WEBVTT

00:00:00.000 --> 00:00:12.000
So we'll begin here with Network Address Translation or NAT for short, but in reality we're going to cover Network Address Translation and Port Address Translation in this discussion.

00:00:12.000 --> 00:00:29.000
So why do we need something like Network Address Translation? Well it really comes down to the fact that we need a way to go to the Internet even though we have IP addresses on our systems that don't allow us to do so.

00:00:29.000 --> 00:00:42.000
Remember, inside your organization you're using private RFC 1918 addresses. So your address ranges are what? 10.0.0.0 to 10.255.255.255.

00:00:42.000 --> 00:00:57.000
You have 172.16.0.0 to 172.31.255.255 and then you got 192.168.0.0 to 192.168.255.255. Those are the three different ranges you have that you can carve up and submit as you need to.

00:00:57.000 --> 00:01:08.000
The thing about these RFC 1918 addresses is we're all using them inside of our organizations. I use them, you use them, we use them in our homes, we use them in our headquarters, our branch offices, our data centers and so on and so forth.

00:01:08.000 --> 00:01:22.000
And so because all of our devices are addressed with these RFC 1918 addresses, we can't allow them on the Internet because if we allowed them on the Internet then that would conflict with other people that are using that exact same addressing space.

00:01:22.000 --> 00:01:43.000
So what do we have out on the Internet? We have public IP addressing out on the Internet. So we need a way to allow our users who are using private IP addresses in order to go to the Internet and use a public IP address while they're on the Internet and that's where network address translation comes into play.

00:01:44.000 --> 00:01:57.000
So over here as an example we have PC number one. They are 10.0.0.10. And so they built a packet and that packet is sourced from them going over to the web server at 8.8.8.8 in our example up in the upper right hand corner.

00:01:57.000 --> 00:02:15.000
And so this is created by the PC. It's going to be sent out on the network and these RFC 1918 addresses are routable inside of our organization. So the packet can be routed based on any type of destination private IP address.

00:02:15.000 --> 00:02:36.000
In this case we have a destination public IP address but if the destination was private as in when the traffic is returning it's routable through our environment. The thing is that they're not routable on the Internet. So your service providers are blocking the ability for you to be able to accidentally send or on purpose send packets to the Internet that are sourced or destined or whatever from these private IP addresses.

00:02:36.000 --> 00:03:04.000
But you should really consider yourself making sure that you have an access control list set up at the edge of your environment that is denying all traffic from leaving your network if it is sourced from any one of those public IP addressing spaces. This is going to protect you just in case. So that way there are nothing accidentally goes out here unless it absolutely needs to go out there after it has been translated.

00:03:06.000 --> 00:03:25.000
Nothing should leave my environment unless it has successfully gone through network address translation. So in this case I'm just denying all of those RFC 1918 ranges and we're permitting what we're going to be using for network address translation from a public IP addressing standpoint as source addresses. And then I'm denying that on my interface outbound in that case.

00:03:26.000 --> 00:03:44.000
So this ensures that in the end if network translation fails or doesn't work the packets not allowed to leave the environment because the access control list is going to block it in that particular case. So now when we get to this network this router here this router is the entity that's running network address translation in this particular environment.

00:03:45.000 --> 00:04:07.000
So what it has to be configured with is network address translation policies network address translation configurations is a better way to put it in this case is not actually policies. So we have these network address translation configurations and it's going to identify how we want to do translation. So in this particular case we are going to be translated anything that is sourced from this address to this address right over here.

00:04:07.000 --> 00:04:20.000
So we go back one page it's this address to this address. So there is a source address. We need to route it out. So we got to translate it over to that. So the router is going to successfully translate it for us.

00:04:21.000 --> 00:04:46.000
And then it can go and it keeps an entry of that in its NAT table. So this is our NAT table. And so now keeps an entry of what is the private IP what is the public IP we translated it to and what is the destination that they are trying to reach. And this is important because when the traffic comes back all three of these pieces of information are going to be necessary in order to translate the traffic when it arrives back at the environment.

00:04:47.000 --> 00:05:04.000
So in this particular case now we can send it out and it goes and goes and goes and goes and goes and goes until it reaches the destination. So as you can see it's actually sourced now from an address that's associated with that particular router for network address translation. It's no longer sourced from the client.

00:05:04.000 --> 00:05:29.000
So you kind of get to hide your clients from the Internet and a lot of people consider that a security feature and there are I recently wrote a book the CCST cybersecurity book for Cisco and Cisco makes a note that yes network address translation is a type of security. Not really like when you really get into the deep details of network address translation.

00:05:29.000 --> 00:05:46.000
Yes it provides a little bit of security by masking your clients nobody can see who exactly the client is but in reality if a cyber criminal if a cyber criminal really wants to figure it out they're going to be able to figure it out right they're going to be able to get to your client regardless of whether you hide their real IP address or not.

00:05:46.000 --> 00:06:04.000
So yeah it's a type of obfuscation it's a type of obfuscation absolutely when you think about it but you know it's if you if somebody asked me as a CISSP is network address translation security I know it's not right it's what to translate addresses.

00:06:04.000 --> 00:06:25.000
Yeah but you know you don't really know the client IP look cyber criminals this is a joke to them this is a joke this is nothing. So if you're just using network address translation as a form of security for yourself you know beyond that you need firewalls you need a whole bunch of other security features in order to make sure you're secure and that's not going to do it for you when it's all said and done.

00:06:26.000 --> 00:06:43.000
All right but yeah I mean if I'll tell you this though but on Cisco exams if and you probably won't have it on this exam but if you ever had a Cisco exam and they said what are the following benefits benefits of using that one of the things that Cisco expects you know that security okay well yes and no all right.

00:06:43.000 --> 00:07:06.000
But for in the Cisco world you say yes but if you're a CISSP you'd be like no no no no. All right so with that in mind now our web server has gobbled it up in this particular case and so now when it creates a packet to return everything to the source remember our source is this but here's the deal right now the source is actually this when you think about it.

00:07:06.000 --> 00:07:20.000
So we create from the source of the web server to the destination of this so return traffic so notice how everything's flipped over now right so this was the original source coming to the web server so now it's the destination coming back so everything's flipped.

00:07:20.000 --> 00:07:44.000
So now eventually that all arrives back and this is where that NAT table becomes very very important you know remember how we kept track of who the destination was do you remember that in the NAT table well thank goodness we did because come back here originally we kept track of the destination and the destination was 8 8 8 8.

00:07:45.000 --> 00:08:08.000
That's where we're going who on the internet are we going to this is important because now we receive something with this and this so we have this piece of the puzzle this piece of the puzzle okay what is this piece of the puzzle then and that's where the table comes into play the table says okay so now if it's source from this going to this so source from this going to this change it back to this so we changed it back to that.

00:08:09.000 --> 00:08:23.000
Right and now we can go ahead and route it and now that we route it we send it on its way so NAT on the way on the way out routing happens first NAT happens second on the way back NAT happens first routing happens second.

00:08:23.000 --> 00:08:52.000
All right so that's the gist of NAT now the thing about NAT is there's many different ways that we can implement it for example the way I just described to you is just one way it's about translating private IP addresses to public IP addresses that's what we're doing but you can use NAT in four different combinations for example you can do private to public translations like we're doing here but you can do private to private translations this is typically common when you are merging two companies together and if you're both using the 10 network.

00:08:53.000 --> 00:09:12.000
And you have overlapping address spaces for a temporarily temporary solution you might NAT between those two environments so that way there you don't have IP addressing conflicts in that particular case you might do public to private translation so for example in a scenario where you have a server inside your environment.

00:09:12.000 --> 00:09:41.000
That needs to be accessible from the Internet obviously the server wouldn't be located there if it was accessible from the Internet but let's say there's a private IP address well in this case we'd be doing public to private IP addressing so when people try to access my server then the public address that is well known on the Internet is translated to the private address so we can get to the server and back so nobody really knows the private IP address of the server they just know the public IP address of the server but I mean if a cyber criminal really wanted to figure it out they'd be.

00:09:42.000 --> 00:10:09.000
Able to the good ones anyways and the last but not least public to public that's right you know out there there might be scenarios where ISPs are doing public to public translation for different situations and services right so our goal for the exam is to be available or be able to configure verify and troubleshoot private to public translation so that's what our discussions can be about so in that case we need to have very specific terms that we know and that is inside local address.

00:10:09.000 --> 00:10:19.000
So the inside local address in this particular case is going to be the private IP address inside our network so that's the private IP address inside our network.

00:10:19.000 --> 00:10:47.000
The inside global address is a little bit confusing but what I want you to realize that's the public IP address we're translating to so that's the public IP we're translating to so even though it says inside global right it's the public IP address we're translating the private IP addresses to and then outside global address that's who we're trying to reach so those are the three different pieces of information that are critical for us to be successful in this particular case.

00:10:48.000 --> 00:10:53.000
So we have our private inside RFC 1918 addresses in this scenario.

00:10:53.000 --> 00:11:14.000
Fighting me today 1918 addresses and then you have your public IP addresses that you'd get from your service provider that you can use for this scenario and then last but not least whoever you're trying to reach so this is going to be dynamically populated based on the NAT device.

00:11:14.000 --> 00:11:43.000
Same thing with this one same thing with this one but this one is going to be from you know a set a set grouping or it could be one address or multiple IP addresses that are used for the public connectivity so when it comes to NAT we have static NAT dynamic NAT PAT and dynamic NAT with PAT that we had to be ready for for the certification exam so let's begin with static NAT so static NAT uses a one-to-one address mapping so what do I mean by one-to-one address mapping?

