WEBVTT

1
00:00.000 --> 00:02.680
In this video, you and I get to put a game plan together

2
00:02.680 --> 00:06.380
for our design, implementation, and verification

3
00:06.380 --> 00:08.180
of network address translation.

4
00:08.180 --> 00:09.820
And here is what I would love to do.

5
00:09.820 --> 00:12.960
I would love to modify our existing topologies

6
00:12.960 --> 00:15.320
just a little bit, and I would like to go ahead

7
00:15.320 --> 00:17.520
and instead of having this be my management network

8
00:17.520 --> 00:19.500
that I'm double-dipping on, I'd like to go ahead

9
00:19.500 --> 00:24.500
and use VLAN 23 right here as the external segment

10
00:24.500 --> 00:26.860
where we can reach an external router over.

11
00:26.860 --> 00:29.440
So the tier zero gateway is currently connected

12
00:29.440 --> 00:32.440
to my 192.1 state network, but I'd like to go ahead
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:29.440 --> 00:32.440
to my 192.1 state network, but I'd like to go ahead

13
00:32.440 --> 00:37.000
and use VLAN 23, which has the addressing space of 23.1.2.0

14
00:37.000 --> 00:38.280
with a 24-bit mask.

15
00:38.280 --> 00:40.800
I've got an external router connected right here at .1

16
00:40.800 --> 00:42.160
on the 23.1.2 network.

17
00:42.160 --> 00:45.360
And so for edge one and edge two here,

18
00:45.360 --> 00:48.640
let's go ahead and use .61 and .62.

19
00:48.640 --> 00:51.840
Make a little note, that's edge one, and this will be edge two.

20
00:51.840 --> 00:54.160
I've also got OSPF configured on this edge already,

21
00:54.160 --> 00:56.840
so once we modify our tier zero gateway

22
00:56.840 --> 00:58.400
and move it over to this external segment

23
00:58.400 --> 01:00.880
from VLAN 23 and update the addresses,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:58.400 --> 01:00.880
from VLAN 23 and update the addresses,

24
01:00.880 --> 01:03.840
we'll also take a quick peek at the OSPF configuration

25
01:03.840 --> 01:05.680
just to make sure we have OSPF enabled

26
01:05.680 --> 01:06.800
on these two interfaces.

27
01:06.800 --> 01:08.480
And that way, this gateway right here

28
01:08.480 --> 01:10.760
can dynamically learn about the 1010 network

29
01:10.760 --> 01:13.360
and the 1020 network as we did in previous videos

30
01:13.360 --> 01:14.640
regarding IP routing.

31
01:14.640 --> 01:17.720
And in those previous videos, we did it with BGP

32
01:17.720 --> 01:19.200
and we also did it with OSPF.

33
01:19.200 --> 01:20.040
So if this gateway here,

34
01:20.040 --> 01:22.240
this external router is already configured for OSPF,

35
01:22.240 --> 01:23.600
we just need to make sure we enable it here

36
01:23.600 --> 01:24.920
on our tier zero gateway.

37
01:24.920 --> 01:26.320
I also think by doing that,

38
01:26.320 --> 01:30.000
there'll be a great exercise in walking through that process again
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:30.000 --> 01:31.680
and to see those changes being made

40
01:31.680 --> 01:33.240
and then we can verify them together.

41
01:33.240 --> 01:34.480
So our first step in our game plan

42
01:34.480 --> 01:36.160
will be to update our topology.

43
01:36.160 --> 01:38.840
Next, let's go ahead and deploy some VMs

44
01:38.840 --> 01:40.000
that we can test with.

45
01:40.000 --> 01:42.960
So we already have these four VMs already in place

46
01:42.960 --> 01:45.200
and what I'd like to do is add a couple more.

47
01:45.200 --> 01:48.760
So I'm gonna add another VM down here to segment 10

48
01:48.760 --> 01:52.080
and I'm also gonna put a little VM up here on VLAN 23

49
01:52.080 --> 01:54.240
and that way we can test and verify

50
01:54.240 --> 01:57.520
our network address translation going through our environment here.

51
01:57.520 --> 01:59.600
'Cause my intention is to go ahead and implement NAT here

52
01:59.600 --> 02:01.560
on our tier zero gateway zero.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:59.600 --> 02:01.560
on our tier zero gateway zero.

53
02:01.560 --> 02:03.680
So deploy VMs for testing.

