:25.450
the opportunity to make a plan and implement that plan regarding static NAT and

182
08:25.450 --> 08:26.320
dynamic NAT and

183
08:26.320 --> 08:30.310
dynamic pad. In the next video, I'd like to present a hands-on lab that you can
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

183
08:26.320 --> 08:30.310
dynamic pad. In the next video, I'd like to present a hands-on lab that you can

184
08:30.310 --> 08:31.600
use to get practice

185
08:31.600 --> 08:35.530
working with, configuring, verifying and when needed troubleshooting pad on

186
08:35.530 --> 08:36.720
your own. So I'll see

187
08:36.720 --> 08:38.320
you in the next video in just a moment.