00:11:44.000 --> 00:12:13.000
It means that you need one public address for every private IP address that you have that's right so if you have five private users then you need five public addresses so if you have a thousand users that means you're going to need a thousand public IP addresses so let me ask you this folks how many of you have or how many public IP addresses do you have for your organization?

00:12:14.000 --> 00:12:31.000
Chat in all right so Andrew says about two hundred and fifty four ish public IP addresses Joshua are you a service provider?

00:12:31.000 --> 00:12:59.000
45,000 John says we have a class C up figures you are 45,000 so John says class C so another so you know this is um this is um these are actually abnormal answers in my Encore class so typically when we're teaching CCNA typically we're teaching Encore we typically have people saying oh I've got either one

00:12:59.000 --> 00:13:21.000
public IP or potentially they have seven or eight public IPs like in powers of two so they might have one or two or four or eight or sixteen and so on and so forth so that's typically what you find but today here we have some people are saying they've got 254

00:13:21.000 --> 00:13:49.000
and 45,000 so from a typical standpoint it's very tough nowadays especially to get a lot of public IP addresses and so if you need a one-to-one relationship this this would not work for you because even to get you know seven public IP addresses today is a challenging it's challenging when it comes to IPv4 so when

00:13:49.000 --> 00:14:17.000
it's all said and done this type of NAT is reserved for those specific circumstances where you want to one manually so statically manually control exactly which private IP gets converted to which public IP and when that public IP is in use or sorry once that public IP

00:14:17.000 --> 00:14:37.000
is mapped then no one else can use it it's reserved for that specific device so any scenario that's on the exam that says you want to make sure that this public IP is always assigned to that device no matter what and nobody else can use it then static NAT is the way to go and you would

00:14:37.000 --> 00:15:06.000
actually manually configure this and so it doesn't make sense when you have let's say 5,000 users that all need a public IP address to do something like this because the odds of getting 5,000 public IP addresses is slim and you manually having to map all of them just doesn't make sense in that type of environment so first of all let's talk about enabling NAT on our interfaces

00:15:06.000 --> 00:15:34.000
so we have the concept of inside interfaces and then we have the concept of outside interfaces you can have multiple inside interfaces you can have multiple outside interfaces what does this do it teaches your router how to handle traffic for translation so for example in this case this is an inside interface

00:15:34.000 --> 00:16:02.000
and inside interface and inside interface and outside interface based on my configuration so what this means is that if traffic arrives on an inbound interface and is leaving an inbound interface translation does not happen if it arrives on an in interface and goes out and out interface then translation has to happen

00:16:02.000 --> 00:16:26.000
based on our configuration that then means if traffic is coming this way in and out interface it then has to be translated back before it can be routed out and in interface and then if you're coming in and out interface leaving an out interface you wouldn't be translated either in that particular case

00:16:26.000 --> 00:16:50.000
so what you need to be aware of for the certification exam is that the right interfaces have been configured for inside and outside so based on some topology some diagrams some scenario anything they're providing to you and you compare that to configuration are those the right inside interfaces are those the right outside interfaces

00:16:56.000 --> 00:16:58.000
you

00:16:58.000 --> 00:17:00.000
you

00:17:00.000 --> 00:17:02.000
you

00:17:02.000 --> 00:17:04.000
you

00:17:04.000 --> 00:17:06.000
you

00:17:06.000 --> 00:17:08.000
you

00:17:08.000 --> 00:17:10.000
you

00:17:10.000 --> 00:17:12.000
waiting Andrew

00:17:12.000 --> 00:17:14.000
so that's number one make sure

00:17:15.000 --> 00:17:34.000
yeah so Andrew so there if you're saying there are scenarios where you do some hairpin on your outside interface that gets natted then that's fine like there are always exceptions to the rule okay there's always exceptions to the rule right but under typical

00:17:34.000 --> 00:17:58.000
conditions this is how you know it would function but absolutely we you can totally set it up I've done it before in firewalls as well where you do the hairpin turn and basically it's almost like it will goes to an inside a different interface then comes back out gets translated again I've done those on like three armed firewalls and different things like that as well yeah yeah

00:17:58.000 --> 00:18:00.000
yeah

00:18:00.000 --> 00:18:02.000
yeah

00:18:02.000 --> 00:18:04.000
yeah

00:18:04.000 --> 00:18:06.000
yeah

00:18:06.000 --> 00:18:08.000
yeah

00:18:08.000 --> 00:18:10.000
yeah

00:18:10.000 --> 00:18:12.000
yeah

00:18:12.000 --> 00:18:14.000
yeah

00:18:14.000 --> 00:18:16.000
so now inside outside

00:18:16.000 --> 00:18:18.000
interfaces be able to verify them on the exam

00:18:18.000 --> 00:18:20.000
next

00:18:20.000 --> 00:18:22.000
this is the static configuration

00:18:22.000 --> 00:18:24.000
say we need one of

00:18:24.000 --> 00:18:26.000
these for each

00:18:26.000 --> 00:18:28.000
and every single

00:18:28.000 --> 00:18:30.000
manual static mapping

00:18:30.000 --> 00:18:32.000
that you want to have

00:18:36.000 --> 00:18:38.000
so we have here

00:18:38.000 --> 00:18:40.000
ipnat inside source

00:18:40.000 --> 00:18:42.000
and this is going to be the command

00:18:42.000 --> 00:18:44.000
for all of your

00:18:44.000 --> 00:18:46.000
examples ipnat

00:18:46.000 --> 00:18:48.000
inside source why is

00:18:48.000 --> 00:18:50.000
that because we are translating

00:18:50.000 --> 00:18:52.000
an inside source

00:18:52.000 --> 00:18:54.000
address that's what we're translating

00:18:54.000 --> 00:18:56.000
so ipnat inside

00:18:56.000 --> 00:18:58.000
source the source is insider

00:18:58.000 --> 00:19:00.000
network so this is

00:19:00.000 --> 00:19:02.000
the command ipnat inside source that is used for

00:19:02.000 --> 00:19:04.000
our private to public translations

00:19:06.000 --> 00:19:08.000
so now because we're doing

00:19:08.000 --> 00:19:10.000
static NAT we type in the static

00:19:10.000 --> 00:19:12.000
keyword and then

00:19:12.000 --> 00:19:14.000
we can go ahead and we can specify

00:19:14.000 --> 00:19:16.000
the RFC 1918

00:19:16.000 --> 00:19:18.000
address that we want to have translated

00:19:18.000 --> 00:19:20.000
so in this case 10.0.0.10

00:19:20.000 --> 00:19:22.000
and then the public

00:19:22.000 --> 00:19:24.000
IP address that we want it translated to

00:19:24.000 --> 00:19:26.000
so that would be

00:19:26.000 --> 00:19:28.000
a public IP address that I would have had to receive

00:19:28.000 --> 00:19:30.000
for my ISP as an example

00:19:30.000 --> 00:19:32.000
and now we

00:19:32.000 --> 00:19:34.000
have a static

00:19:34.000 --> 00:19:36.000
mapping for that so for every single

00:19:36.000 --> 00:19:38.000
translation you want to have you're going

00:19:38.000 --> 00:19:40.000
to need to have a static translation

00:19:46.000 --> 00:19:48.000
there is a parameter

00:19:48.000 --> 00:19:50.000
I want to tell you about here so I'm just

00:19:50.000 --> 00:19:52.000
going to run out to R2 as an example

00:19:52.000 --> 00:19:54.000
I don't have

00:19:54.000 --> 00:19:56.000
it in my slides but I've

00:19:56.000 --> 00:19:58.000
added it recently to my notes

00:19:58.000 --> 00:20:00.000
so we'll type in ipnat

00:20:00.000 --> 00:20:02.000
inside source

00:20:02.000 --> 00:20:04.000
and let's say 10.0.0.10

00:20:04.000 --> 00:20:06.000
and then we'll go to

00:20:06.000 --> 00:20:08.000
203.0.113.

00:20:08.000 --> 00:20:10.000
just say

00:20:10.000 --> 00:20:12.000
91 as an example

00:20:20.000 --> 00:20:22.000
alright

00:20:22.000 --> 00:20:24.000
this extendable

00:20:24.000 --> 00:20:26.000
I want to talk about this one here

00:20:26.000 --> 00:20:28.000
extendable

00:20:28.000 --> 00:20:30.000
so what you need to

00:20:30.000 --> 00:20:32.000
realize is that for

00:20:32.000 --> 00:20:34.000
every single

00:20:34.000 --> 00:20:36.000
private IP

00:20:36.000 --> 00:20:38.000
address

00:20:38.000 --> 00:20:40.000
for every single private

00:20:40.000 --> 00:20:42.000
IP address

00:20:42.000 --> 00:20:44.000
you can only have one

00:20:44.000 --> 00:20:46.000
static

00:20:46.000 --> 00:20:48.000
translation

00:20:48.000 --> 00:20:50.000
one static

00:20:50.000 --> 00:20:52.000
translation so if I tried to create another

00:20:52.000 --> 00:20:54.000
one I wouldn't be allowed

00:20:54.000 --> 00:20:56.000
to do that

00:20:56.000 --> 00:20:58.000
unless I add the

00:20:58.000 --> 00:21:00.000
extendable parameter

00:21:00.000 --> 00:21:02.000
the extendable

00:21:02.000 --> 00:21:04.000
parameter so

00:21:04.000 --> 00:21:06.000
if I wanted to create another one let's say

00:21:06.000 --> 00:21:08.000
static 10.0.0.10

00:21:08.000 --> 00:21:10.000
and give it another

00:21:10.000 --> 00:21:12.000
public IP address

00:21:12.000 --> 00:21:14.000
I would have to put extendable on the other

00:21:14.000 --> 00:21:16.000
ones in order for it to be accepted

00:21:16.000 --> 00:21:18.000
so the static NAT

00:21:18.000 --> 00:21:20.000
extendable parameter is going

00:21:20.000 --> 00:21:22.000
to be used if you want to translate

00:21:22.000 --> 00:21:24.000
a single

00:21:24.000 --> 00:21:26.000
private IP address

00:21:26.000 --> 00:21:28.000
to more than

00:21:28.000 --> 00:21:30.000
one public IP address let me repeat

00:21:30.000 --> 00:21:32.000
that the extendable parameter

00:21:32.000 --> 00:21:34.000
would be utilized if you want to

00:21:34.000 --> 00:21:36.000
translate a single private

00:21:36.000 --> 00:21:38.000
IP address to more

00:21:38.000 --> 00:21:40.000
than one public IP address

00:21:46.000 --> 00:21:48.000
another

00:21:48.000 --> 00:21:50.000
keyword and it's not here another keyword

00:21:50.000 --> 00:21:52.000
though that I want you to think about that they might throw at you