54
02:03.680 --> 02:06.480
I also have DHCP services up here on VLAN 23

55
02:06.480 --> 02:09.120
and also down here on segment 10.

56
02:09.120 --> 02:10.200
So for the new VMs,

57
02:10.200 --> 02:12.480
I won't know what those IP addresses are gonna be exactly

58
02:12.480 --> 02:13.880
until we bring up those VMs

59
02:13.880 --> 02:15.760
and then we'll take a look and use those addresses.

60
02:15.760 --> 02:17.400
Then as we start configuring NAT,

61
02:17.400 --> 02:20.320
let's go ahead and first configure source NAT.

62
02:20.320 --> 02:22.880
Again, we're gonna do that right here on our tier zero gateway.

63
02:22.880 --> 02:24.040
And here's what I propose we do.

64
02:24.040 --> 02:27.280
Let's go ahead and let's do source NAT at tier zero

65
02:27.280 --> 02:31.240
for any traffic sourced from 10.10.anything.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:27.280 --> 02:31.240
for any traffic sourced from 10.10.anything.

66
02:31.240 --> 02:33.120
And for address translation, my lab environment,

67
02:33.120 --> 02:35.320
I've got the whole 2312 network to play with.

68
02:35.320 --> 02:37.720
So as we do that source address translation

69
02:37.720 --> 02:39.360
for traffic on our initial flow,

70
02:39.360 --> 02:40.840
it's going out to the internet.

71
02:40.840 --> 02:45.840
Let's go ahead and map that to 23.1.2.151 through.

72
02:45.840 --> 02:48.400
Let's go ahead and do 250.

73
02:48.400 --> 02:49.520
So for my lab environment,

74
02:49.520 --> 02:51.480
allowing a hundred unique IP addresses here

75
02:51.480 --> 02:52.680
that can be translated to

76
02:52.680 --> 02:54.280
but be more than enough to support

77
02:54.280 --> 02:56.080
the two or three that we're gonna have right here.

78
02:56.080 --> 02:57.400
So if we implement this,

79
02:57.400 --> 02:58.960
it's gonna be a one-to-one mapping

80
02:58.960 --> 03:01.320
for those first effectively hundred clients
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
02:58.960 --> 03:01.320
for those first effectively hundred clients

81
03:01.320 --> 03:02.160
that are going through

82
03:02.160 --> 03:04.680
and getting an address translation with source NAT.

83
03:04.680 --> 03:05.760
Or if we said, you know what,

84
03:05.760 --> 03:07.160
we just wanna map it to one address

85
03:07.160 --> 03:09.800
like 2312.151 and that's it.

86
03:09.800 --> 03:13.000
Then all those clients will be mapping to a single IP address.

87
03:13.000 --> 03:14.520
And that would be an example behind the scenes

88
03:14.520 --> 03:17.160
of using PAT or port address translation,

89
03:17.160 --> 03:18.760
just based on if it's a one-to-one mapping

90
03:18.760 --> 03:20.120
or many-to-one mapping.

91
03:20.120 --> 03:21.640
So we'll set that up and verify

92
03:21.640 --> 03:23.640
that our clients here on this network

93
03:23.640 --> 03:25.280
can go out to the internet.

94
03:25.280 --> 03:27.480
We'll also, when we update our topology verify

95
03:27.480 --> 03:28.920
that right here on this connection

96
03:28.920 --> 03:31.640
between our tier zero gateway and the external router,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
03:28.920 --> 03:31.640
between our tier zero gateway and the external router,

97
03:31.640 --> 03:33.240
we'll also verify that this gateway zero

98
03:33.240 --> 03:35.820
has a default route and that it itself

99
03:35.820 --> 03:36.960
can get up to the internet.

100
03:36.960 --> 03:39.440
That way when we add network address translation here,

101
03:39.440 --> 03:41.200
the clients who are now forwarding traffic

102
03:41.200 --> 03:43.800
out towards the internet can get the address translation

103
03:43.800 --> 03:45.200
and can go up to the internet.

104
03:45.200 --> 03:46.880
Again, that would be due to source NAT.

105
03:46.880 --> 03:48.560
Let's also walk through an exercise

106
03:48.560 --> 03:50.280
of setting up destination NAT.

107
03:50.280 --> 03:52.440
And for that, we'll pick a global address.

108
03:52.440 --> 03:55.880
Let's go ahead and pick 23.1.2.

109
03:55.880 --> 03:58.080
Let's go ahead and use 254.

