Octet

Give users internet access with PAT and publish two servers with static NAT

Cisco IOSWorking

Tasks

  1. Mark the inside and outside interfaces and add a default route to ISP1.
  2. Translate both inside subnets to 203.0.113.2 with PAT.
  3. Map SRV1 to 203.0.113.5 one-to-one, in both directions.
  4. Forward TCP 443 on 203.0.113.2 to SRV2.
  5. Verify the static entries, a PAT session from PC1 and an inbound session to SRV2.

Solution

  1. 1Interfaces, roles and default routeR1
    R1 on Cisco IOS
    interface GigabitEthernet0/0/0
 ip address 203.0.113.2 255.255.255.248
 ip nat outside
 no shutdown
interface GigabitEthernet0/0/1
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
 no shutdown
interface GigabitEthernet0/0/2
 ip address 192.168.20.1 255.255.255.0
 ip nat inside
 no shutdown
ip route 0.0.0.0 0.0.0.0 203.0.113.1
  2. 2PAT for both inside subnetsR1
    R1 on Cisco IOS
    ip access-list standard NAT-INSIDE
 permit 192.168.10.0 0.0.0.255
 permit 192.168.20.0 0.0.0.255
ip nat inside source list NAT-INSIDE interface GigabitEthernet0/0/0 overload

    Without overload, only one inside host at a time could use the interface address.

  3. 3Static NAT for SRV1 and static PAT for SRV2R1
    R1 on Cisco IOS
    ip nat inside source static 192.168.20.10 203.0.113.5
ip nat inside source static tcp 192.168.20.20 443 interface GigabitEthernet0/0/0 443

    Static entries win over the PAT rule, so SRV1's own outbound traffic leaves as 203.0.113.5. SRV2's other outbound traffic still uses PAT. 203.0.113.5 sits inside the outside interface subnet, so R1 answers ISP1's ARP requests for it.

Verify

R1 output
R1# show ip nat translations
Pro  Inside global         Inside local          Outside local         Outside global
---  203.0.113.5           192.168.20.10         ---                   ---
tcp  203.0.113.2:443       192.168.20.20:443     ---                   ---
Total number of translations: 2

Before any traffic, only the two static entries exist. The --- columns mean "any outside host".

PC1 output
PC1# ping 198.51.100.80
Reply from 198.51.100.80: bytes=32 time=14ms TTL=54
Reply from 198.51.100.80: bytes=32 time=13ms TTL=54

PAT works for the users subnet.

EXT1 output
EXT1# curl -sk -o /dev/null -w '%{http_code}\n' https://203.0.113.2/
200

EXT1 is a Linux test host on the internet at 198.51.100.77. Never test a port forward from the inside LAN.

R1 output
R1# show ip nat translations
Pro  Inside global         Inside local          Outside local         Outside global
---  203.0.113.5           192.168.20.10         ---                   ---
tcp  203.0.113.2:443       192.168.20.20:443     ---                   ---
tcp  203.0.113.2:443       192.168.20.20:443     198.51.100.77:50112   198.51.100.77:50112
tcp  203.0.113.2:51004     192.168.10.10:51004   198.51.100.80:443     198.51.100.80:443
icmp 203.0.113.2:1         192.168.10.10:1       198.51.100.80:1       198.51.100.80:1
Total number of translations: 5

PC1's ping and HTTPS session share 203.0.113.2 with their original identifier and port. EXT1's test shows up as a session to SRV2 built from the static PAT entry. After its FIN the entry stays for 60 seconds, the IOS default.

Mistakes people make

  • Swapping ip nat inside and ip nat outside. Nothing gets translated and the statistics show the interfaces on the wrong lists.
  • Forgetting overload: the first user works, everyone else fails.
  • Writing an inbound ACL on Gi0/0/0 that permits 192.168.20.10 or 192.168.20.20. IOS checks it before NAT, so it must permit 203.0.113.5 and 203.0.113.2 port 443.
  • Testing the published services from PC1. Inside traffic to the public addresses hits the hairpin problem.
  • Using a NAT ACL that says permit any. The router then translates traffic it should not, such as future VPN traffic.

On other platforms

The same NAT on a Linux edge router with iptables. Add 203.0.113.5 to eth0 so the router answers ARP for it. Rule order matters, first match wins.

Linux
ip addr add 203.0.113.5/29 dev eth0
sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING  -i eth0 -d 203.0.113.5 -j DNAT --to-destination 192.168.20.10
iptables -t nat -A PREROUTING  -i eth0 -d 203.0.113.2 -p tcp --dport 443 -j DNAT --to-destination 192.168.20.20:443
iptables -t nat -A POSTROUTING -o eth0 -s 192.168.20.10 -j SNAT --to-source 203.0.113.5
iptables -t nat -A POSTROUTING -o eth0 -s 192.168.10.0/24 -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth0 -s 192.168.20.0/24 -j MASQUERADE

Say it in the interview

"Interfaces get their inside and outside roles, one ACL feeds a PAT rule on the outside interface, and static entries handle the servers: one-to-one for SRV1, a single port for SRV2. I verify with the translation table, test inbound from outside the network, and remember that the outside ACL must use the public addresses."

Book 3.3 Internet (IP)