00:21:52.000 --> 00:21:54.000
on the exam because

00:21:54.000 --> 00:21:56.000
they

00:21:56.000 --> 00:21:58.000
people who create exam questions

00:21:58.000 --> 00:22:00.000
have

00:22:00.000 --> 00:22:02.000
to do it in a way where they're not

00:22:02.000 --> 00:22:04.000
giving the answer away

00:22:04.000 --> 00:22:06.000
and sometimes

00:22:06.000 --> 00:22:08.000
they use words that

00:22:08.000 --> 00:22:10.000
they've pulled out of a thesaurus

00:22:10.000 --> 00:22:12.000
and

00:22:12.000 --> 00:22:14.000
it's not something you would

00:22:14.000 --> 00:22:16.000
normally utilize or say yourself

00:22:16.000 --> 00:22:18.000
ever

00:22:18.000 --> 00:22:20.000
and so for example

00:22:20.000 --> 00:22:22.000
if I said to you I wanted you

00:22:22.000 --> 00:22:24.000
to create a network

00:22:24.000 --> 00:22:26.000
address translation

00:22:26.000 --> 00:22:28.000
for

00:22:28.000 --> 00:22:30.000
a client and I wanted

00:22:30.000 --> 00:22:32.000
to be deterministic

00:22:32.000 --> 00:22:34.000
deterministic

00:22:34.000 --> 00:22:36.000
alright that means

00:22:36.000 --> 00:22:38.000
static NAT okay that means static

00:22:38.000 --> 00:22:40.000
NAT don't let the word deterministic

00:22:40.000 --> 00:22:42.000
throw you off it means

00:22:42.000 --> 00:22:44.000
static NAT in that case

00:22:44.000 --> 00:22:46.000
so

00:22:46.000 --> 00:22:48.000
you see the word deterministic you're going with

00:22:48.000 --> 00:22:50.000
a IP NAT inside source

00:22:50.000 --> 00:22:52.000
static and define the values you need

00:22:52.000 --> 00:22:54.000
and if you have to assign more than one public

00:22:54.000 --> 00:22:56.000
IP address to that one address don't forget about

00:22:56.000 --> 00:22:58.000
the extendable keyword

00:22:58.000 --> 00:23:00.000
alright so now when you do that for

00:23:00.000 --> 00:23:02.000
every single IP address

00:23:02.000 --> 00:23:04.000
you do that to folks you're going to

00:23:04.000 --> 00:23:06.000
get one of these entries in your NAT

00:23:06.000 --> 00:23:08.000
table

00:23:08.000 --> 00:23:10.000
basically

00:23:10.000 --> 00:23:12.000
this is a placeholder

00:23:12.000 --> 00:23:14.000
it's locked in which means

00:23:14.000 --> 00:23:16.000
this address always gets

00:23:16.000 --> 00:23:18.000
this address and no one else can

00:23:18.000 --> 00:23:20.000
have it

00:23:20.000 --> 00:23:22.000
and then every time that device communicates

00:23:22.000 --> 00:23:24.000
10.0.0.10

00:23:24.000 --> 00:23:26.000
for example you can see they went to the

00:23:26.000 --> 00:23:28.000
internet in this example

00:23:28.000 --> 00:23:30.000
notice that all of a sudden

00:23:30.000 --> 00:23:32.000
there is a we'll call it dynamic

00:23:32.000 --> 00:23:34.000
entry in the table it just magically

00:23:34.000 --> 00:23:36.000
appeared so for

00:23:36.000 --> 00:23:38.000
every flow of traffic

00:23:38.000 --> 00:23:40.000
from that PC now

00:23:40.000 --> 00:23:42.000
10.0.0.10 that goes to the internet

00:23:42.000 --> 00:23:44.000
there will be an entry

00:23:44.000 --> 00:23:46.000
added to the table for that

00:23:46.000 --> 00:23:48.000
communication flow and that's important

00:23:48.000 --> 00:23:50.000
there has to be right there has to be

00:23:50.000 --> 00:23:52.000
because when

00:23:52.000 --> 00:23:54.000
you go out and then you come

00:23:54.000 --> 00:23:56.000
back we need that translated back

00:23:56.000 --> 00:23:58.000
so if I go to a different outside address

00:23:58.000 --> 00:24:00.000
there's got to be a mapping in here

00:24:00.000 --> 00:24:02.000
for that so the traffic comes back

00:24:02.000 --> 00:24:04.000
we can map it back right now we go

00:24:04.000 --> 00:24:06.000
out we got to record everything so when the traffic comes

00:24:06.000 --> 00:24:08.000
back we can map it back so we've got to keep track

00:24:08.000 --> 00:24:10.000
of that as we go along so

00:24:10.000 --> 00:24:12.000
if this device all of a sudden makes 30 connections

00:24:12.000 --> 00:24:14.000
to the internet there will be 30

00:24:14.000 --> 00:24:16.000
entries in here for that particular

00:24:16.000 --> 00:24:18.000
client plus the static one

00:24:18.000 --> 00:24:20.000
that's holding on to that position for it

00:24:20.000 --> 00:24:22.000
we look

00:24:22.000 --> 00:24:24.000
down here and show IP NAT statistics

00:24:24.000 --> 00:24:26.000
for the exam really what are you going to need out of

00:24:26.000 --> 00:24:28.000
this is how do I verify the outside

00:24:28.000 --> 00:24:30.000
interfaces and the inside interfaces

00:24:30.000 --> 00:24:32.000
and when we get to other discussions there will be a little bit more

00:24:32.000 --> 00:24:34.000
information in here in regards to that

00:24:34.000 --> 00:24:36.000
alright so that's static NAT

00:24:36.000 --> 00:24:38.000
think about any scenario where they're asking you

00:24:38.000 --> 00:24:40.000
to make sure that a certain

00:24:40.000 --> 00:24:42.000
address is always used

00:24:42.000 --> 00:24:44.000
by a specific client

00:24:44.000 --> 00:24:46.000
regardless of the reason for it

00:24:46.000 --> 00:24:48.000
even if it doesn't make sense for the real world

00:24:48.000 --> 00:24:50.000
then okay well I'm going to have to use a static

00:24:50.000 --> 00:24:52.000
NAT for that and so

00:24:52.000 --> 00:24:54.000
basically you're reserving that IP

00:24:54.000 --> 00:24:56.000
address for that client

00:24:56.000 --> 00:24:58.000
alright so dynamic NAT on the other hand

00:24:58.000 --> 00:25:00.000
allows us to avoid

00:25:00.000 --> 00:25:02.000
having to manually do all of our

00:25:02.000 --> 00:25:04.000
translations so with static NAT

00:25:04.000 --> 00:25:06.000
you're manually doing all your translations

00:25:06.000 --> 00:25:08.000
with dynamic NAT you're going to let the router

00:25:08.000 --> 00:25:10.000
just dynamically pick

00:25:10.000 --> 00:25:12.000
the translations on its own

00:25:12.000 --> 00:25:14.000
but

00:25:14.000 --> 00:25:16.000
I want you to realize even though it says a many to many

00:25:16.000 --> 00:25:18.000
address mapping what does that mean it means

00:25:18.000 --> 00:25:20.000
that I'm going to have many private IP addresses

00:25:20.000 --> 00:25:22.000
to many public IP addresses

00:25:22.000 --> 00:25:24.000
but what a lot of people don't realize

00:25:24.000 --> 00:25:26.000
is that when you just implement dynamic NAT as

00:25:26.000 --> 00:25:28.000
such what happens is that

00:25:28.000 --> 00:25:30.000
once your router grabs

00:25:30.000 --> 00:25:32.000
a public IP address and

00:25:32.000 --> 00:25:34.000
gives it to a specific private

00:25:34.000 --> 00:25:36.000
IP address no one else

00:25:36.000 --> 00:25:38.000
can use that

00:25:38.000 --> 00:25:40.000
until

00:25:40.000 --> 00:25:42.000
that user no longer needs

00:25:42.000 --> 00:25:44.000
it and approximately

00:25:44.000 --> 00:25:46.000
30 minutes has expired without

00:25:46.000 --> 00:25:48.000
them communicating ever again so

00:25:48.000 --> 00:25:50.000
typically what happens if you use this

00:25:50.000 --> 00:25:52.000
option during the day as soon as a

00:25:52.000 --> 00:25:54.000
user is given one of the public IP addresses from

00:25:54.000 --> 00:25:56.000
the pool then

00:25:56.000 --> 00:25:58.000
they're typically going to be using that one for the rest of the