110
03:58.080 --> 04:00.640
We use the last valid IP address in that range there.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
03:58.080 --> 04:00.640
We use the last valid IP address in that range there.

111
04:00.640 --> 04:02.840
And let's map that to the internal address

112
04:02.840 --> 04:03.880
of one of our VMs.

113
04:03.880 --> 04:06.960
So we could map that to VM1 or VM3 or better yet.

114
04:06.960 --> 04:09.600
We could use a new VM that we're gonna bring into play.

115
04:09.600 --> 04:11.520
And so this server right here,

116
04:11.520 --> 04:13.100
we'll go ahead and label it as server.

117
04:13.100 --> 04:14.880
It's gonna get an IP address via DHCP.

118
04:14.880 --> 04:18.020
So whatever IP address that gets, we'll use

119
04:18.020 --> 04:20.000
and we'll map the external globally-rattle address

120
04:20.000 --> 04:22.320
to 23.1.2.2.2.2.2.

121
04:22.320 --> 04:25.200
That guy's IP address, whatever it happens to be.

122
04:25.200 --> 04:27.880
And for the lab, I have this 23.1.2 network,

123
04:27.880 --> 04:31.240
which on the public internet is a valid IP address range,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
04:27.880 --> 04:31.240
which on the public internet is a valid IP address range,

124
04:31.240 --> 04:33.560
but I'm just using it privately here in my lab.

125
04:33.560 --> 04:35.720
And that way we get a very clear differentiation

126
04:35.720 --> 04:37.800
of what are the private addresses here

127
04:37.800 --> 04:39.960
and which ones are the public addresses.

128
04:39.960 --> 04:42.240
So anything in my lab environment here that starts with 23

129
04:42.240 --> 04:45.520
is a representation of a globally-rattle address

130
04:45.520 --> 04:46.360
on the internet.

131
04:46.360 --> 04:48.400
Now also, as part of this, you might ask,

132
04:48.400 --> 04:50.880
well, Keith, if you swap out on the source that part,

133
04:50.880 --> 04:53.400
if you swap out, for example, VM1's address

134
04:53.400 --> 04:56.360
and you give it 23.1.2.something in this range

135
04:56.360 --> 04:57.600
for the address translation,

136
04:57.600 --> 04:58.960
and it goes up to the internet.

137
04:58.960 --> 05:00.720
Well, the internet, if it tries to respond back,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

137
04:58.960 --> 05:00.720
Well, the internet, if it tries to respond back,

138
05:00.720 --> 05:03.080
it's gonna respond back to wherever that real address lives

139
05:03.080 --> 05:04.720
and not back to your home lab environment.

140
05:04.720 --> 05:06.920
So I also wanna point out something else

141
05:06.920 --> 05:09.560
that I have going on that's also important to know about.

142
05:09.560 --> 05:13.040
And that's this right here on the other side of this gateway.

143
05:13.040 --> 05:15.320
I am also doing NAT again.

144
05:15.320 --> 05:17.480
So I'm taking the addresses that come in

145
05:17.480 --> 05:21.040
from 23.1 to anything after we do our NAT work here.

146
05:21.040 --> 05:24.200
And I'm mapping it over to globally-rattle addresses

147
05:24.200 --> 05:25.680
over here on this device as well.

148
05:25.680 --> 05:28.200
And that way, as this client really goes up to the internet,

149
05:28.200 --> 05:29.720
it's actually having that happen here,

150
05:29.720 --> 05:31.120
which we'll verify together.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

150
05:29.720 --> 05:31.120
which we'll verify together.

151
05:31.120 --> 05:32.960
And it's also having that happen here

152
05:32.960 --> 05:34.920
just for reachability to the public internet.

153
05:34.920 --> 05:37.240
So all that second layer of NAT isn't too critical

154
05:37.240 --> 05:39.320
like for a production environment to be aware of.

155
05:39.320 --> 05:40.680
I did want you in my lab environment

156
05:40.680 --> 05:42.320
to be aware of how I'm pulling that off.

157
05:42.320 --> 05:43.560
So that is our game plan.

158
05:43.560 --> 05:44.400
So in our next video,

159
05:44.400 --> 05:46.560
we're gonna begin with the update of our topology,

160
05:46.560 --> 05:48.200
verify basic connectivity,

161
05:48.200 --> 05:49.840
then we'll proceed to VM deployment

162
05:49.840 --> 05:51.960
and then source NAT and destination NAT.

163
05:51.960 --> 05:55.120
I'll see you as we continue this journey in the next video.