00:25:58.000 --> 00:26:00.000
day because they're going to be chatty

00:26:00.000 --> 00:26:02.000
at least once every 30 minutes

00:26:02.000 --> 00:26:04.000
and so they'll just keep using that same address

00:26:04.000 --> 00:26:06.000
right

00:26:06.000 --> 00:26:08.000
so problem

00:26:08.000 --> 00:26:10.000
just like with static NAT you need one public

00:26:10.000 --> 00:26:12.000
IP address essentially for

00:26:12.000 --> 00:26:14.000
every single private

00:26:14.000 --> 00:26:16.000
IP address that you have in order

00:26:16.000 --> 00:26:18.000
to make this work appropriately

00:26:18.000 --> 00:26:20.000
inside

00:26:20.000 --> 00:26:22.000
interfaces outside interfaces same as before

00:26:22.000 --> 00:26:24.000
now here

00:26:24.000 --> 00:26:26.000
instead we've got a pool

00:26:26.000 --> 00:26:28.000
and we've got an access control

00:26:28.000 --> 00:26:30.000
list so if you look

00:26:30.000 --> 00:26:32.000
down at our IP NAT inside source

00:26:32.000 --> 00:26:34.000
command you'll see that there's a list

00:26:34.000 --> 00:26:36.000
50 that is referring

00:26:36.000 --> 00:26:38.000
to the access control list

00:26:38.000 --> 00:26:40.000
and then you have the pool

00:26:40.000 --> 00:26:42.000
stormwind demos which

00:26:42.000 --> 00:26:44.000
is referring to the actual pool

00:26:44.000 --> 00:26:46.000
itself so what

00:26:46.000 --> 00:26:48.000
is list 50 those are going

00:26:48.000 --> 00:26:50.000
to be the private IP addresses

00:26:50.000 --> 00:26:52.000
what do we call those again the

00:26:52.000 --> 00:26:54.000
inside local

00:26:54.000 --> 00:26:56.000
addresses that's what it is

00:26:56.000 --> 00:26:58.000
and so these are now going to be the public

00:26:58.000 --> 00:27:00.000
IP addresses and they're

00:27:00.000 --> 00:27:02.000
going to be the wow that doesn't say

00:27:02.000 --> 00:27:04.000
public pub

00:27:04.000 --> 00:27:06.000
lick there we go and these are going to be

00:27:06.000 --> 00:27:08.000
your in side

00:27:08.000 --> 00:27:10.000
global addresses

00:27:18.000 --> 00:27:20.000
make sure you know those terms

00:27:20.000 --> 00:27:22.000
for the certification exam

00:27:23.000 --> 00:27:25.000
so if we look at our access control

00:27:25.000 --> 00:27:27.000
list notice that this

00:27:27.000 --> 00:27:29.000
access control list is

00:27:29.000 --> 00:27:31.000
only showing

00:27:31.000 --> 00:27:33.000
three addresses in

00:27:33.000 --> 00:27:35.000
total that's it we have

00:27:35.000 --> 00:27:37.000
10.0.0.10

00:27:37.000 --> 00:27:39.000
we have 10.0.1.50

00:27:39.000 --> 00:27:41.000
and we have 10.0.2.20

00:27:41.000 --> 00:27:43.000
for the

00:27:43.000 --> 00:27:45.000
access control is 50

00:27:45.000 --> 00:27:47.000
why did I do it that way in this

00:27:47.000 --> 00:27:49.000
particular example because look

00:27:49.000 --> 00:27:51.000
at your global addresses look at your public

00:27:51.000 --> 00:27:53.000
IP addresses this

00:27:53.000 --> 00:27:55.000
pool here IP

00:27:55.000 --> 00:27:57.000
NAT pool called it storm

00:27:57.000 --> 00:27:59.000
wind demo notice how there's only

00:27:59.000 --> 00:28:01.000
three addresses

00:28:03.000 --> 00:28:05.000
we have 92

00:28:05.000 --> 00:28:07.000
we have 93 and we have

00:28:07.000 --> 00:28:09.000
94 that's it

00:28:09.000 --> 00:28:11.000
so with this particular configuration

00:28:11.000 --> 00:28:13.000
there's

00:28:13.000 --> 00:28:15.000
only three public IP

00:28:15.000 --> 00:28:17.000
addresses so it doesn't

00:28:17.000 --> 00:28:19.000
make sense for me to have an access control

00:28:19.000 --> 00:28:21.000
that includes more than

00:28:21.000 --> 00:28:23.000
three devices

00:28:23.000 --> 00:28:25.000
especially if they all

00:28:25.000 --> 00:28:27.000
need to access the internet at the same time it

00:28:27.000 --> 00:28:29.000
wouldn't make sense because once the three

00:28:29.000 --> 00:28:31.000
addresses are consumed by

00:28:31.000 --> 00:28:33.000
three devices

00:28:33.000 --> 00:28:35.000
then they can't be used

00:28:35.000 --> 00:28:37.000
by anybody else unless

00:28:37.000 --> 00:28:39.000
those devices are no

00:28:39.000 --> 00:28:41.000
longer using them anymore

00:28:41.000 --> 00:28:43.000
and in the 30 minutes expires

00:28:43.000 --> 00:28:45.000
the timeout period

00:28:45.000 --> 00:28:47.000
so in this case

00:28:47.000 --> 00:28:49.000
dynamic

00:28:49.000 --> 00:28:51.000
NAT is using a scenario where

00:28:51.000 --> 00:28:53.000
you have

00:28:53.000 --> 00:28:55.000
certain systems

00:28:55.000 --> 00:28:57.000
whereby

00:28:57.000 --> 00:28:59.000
you want them to always

00:28:59.000 --> 00:29:01.000
use

00:29:01.000 --> 00:29:03.000
the same

00:29:03.000 --> 00:29:05.000
IP addresses that are

00:29:05.000 --> 00:29:07.000
in a group but you

00:29:07.000 --> 00:29:09.000
don't care which one they use from that group

00:29:09.000 --> 00:29:11.000
for example I don't care

00:29:11.000 --> 00:29:13.000
which IP address is used by

00:29:13.000 --> 00:29:15.000
10.0.0.10 any of those three is fine

00:29:15.000 --> 00:29:17.000
I don't care which one 1.50

00:29:17.000 --> 00:29:19.000
any of those three is fine

00:29:19.000 --> 00:29:21.000
I don't care 220 any of those three is fine

00:29:21.000 --> 00:29:23.000
so I'm just letting my

00:29:23.000 --> 00:29:25.000
device my router

00:29:25.000 --> 00:29:27.000
just give each one

00:29:27.000 --> 00:29:29.000
whichever one it wants to at that moment

00:29:29.000 --> 00:29:31.000
in time when it needs to

00:29:33.000 --> 00:29:35.000
if the pool

00:29:35.000 --> 00:29:37.000
did not have enough addresses

00:29:37.000 --> 00:29:39.000
just remember this

00:29:39.000 --> 00:29:41.000
once

00:29:41.000 --> 00:29:43.000
the pool is exhausted

00:29:43.000 --> 00:29:45.000
then the rest of the devices that need

00:29:45.000 --> 00:29:47.000
addresses would not be able to connect

00:29:47.000 --> 00:29:49.000
to the internet so that's

00:29:49.000 --> 00:29:51.000
something to keep in mind on the exam when you configure verify

00:29:51.000 --> 00:29:53.000
and troubleshoot NAT

00:29:53.000 --> 00:29:55.000
double check

00:29:55.000 --> 00:29:57.000
how is this NAT configuration set

00:29:57.000 --> 00:29:59.000
up it's set up in a way

00:29:59.000 --> 00:30:01.000
whereby I have to

00:30:01.000 --> 00:30:03.000
have the same number of public IPs

00:30:03.000 --> 00:30:05.000
as I do private IPs

00:30:05.000 --> 00:30:07.000
so if the scenario has 10

00:30:07.000 --> 00:30:09.000
private IPs and there's only 5 public

00:30:09.000 --> 00:30:11.000
addresses and 5 users at any given

00:30:11.000 --> 00:30:13.000
time cannot go to the internet

00:30:13.000 --> 00:30:15.000
so if the scenario is talking about

00:30:15.000 --> 00:30:17.000
intermittent connectivity or they can't get to

00:30:17.000 --> 00:30:19.000
the internet and you look at this and you're like oh

00:30:19.000 --> 00:30:21.000
yeah there's just not enough addresses in the pool

00:30:21.000 --> 00:30:23.000
for the number of users that are there

00:30:23.000 --> 00:30:25.000
so you'd have to

00:30:25.000 --> 00:30:27.000
either get a bigger pool or

00:30:27.000 --> 00:30:29.000
you know maybe

00:30:29.000 --> 00:30:31.000
redefine what users are allowed to use that

00:30:31.000 --> 00:30:33.000
pool in that particular case

00:30:35.000 --> 00:30:37.000
so when we look at this output now

00:30:37.000 --> 00:30:39.000
same thing outside inside interfaces

00:30:39.000 --> 00:30:41.000
and now down here though you'll see

00:30:41.000 --> 00:30:43.000
inside source with dynamic

00:30:43.000 --> 00:30:45.000
mappings it says we're going to dynamically map

00:30:45.000 --> 00:30:47.000
anyone from access list 50

00:30:47.000 --> 00:30:49.000
to the pool

00:30:49.000 --> 00:30:51.000
of Stormwind demo and the pool of Stormwind

00:30:51.000 --> 00:30:53.000
demo is 20301

00:30:53.000 --> 00:30:55.000
1392 all the way up to

00:30:55.000 --> 00:30:57.000
20301 1394

00:31:01.000 --> 00:31:03.000
so now when we look at our table

00:31:03.000 --> 00:31:05.000
what you'll see

00:31:05.000 --> 00:31:07.000
is that when the router

00:31:07.000 --> 00:31:09.000
gives the public IP

00:31:09.000 --> 00:31:11.000
address to that private IP

00:31:11.000 --> 00:31:13.000
address it'll basically

00:31:13.000 --> 00:31:15.000
put

00:31:15.000 --> 00:31:17.000
we'll call it a lock on that particular

00:31:17.000 --> 00:31:19.000
public IP address in the table

00:31:19.000 --> 00:31:21.000
so you can confirm

00:31:21.000 --> 00:31:23.000
here that 10010 has

00:31:23.000 --> 00:31:25.000
been given 20301 1392

00:31:25.000 --> 00:31:27.000
and

00:31:27.000 --> 00:31:29.000
that will remain with

00:31:29.000 --> 00:31:31.000
10010 for as long as

00:31:31.000 --> 00:31:33.000
10010 keeps talking

00:31:33.000 --> 00:31:35.000
if 10010 stops talking

00:31:35.000 --> 00:31:37.000
then approximately 30 minutes later

00:31:37.000 --> 00:31:39.000
that would be removed they don't stop

00:31:39.000 --> 00:31:41.000
talking then they'll keep getting to use it

00:31:43.000 --> 00:31:45.000
same thing with

00:31:45.000 --> 00:31:47.000
the other ones

00:31:47.000 --> 00:31:49.000
and then every time we communicate you'll see

00:31:49.000 --> 00:31:51.000
that there's going to be a dynamic entry

00:31:51.000 --> 00:31:53.000
added for each

00:31:53.000 --> 00:31:55.000
of the conversations that are going on

00:31:55.000 --> 00:31:57.000
so 10010 went out to the

00:31:57.000 --> 00:31:59.000
internet 30 times then there'd be 30

00:31:59.000 --> 00:32:01.000
entries here for each and every single one

00:32:01.000 --> 00:32:03.000
of those connections it has out to the internet

00:32:03.000 --> 00:32:05.000
because we got to keep track of all the

00:32:05.000 --> 00:32:07.000
communications so we know how to translate

00:32:07.000 --> 00:32:09.000
back when the return traffic comes back

00:32:11.000 --> 00:32:13.000
so obviously

00:32:13.000 --> 00:32:15.000
dynamic NAT and static

00:32:15.000 --> 00:32:17.000
NAT are not

00:32:17.000 --> 00:32:19.000
going to give us the best

00:32:19.000 --> 00:32:21.000
results for our enterprise environment

00:32:21.000 --> 00:32:23.000
and why is that

00:32:23.000 --> 00:32:25.000
well think about

00:32:25.000 --> 00:32:27.000
static NAT manually configure

00:32:27.000 --> 00:32:29.000
if you have a thousand users do you really want to manually

00:32:29.000 --> 00:32:31.000
configure all 1000

00:32:31.000 --> 00:32:33.000
users probably not

00:32:33.000 --> 00:32:35.000
what about dynamic NAT if you have a thousand

00:32:35.000 --> 00:32:37.000
users well I mean

00:32:37.000 --> 00:32:39.000
it can dynamically do it for you but you still need a

00:32:39.000 --> 00:32:41.000
thousand IPs so both for static NAT

00:32:41.000 --> 00:32:43.000
and dynamic NAT you're going to need the number

00:32:43.000 --> 00:32:45.000
of public IP that you have for private

00:32:45.000 --> 00:32:47.000
and that is typically

00:32:47.000 --> 00:32:49.000
not going to happen for you

00:32:51.000 --> 00:32:53.000
so that's where PAT comes into play

00:32:53.000 --> 00:32:55.000
what is PAT

00:32:55.000 --> 00:32:57.000
it's called port

00:32:57.000 --> 00:32:59.000
address translation but I like to say it this way

00:32:59.000 --> 00:33:01.000
port

00:33:01.000 --> 00:33:03.000
and address

00:33:03.000 --> 00:33:05.000
translation

00:33:07.000 --> 00:33:09.000
so

00:33:09.000 --> 00:33:11.000
think about network

00:33:11.000 --> 00:33:13.000
address translation they could have just called it

00:33:13.000 --> 00:33:15.000
address translation

00:33:15.000 --> 00:33:17.000
not network address translation just

00:33:17.000 --> 00:33:19.000
address translation or IP

00:33:19.000 --> 00:33:21.000
address translation because that's all you're translating

00:33:21.000 --> 00:33:23.000
when NAT

00:33:23.000 --> 00:33:25.000
static NAT dynamic NAT

00:33:25.000 --> 00:33:27.000
address translation that's all it is

00:33:27.000 --> 00:33:29.000
whereas with port

00:33:29.000 --> 00:33:31.000
or PAT you're doing

00:33:31.000 --> 00:33:33.000
port and address

00:33:33.000 --> 00:33:35.000
translation so now you can

00:33:35.000 --> 00:33:37.000
translate both the port numbers

00:33:37.000 --> 00:33:39.000
and the addresses themselves

00:33:39.000 --> 00:33:41.000
and depending on

00:33:41.000 --> 00:33:43.000
the situation the router will choose

00:33:43.000 --> 00:33:45.000
what it wants to do if it doesn't need to

00:33:45.000 --> 00:33:47.000
translate the port it won't if it needs to it will

00:33:49.000 --> 00:33:51.000
also PAT uses a

00:33:51.000 --> 00:33:53.000
many to one address mapping

00:33:53.000 --> 00:33:55.000
what does that mean it means that you can

00:33:55.000 --> 00:33:57.000
have

00:33:57.000 --> 00:33:59.000
many many many many many

00:33:59.000 --> 00:34:01.000
private IP addresses all

00:34:01.000 --> 00:34:03.000
using the same public IP address

00:34:05.000 --> 00:34:07.000
so let's just look at this configuration here

00:34:07.000 --> 00:34:09.000
now we've got our insides we've got our

00:34:09.000 --> 00:34:11.000
outside interfaces

00:34:11.000 --> 00:34:13.000
here's our access control

00:34:13.000 --> 00:34:15.000
list so in this case I've included every

00:34:15.000 --> 00:34:17.000
single one of our

00:34:17.000 --> 00:34:19.000
subnets that

00:34:19.000 --> 00:34:21.000
we have that are attached to our SVI

00:34:21.000 --> 00:34:23.000
so 10.0.0.24

00:34:23.000 --> 00:34:25.000
1.0.0.24 2.0.0.24

00:34:25.000 --> 00:34:27.000
3.0.0.24

00:34:27.000 --> 00:34:29.000
so that access

00:34:29.000 --> 00:34:31.000
control list is what that is referring to

00:34:31.000 --> 00:34:33.000
our inside

00:34:33.000 --> 00:34:35.000
local addresses

00:34:35.000 --> 00:34:37.000
our RFC

00:34:37.000 --> 00:34:39.000
1918 addresses when it's all

00:34:39.000 --> 00:34:41.000
said and done it's the

00:34:41.000 --> 00:34:43.000
private IPs

00:34:45.000 --> 00:34:47.000
and as you can see IP NAT inside

00:34:47.000 --> 00:34:49.000
source list 50 is right there

00:34:53.000 --> 00:34:55.000
and then because we're

00:34:55.000 --> 00:34:57.000
using PAT and we can do port and

00:34:57.000 --> 00:34:59.000
address translation notice we

00:34:59.000 --> 00:35:01.000
don't have a pool in this particular example

00:35:01.000 --> 00:35:03.000
why do I not

00:35:03.000 --> 00:35:05.000
need a pool I don't need

00:35:05.000 --> 00:35:07.000
a pool because we can

00:35:07.000 --> 00:35:09.000
all use the exact

00:35:09.000 --> 00:35:11.000
same public IP address now

00:35:11.000 --> 00:35:13.000
so typically

00:35:13.000 --> 00:35:15.000
you would use the IP address

00:35:15.000 --> 00:35:17.000
of an interface

00:35:17.000 --> 00:35:19.000
as an example here

00:35:19.000 --> 00:35:21.000
so interface fast

00:35:21.000 --> 00:35:23.000
internet 0.0.0

00:35:25.000 --> 00:35:27.000
so use the IP address

00:35:27.000 --> 00:35:29.000
of interface 0.0.0

00:35:29.000 --> 00:35:31.000
so this would be your inside

00:35:31.000 --> 00:35:33.000
global address

00:35:33.000 --> 00:35:35.000
for network address translation

00:35:35.000 --> 00:35:37.000
your public IP address

00:35:41.000 --> 00:35:43.000
now this keyword

00:35:43.000 --> 00:35:45.000
here means what

00:35:45.000 --> 00:35:47.000
that keyword means

00:35:47.000 --> 00:35:49.000
turn

00:35:49.000 --> 00:35:51.000
on

00:35:51.000 --> 00:35:53.000
PAT

00:35:53.000 --> 00:35:55.000
now on Cisco

00:35:55.000 --> 00:35:57.000
iOS devices

00:35:57.000 --> 00:35:59.000
if you forget that overload

00:35:59.000 --> 00:36:01.000
keyword you're fine

00:36:01.000 --> 00:36:03.000
it'll automatically do it for you

00:36:03.000 --> 00:36:05.000
because it will not allow you

00:36:05.000 --> 00:36:07.000
to put the interface

00:36:07.000 --> 00:36:09.000
in unless you're

00:36:09.000 --> 00:36:11.000
overloading on it so it'll automatically

00:36:11.000 --> 00:36:13.000
do it for you folks no worries

00:36:13.000 --> 00:36:15.000
about that but on the exam

00:36:15.000 --> 00:36:17.000
if you saw

00:36:17.000 --> 00:36:19.000
this on the exam

00:36:19.000 --> 00:36:21.000
then that is wrong that is the reason

00:36:21.000 --> 00:36:23.000
why it's not working even though it would still work

00:36:23.000 --> 00:36:25.000
in the real world that is why it's not working

00:36:25.000 --> 00:36:27.000
on the exam why because you can

00:36:27.000 --> 00:36:29.000
photoshop copy and paste

00:36:29.000 --> 00:36:31.000
do anything you want as a

00:36:31.000 --> 00:36:33.000
exam developer

00:36:33.000 --> 00:36:35.000
when it comes to Cisco exams

00:36:35.000 --> 00:36:37.000
so keep that in mind that

00:36:37.000 --> 00:36:39.000
the overload keyword if it's missing

00:36:39.000 --> 00:36:41.000
that is probably what they are

00:36:41.000 --> 00:36:43.000
looking for you to figure out in that

00:36:43.000 --> 00:36:45.000
example

00:36:47.000 --> 00:36:49.000
all

00:36:49.000 --> 00:36:51.000
right so now

00:36:51.000 --> 00:36:53.000
if we look at this you'll see our inside

00:36:53.000 --> 00:36:55.000
or outside interfaces no change

00:36:55.000 --> 00:36:57.000
there but now you'll see that when it comes to

00:36:57.000 --> 00:36:59.000
the inside source information access list

00:36:59.000 --> 00:37:01.000
50 is being translated to the

00:37:01.000 --> 00:37:03.000
IP address of that interface

00:37:05.000 --> 00:37:07.000
and notice it doesn't even say

00:37:07.000 --> 00:37:09.000
overload here because it just it's going to have to

00:37:09.000 --> 00:37:11.000
happen no matter what

00:37:11.000 --> 00:37:13.000
all right

00:37:13.000 --> 00:37:15.000
so now as devices are

00:37:15.000 --> 00:37:17.000
communicating notice how there's no

00:37:17.000 --> 00:37:19.000
entries in there with the dashes in them

00:37:19.000 --> 00:37:21.000
like we had with the other two

00:37:21.000 --> 00:37:23.000
because we don't have to make an entry

00:37:23.000 --> 00:37:25.000
in that table

00:37:25.000 --> 00:37:27.000
for that particular client because this just

00:37:27.000 --> 00:37:29.000
happens on the fly and nothing's being

00:37:29.000 --> 00:37:31.000
specifically reserved for anybody

00:37:31.000 --> 00:37:33.000
in this case

00:37:33.000 --> 00:37:35.000
so you'll see that we have 10.0.0.10

00:37:35.000 --> 00:37:37.000
1.50

00:37:37.000 --> 00:37:39.000
here and 2.20

00:37:39.000 --> 00:37:41.000
notice how they're all using

00:37:41.000 --> 00:37:43.000
the exact same

00:37:43.000 --> 00:37:45.000
IP address

00:37:45.000 --> 00:37:47.000
exact same

00:37:47.000 --> 00:37:49.000
IP address every single

00:37:49.000 --> 00:37:51.000
one of them

00:37:55.000 --> 00:37:57.000
so that's great we can piggyback

00:37:57.000 --> 00:37:59.000
and use the same IP

00:37:59.000 --> 00:38:01.000
now what happens

00:38:01.000 --> 00:38:03.000
though

00:38:03.000 --> 00:38:05.000
if two devices

00:38:05.000 --> 00:38:07.000
are using the exact

00:38:07.000 --> 00:38:09.000
same port number

00:38:09.000 --> 00:38:11.000
that is a problem

00:38:11.000 --> 00:38:13.000
look at this

00:38:13.000 --> 00:38:15.000
this device is using the same

00:38:15.000 --> 00:38:17.000
port number as this

00:38:17.000 --> 00:38:19.000
device right here

00:38:19.000 --> 00:38:21.000
source port

00:38:21.000 --> 00:38:23.000
so the traffic

00:38:23.000 --> 00:38:25.000
is coming this way

00:38:25.000 --> 00:38:27.000
from both of those devices

00:38:27.000 --> 00:38:29.000
this one is from

00:38:29.000 --> 00:38:31.000
10.0.0.10

00:38:31.000 --> 00:38:33.000
this one's from

00:38:33.000 --> 00:38:35.000
10.0.2.20

00:38:35.000 --> 00:38:37.000
and this one's using port number

00:38:37.000 --> 00:38:39.000
62345

00:38:39.000 --> 00:38:41.000
so is this one

00:38:45.000 --> 00:38:47.000
so now if we translate those

00:38:47.000 --> 00:38:49.000
we would end up translating

00:38:49.000 --> 00:38:51.000
to 203.0.113.91

00:38:51.000 --> 00:38:53.000
at

00:38:53.000 --> 00:38:55.000
62345

00:38:55.000 --> 00:38:57.000
and

00:38:57.000 --> 00:38:59.000
203.0.113.91

00:38:59.000 --> 00:39:01.000
at

00:39:01.000 --> 00:39:03.000
62345

00:39:03.000 --> 00:39:05.000
that is a problem

00:39:05.000 --> 00:39:07.000
that is a problem

00:39:07.000 --> 00:39:09.000
why

00:39:09.000 --> 00:39:11.000
is that a problem because these

00:39:11.000 --> 00:39:13.000
are no longer unique

00:39:13.000 --> 00:39:15.000
and if these are no longer unique

00:39:15.000 --> 00:39:17.000
right here these ones here

00:39:17.000 --> 00:39:19.000
that's a problem because the router

00:39:19.000 --> 00:39:21.000
is not going to know 100%

00:39:21.000 --> 00:39:23.000
what to translate it to

00:39:23.000 --> 00:39:25.000
when it comes back because

00:39:25.000 --> 00:39:27.000
it would not know when the traffic comes back

00:39:27.000 --> 00:39:29.000
hey am I supposed to translate it to this

00:39:29.000 --> 00:39:31.000
or am I supposed to translate it to this

00:39:31.000 --> 00:39:33.000
because it's the same

00:39:33.000 --> 00:39:35.000
so what does your router do this is where it does

00:39:35.000 --> 00:39:37.000
port translation

00:39:37.000 --> 00:39:39.000
port translation

00:39:39.000 --> 00:39:41.000
notice that it translated this port

00:39:41.000 --> 00:39:43.000
number right here

00:39:43.000 --> 00:39:45.000
see that

00:39:45.000 --> 00:39:47.000
so now it changed it to

00:39:47.000 --> 00:39:49.000
64544

00:39:49.000 --> 00:39:51.000
64544

00:39:51.000 --> 00:39:53.000
it simply uses an unused port number

00:39:53.000 --> 00:39:55.000
in the table if that port's not

00:39:55.000 --> 00:39:57.000
being used in the table it'll just go ahead

00:39:57.000 --> 00:39:59.000
and use it so now we have

00:39:59.000 --> 00:40:01.000
uniqueness between the two

00:40:01.000 --> 00:40:03.000
so that way there when traffic comes back

00:40:03.000 --> 00:40:05.000
and the traffic is

00:40:05.000 --> 00:40:07.000
destined to

00:40:07.000 --> 00:40:09.000
203.0.113.91

00:40:09.000 --> 00:40:11.000
62345

00:40:11.000 --> 00:40:13.000
62345

00:40:13.000 --> 00:40:15.000
from 8888

00:40:15.000 --> 00:40:17.000
well that's

00:40:17.000 --> 00:40:19.000
8888 okay right here

00:40:19.000 --> 00:40:21.000
and that is

00:40:21.000 --> 00:40:23.000
203.0.113.91

00:40:23.000 --> 00:40:25.000
62345 that's this one here so now

00:40:25.000 --> 00:40:27.000
we can translate it back to this

00:40:27.000 --> 00:40:29.000
and when it comes back

00:40:29.000 --> 00:40:31.000
to

00:40:31.000 --> 00:40:33.000
203.0.113.91

00:40:33.000 --> 00:40:35.000
it's 64544

00:40:35.000 --> 00:40:37.000
from 8888

00:40:37.000 --> 00:40:39.000
then that's gonna match this

00:40:39.000 --> 00:40:41.000
entry here

00:40:41.000 --> 00:40:43.000
203.0.113.91

00:40:43.000 --> 00:40:45.000
64544

00:40:45.000 --> 00:40:47.000
and it's coming from 8888

00:40:47.000 --> 00:40:49.000
so now we can translate it back to this

00:40:49.000 --> 00:40:51.000
so we'll have to translate the port number back as well

00:40:51.000 --> 00:40:53.000
right because

00:40:53.000 --> 00:40:55.000
the user is expecting this

00:40:55.000 --> 00:40:57.000
the user's not expecting that port number

00:40:57.000 --> 00:40:59.000
it's expecting that port number

00:40:59.000 --> 00:41:01.000
we gotta translate the port number back as well

00:41:01.000 --> 00:41:03.000
on the way back

00:41:03.000 --> 00:41:05.000
so all of this is transparent

00:41:05.000 --> 00:41:07.000
to the user they have no idea this is going on

00:41:07.000 --> 00:41:09.000
so folks what is

00:41:09.000 --> 00:41:11.000
our number one limitation with

00:41:11.000 --> 00:41:13.000
PAT then what is the number one

00:41:13.000 --> 00:41:15.000
limitation we have with port address

00:41:15.000 --> 00:41:17.000
translation

00:41:29.000 --> 00:41:31.000
you don't know put in a question

00:41:31.000 --> 00:41:33.000
mark

00:41:33.000 --> 00:41:35.000
so I know you're thinking

00:41:35.000 --> 00:41:37.000
yeah good

00:41:37.000 --> 00:41:39.000
ports

00:41:39.000 --> 00:41:41.000
our biggest challenge with

00:41:41.000 --> 00:41:43.000
port address translation is ports as

00:41:43.000 --> 00:41:45.000
John said

00:41:45.000 --> 00:41:47.000
how many ports are

00:41:47.000 --> 00:41:49.000
there in total folks

00:42:00.000 --> 00:42:02.000
yeah

00:42:02.000 --> 00:42:04.000
0-65,535

00:42:04.000 --> 00:42:06.000
so like 65,536

00:42:06.000 --> 00:42:08.000
so here's

00:42:08.000 --> 00:42:10.000
how PAT works you're not gonna have to know this for the

00:42:10.000 --> 00:42:12.000
exam but I'm gonna tell you for the real world

00:42:12.000 --> 00:42:14.000
if the source port

00:42:14.000 --> 00:42:16.000
equals

00:42:16.000 --> 00:42:18.000
0-511

00:42:18.000 --> 00:42:20.000
then

00:42:20.000 --> 00:42:22.000
if the port has to be

00:42:22.000 --> 00:42:24.000
translated it'll translate it within

00:42:24.000 --> 00:42:26.000
that range

00:42:26.000 --> 00:42:28.000
if the source port

00:42:28.000 --> 00:42:30.000
equals

00:42:30.000 --> 00:42:32.000
512-1023

00:42:32.000 --> 00:42:34.000
then it'll translate it in that range

00:42:34.000 --> 00:42:36.000
the source port is

00:42:36.000 --> 00:42:38.000
1024-65,535

00:42:38.000 --> 00:42:40.000
then that will

00:42:40.000 --> 00:42:42.000
translate it in that range

00:42:42.000 --> 00:42:44.000
so most users are gonna be using

00:42:44.000 --> 00:42:46.000
source ports of this

00:42:46.000 --> 00:42:48.000
which means you don't even have a full

00:42:48.000 --> 00:42:50.000
65,536

00:42:50.000 --> 00:42:52.000
ports right because if a

00:42:52.000 --> 00:42:54.000
user is using one of these source ports

00:42:54.000 --> 00:42:56.000
and then all of a sudden

00:42:56.000 --> 00:42:58.000
you run out of these source ports

00:42:58.000 --> 00:43:00.000
for uniqueness and there's more translations

00:43:00.000 --> 00:43:02.000
than you need then what happens

00:43:02.000 --> 00:43:04.000
right well then they can't

00:43:04.000 --> 00:43:06.000
translate because there's no more

00:43:06.000 --> 00:43:08.000
ports to be used for translation

00:43:10.000 --> 00:43:12.000
folks

00:43:12.000 --> 00:43:14.000
if you go to one single website

00:43:14.000 --> 00:43:16.000
approximately

00:43:16.000 --> 00:43:18.000
how many translations

00:43:18.000 --> 00:43:20.000
do you think happens today

00:43:20.000 --> 00:43:22.000
just when you go to one website

00:43:22.000 --> 00:43:24.000
right back in the day you went

00:43:24.000 --> 00:43:26.000
to one website that was like one

00:43:26.000 --> 00:43:28.000
translation right you

00:43:28.000 --> 00:43:30.000
went to that website you got translated to go

00:43:30.000 --> 00:43:32.000
there you're done but like

00:43:32.000 --> 00:43:34.000
how many translations happen today

00:43:34.000 --> 00:43:36.000
it's a

00:43:36.000 --> 00:43:38.000
lot it really

00:43:38.000 --> 00:43:40.000
is

00:43:46.000 --> 00:43:48.000
I'm just gonna

00:43:48.000 --> 00:43:50.000
execute the netstat command

00:43:50.000 --> 00:43:52.000
on my device right now these are just the active

00:43:52.000 --> 00:43:54.000
TCP sessions I have now

00:43:54.000 --> 00:43:56.000
some of these are inside some of these are outside

00:43:56.000 --> 00:43:58.000
right but there's not a whole lot going on

00:43:58.000 --> 00:44:00.000
right now in regards to that

00:44:00.000 --> 00:44:02.000
but see for every single one of those

00:44:02.000 --> 00:44:04.000
that have to go to the internet

00:44:04.000 --> 00:44:06.000
there would end up being a

00:44:06.000 --> 00:44:08.000
translation that would have to happen so let's go to

00:44:08.000 --> 00:44:10.000
www.cisco.com

00:44:12.000 --> 00:44:14.000
before we go there let's remind you

00:44:14.000 --> 00:44:16.000
this was the list

00:44:16.000 --> 00:44:18.000
it's not very long it's short

00:44:18.000 --> 00:44:20.000
very short there's the top

00:44:20.000 --> 00:44:22.000
one two three so

00:44:22.000 --> 00:44:24.000
just an extra three more clicks on my

00:44:24.000 --> 00:44:26.000
wheel now let's go to cisco.com

00:44:28.000 --> 00:44:30.000
and all I've done is gone to cisco.com

00:44:30.000 --> 00:44:32.000
and what do we have now

00:44:32.000 --> 00:44:34.000
three

00:44:34.000 --> 00:44:36.000
netstat

00:44:36.000 --> 00:44:38.000
do you see that look at that list

00:44:38.000 --> 00:44:40.000
okay so now let's also

00:44:40.000 --> 00:44:42.000
go to maybe

00:44:42.000 --> 00:44:44.000
www.aws.com

00:44:50.000 --> 00:44:52.000
hey

00:44:52.000 --> 00:44:54.000
let's go at the same

00:44:54.000 --> 00:44:56.000
time to stormwindstudios.com

00:44:58.000 --> 00:45:00.000
so just think about it as a single

00:45:00.000 --> 00:45:02.000
user right now who's that

00:45:02.000 --> 00:45:04.000
this is a good looking guy

00:45:04.000 --> 00:45:06.000
right so

00:45:06.000 --> 00:45:08.000
when it's all said and done just think

00:45:08.000 --> 00:45:10.000
about that now a lot of these are going to time out

00:45:10.000 --> 00:45:12.000
here within 30 seconds right because they were

00:45:12.000 --> 00:45:14.000
just temporary connections to get

00:45:14.000 --> 00:45:16.000
what do you need but in the end folks

00:45:16.000 --> 00:45:18.000
I hope you're realizing that

00:45:18.000 --> 00:45:20.000
the moral of the story of this is that

00:45:20.000 --> 00:45:22.000
you need to be well

00:45:22.000 --> 00:45:24.000
aware that

00:45:24.000 --> 00:45:26.000
it doesn't take long

00:45:26.000 --> 00:45:28.000
for users in your organization

00:45:28.000 --> 00:45:30.000
when they are aggressively

00:45:30.000 --> 00:45:32.000
using the internet to end

00:45:32.000 --> 00:45:34.000
up consuming all the port numbers

00:45:34.000 --> 00:45:36.000
as a collective unit

00:45:36.000 --> 00:45:38.000
so if you had a thousand users

00:45:38.000 --> 00:45:40.000
if you had a thousand users

00:45:42.000 --> 00:45:44.000
a thousand users

00:45:44.000 --> 00:45:46.000
what's a thousand times let's

00:45:46.000 --> 00:45:48.000
say 65

00:45:48.000 --> 00:45:50.000
65

00:45:50.000 --> 00:45:52.000
that's 65,000

00:45:52.000 --> 00:45:54.000
you're almost maxed out right there folks

00:45:54.000 --> 00:45:56.000
you're almost

00:45:56.000 --> 00:45:58.000
maxed out right there so every user

00:45:58.000 --> 00:46:00.000
just making 65 connections

00:46:00.000 --> 00:46:02.000
out to the internet and you saw how many I

00:46:02.000 --> 00:46:04.000
had which is three websites

00:46:04.000 --> 00:46:06.000
could easily

00:46:06.000 --> 00:46:08.000
consume all those port numbers

00:46:08.000 --> 00:46:10.000
now the good news here is

00:46:10.000 --> 00:46:12.000
that these time out

00:46:12.000 --> 00:46:14.000
in 30 seconds out of your table

00:46:14.000 --> 00:46:16.000
meaning what

00:46:16.000 --> 00:46:18.000
meaning that if this

00:46:20.000 --> 00:46:22.000
if my router doesn't continue to see traffic

00:46:22.000 --> 00:46:24.000
in and out in and out

00:46:24.000 --> 00:46:26.000
in and out for this translation

00:46:26.000 --> 00:46:28.000
then in 30 seconds of

00:46:28.000 --> 00:46:30.000
inactivity it will get rid of it

00:46:30.000 --> 00:46:32.000
reclaiming that port number

00:46:32.000 --> 00:46:34.000
that was being used there

00:46:34.000 --> 00:46:36.000
so think of this scenario

00:46:36.000 --> 00:46:38.000
on the exam or even in the real world

00:46:38.000 --> 00:46:40.000
if you have users

00:46:40.000 --> 00:46:42.000
who complain the internet is broken

00:46:42.000 --> 00:46:44.000
and then by the time you reach

00:46:44.000 --> 00:46:46.000
out to them they say oh no no it's

00:46:46.000 --> 00:46:48.000
fine now and then you have another

00:46:48.000 --> 00:46:50.000
user who complains the internet's broken

00:46:50.000 --> 00:46:52.000
but then by the time you reach out to them

00:46:52.000 --> 00:46:54.000
they're like oh no no it's fine everything's back to normal

00:46:54.000 --> 00:46:56.000
if that is a constant theme

00:46:56.000 --> 00:46:58.000
it might

00:46:58.000 --> 00:47:00.000
simply be that you don't have

00:47:00.000 --> 00:47:02.000
enough port numbers

00:47:02.000 --> 00:47:04.000
for a network address translation

00:47:04.000 --> 00:47:06.000
based on the amount of traffic

00:47:06.000 --> 00:47:08.000
that's going to the internet

00:47:08.000 --> 00:47:10.000
that's what that is

00:47:10.000 --> 00:47:12.000
so how do

00:47:12.000 --> 00:47:14.000
you add more port numbers folks

00:47:14.000 --> 00:47:16.000
to solve

00:47:16.000 --> 00:47:18.000
this problem if you

00:47:18.000 --> 00:47:20.000
end up in that situation

00:47:20.000 --> 00:47:22.000
how

00:47:22.000 --> 00:47:24.000
do you add more port numbers

00:47:24.000 --> 00:47:26.000
in order to solve this problem

00:47:26.000 --> 00:47:28.000
yes exactly Andrew good one

00:47:28.000 --> 00:47:30.000
add another IP address

00:47:30.000 --> 00:47:32.000
because if we add another IP address

00:47:32.000 --> 00:47:34.000
publicly

00:47:34.000 --> 00:47:36.000
then what happens

00:47:36.000 --> 00:47:38.000
we have another 60 approximately

00:47:38.000 --> 00:47:40.000
65,000 address port numbers

00:47:40.000 --> 00:47:42.000
so I've got 65,000

00:47:42.000 --> 00:47:44.000
port numbers times 2

00:47:44.000 --> 00:47:46.000
you've got a third address now you've got 65,000 port

00:47:46.000 --> 00:47:48.000
numbers times 3 add another address

00:47:48.000 --> 00:47:50.000
you get the picture so how do we implement

00:47:50.000 --> 00:47:52.000
that we implement with dynamic

00:47:52.000 --> 00:47:54.000
port address translation

00:47:54.000 --> 00:47:56.000
that's right all that means is instead of

00:47:56.000 --> 00:47:58.000
using

00:47:58.000 --> 00:48:00.000
just one address let's use

00:48:00.000 --> 00:48:02.000
addresses within a pool so before I

00:48:02.000 --> 00:48:04.000
show you the configuration let's go back to this configuration

00:48:04.000 --> 00:48:06.000
remember this configuration

00:48:06.000 --> 00:48:08.000
dynamic NAT

00:48:08.000 --> 00:48:10.000
what do we say the problem with this configuration

00:48:10.000 --> 00:48:12.000
is that the way it's set up

00:48:12.000 --> 00:48:14.000
every single

00:48:14.000 --> 00:48:16.000
address gets mapped

00:48:16.000 --> 00:48:18.000
specifically to a public IP address

00:48:18.000 --> 00:48:20.000
and no one else can use it

00:48:22.000 --> 00:48:24.000
what if we just simply

00:48:24.000 --> 00:48:26.000
overload

00:48:28.000 --> 00:48:30.000
on this entire config

00:48:30.000 --> 00:48:32.000
and instead we change this to 0

00:48:32.000 --> 00:48:34.000
0 0

00:48:36.000 --> 00:48:38.000
0

00:48:38.000 --> 00:48:40.000
that's it

00:48:40.000 --> 00:48:42.000
just by making those few changes

00:48:42.000 --> 00:48:44.000
folks we now

00:48:44.000 --> 00:48:46.000
can implement

00:48:48.000 --> 00:48:50.000
dynamic port address

00:48:50.000 --> 00:48:52.000
translation

00:48:54.000 --> 00:48:56.000
so for the exam think about if they show you

00:48:56.000 --> 00:48:58.000
this without

00:48:58.000 --> 00:49:00.000
overload

00:49:02.000 --> 00:49:04.000
and they are indicating that users

00:49:06.000 --> 00:49:08.000
are

00:49:08.000 --> 00:49:10.000
not able to go to the internet just

00:49:10.000 --> 00:49:12.000
double check that they forget the overload

00:49:12.000 --> 00:49:14.000
keyword

00:49:14.000 --> 00:49:16.000
and there

00:49:16.000 --> 00:49:18.000
you go there's your patent with multiple IP addresses

00:49:18.000 --> 00:49:20.000
so

00:49:20.000 --> 00:49:22.000
now we have three public IP

00:49:22.000 --> 00:49:24.000
in this scenario all

00:49:24.000 --> 00:49:26.000
being overloaded on for this

00:49:26.000 --> 00:49:28.000
entire access control list

00:49:28.000 --> 00:49:30.000
range of private IP addresses

00:49:30.000 --> 00:49:32.000
so now

00:49:32.000 --> 00:49:34.000
when you look at this scenario

00:49:38.000 --> 00:49:40.000
you'll see over here on the left

00:49:40.000 --> 00:49:42.000
hand side we have

00:49:42.000 --> 00:49:44.000
94 use

00:49:44.000 --> 00:49:46.000
95 94 96

00:49:46.000 --> 00:49:48.000
95 94 95 94

00:49:48.000 --> 00:49:50.000
96

00:49:50.000 --> 00:49:52.000
and if

00:49:52.000 --> 00:49:54.000
two users are using

00:49:54.000 --> 00:49:56.000
the same port number

00:49:56.000 --> 00:49:58.000
and the same

00:49:58.000 --> 00:50:00.000
and the same address

00:50:00.000 --> 00:50:02.000
so did they use the same address

00:50:02.000 --> 00:50:04.000
yes they

00:50:04.000 --> 00:50:06.000
did right

00:50:06.000 --> 00:50:08.000
then the port number had to be changed

00:50:08.000 --> 00:50:10.000
so this port number was changed

00:50:12.000 --> 00:50:14.000
so this one had to be

00:50:14.000 --> 00:50:16.000
port and address translated

00:50:18.000 --> 00:50:20.000
because it conflicted with that port number

00:50:20.000 --> 00:50:22.000
there

00:50:22.000 --> 00:50:24.000
you

00:50:28.000 --> 00:50:30.000
question now is what if the same port

00:50:30.000 --> 00:50:32.000
number is being used

00:50:34.000 --> 00:50:36.000
but the device

00:50:36.000 --> 00:50:38.000
chooses different IP addresses

00:50:38.000 --> 00:50:40.000
then does it have to translate the port number

00:50:40.000 --> 00:50:42.000
no it doesn't

00:50:52.000 --> 00:50:54.000
so let me repeat that

00:50:54.000 --> 00:50:56.000
your router can make a choice here either

00:50:56.000 --> 00:50:58.000
I use the same

00:50:58.000 --> 00:51:00.000
IP and translate the port

00:51:00.000 --> 00:51:02.000
or I use a different IP and then I

00:51:02.000 --> 00:51:04.000
don't have to translate the port it'll

00:51:04.000 --> 00:51:06.000
make those decisions on the fly for you and it doesn't matter

00:51:06.000 --> 00:51:08.000
what decision it makes

00:51:08.000 --> 00:51:10.000
all right so there's your config for

00:51:10.000 --> 00:51:12.000
config verify and troubleshoot network

00:51:12.000 --> 00:51:14.000
gadgets translation on the certification exam

00:51:14.000 --> 00:51:16.000
Andrew says funny that the exam

00:51:16.000 --> 00:51:18.000
is new but you can't configure this

00:51:18.000 --> 00:51:20.000
in the CLI and the next gen firewalls

00:51:20.000 --> 00:51:22.000
okay so you got to remember this

00:51:22.000 --> 00:51:24.000
Andrew this exam is not about next

00:51:24.000 --> 00:51:26.000
gen firewalls

00:51:26.000 --> 00:51:28.000
this exam is about network address translation

00:51:28.000 --> 00:51:30.000
implemented on Cisco

00:51:30.000 --> 00:51:32.000
iOS routers and

00:51:32.000 --> 00:51:34.000
Cisco iOS XE

00:51:34.000 --> 00:51:36.000
routers

00:51:36.000 --> 00:51:38.000
that's the difference

00:51:38.000 --> 00:51:40.000
that's the

00:51:40.000 --> 00:51:42.000
difference so the exam

00:51:42.000 --> 00:51:44.000
is very specific to the

00:51:44.000 --> 00:51:46.000
operating system no don't apologize

00:51:46.000 --> 00:51:48.000
I'm glad you brought that up

00:51:48.000 --> 00:51:50.000
I'm glad you brought that up never apologize

00:51:50.000 --> 00:51:52.000
for bringing something up ever right

00:51:52.000 --> 00:51:54.000
it's part of the learning process part of the conversation

00:51:54.000 --> 00:51:56.000
so so the important thing is

00:51:56.000 --> 00:51:58.000
is that we as

00:51:58.000 --> 00:52:00.000
network admins in the real world we deal

00:52:00.000 --> 00:52:02.000
with a lot of different operating systems like for example

00:52:02.000 --> 00:52:04.000
some of you might be using Nexus OS

00:52:04.000 --> 00:52:06.000
other people are using firewall

00:52:06.000 --> 00:52:08.000
operating system and they're all

00:52:08.000 --> 00:52:10.000
different which is really unfortunate

00:52:10.000 --> 00:52:12.000
in the grand scheme of things because it means you have to

00:52:12.000 --> 00:52:14.000
learn many different operating systems and

00:52:14.000 --> 00:52:16.000
we wonder why we have security problems in this

00:52:16.000 --> 00:52:18.000
world that we can't keep up because

00:52:18.000 --> 00:52:20.000
it's a different way to secure everything it's a different way to do

00:52:20.000 --> 00:52:22.000
everything which is unfortunate in the world

00:52:22.000 --> 00:52:24.000
of Cisco all right but

00:52:24.000 --> 00:52:26.000
the end result

00:52:26.000 --> 00:52:28.000
is that for this exam what I've shown

00:52:28.000 --> 00:52:30.000
you is iOS and iOS XE

00:52:30.000 --> 00:52:32.000
and if you don't use

00:52:32.000 --> 00:52:34.000
a lot of iOS and iOS XE

00:52:34.000 --> 00:52:36.000
labs

00:52:36.000 --> 00:52:38.000
and other things like that that we have available

00:52:38.000 --> 00:52:40.000
to you and a lot of the practice exams

00:52:40.000 --> 00:52:42.000
and labs are going to help you get familiar with

00:52:42.000 --> 00:52:44.000
iOS and iOS XE to get ready for the exam

00:52:44.000 --> 00:52:46.000
Thank you