Cisco IOS NAT with Overload

[@2007Russdog]

I asked this question 6 months ago. Now, I completely understand it now. I used an existing network topology on Packet Tracer and had absolutely no problem with it. All from watching most of your videos. Thanks Keith.

[@ryanrrothwell]

Thanks Keith, I like this. Quick concise and precise.

[@KeithBarker]

Thank you Ryan Rothwell!

[@mpdredd]

Thanks for this!! I've been fighting a router all day trying to teach myself how to configure a Cisco router... This was the only part I was missing, THANK YOU!

[@KeithBarker]

Music to my ears. Thanks for letting me know your progress! Keith

[@KeithBarker]

Yes. There are filter lists you can use, and passive interfaces you can set up, depending on your topology.

[@javicesp]

Very good explanation and very easy to understand. Good job!

[@KeithBarker]

If you are going to use your own outside interface, use the "interface" keyword and then specify that interface. Adding on the "overload" option allows multiple devices to PAT against that address.

[@KeithBarker]

Hi Solomon- Yes. We could use policy based NAT/PAT and accomplish that.

[@KeithBarker]

The router doesn't know anything about an address being public or private (RFC 1918). It will just follow the rules for any packets entering the router on an "ip nat inside" interface, and being routed out of an "ip nat outside" interface. Hopefully we have a global address on the outside (if we are doing pat with overload), or we have an appropriate global pool that is correct. Great question. Best wishes, Keith Barker

[@EasyjetVirtualCaptain]

Thanks for sharing your video, after watching it made me understand even better ....

[@sierosierikas3748]

Thanks Keith, that made my home router do "natting" :-)

[@KeithBarker]

The client, R1 and R2 would all connect using a Layer 2 switch, and the client at 10.0.0.15 would specify R2 as it's default gateway. Any traffic going through R2 would have NAT/PAT applied to it (based on how R2 is configured). Does that help with your question? Keith

[@solomonajekwe]

Hello Keith, Nice work. I had a recent challenge at work; based on your topology in the video, Imagine the link between R2 & R3 is over the internet with a GRE Tunnel built connecting the nodes together. Can the same configs you carried out still be valid? Aim is to maintain the GRE tunnel between R2 & R3 while also providing internet access to R1& its hosts via R2 Fa0/1 interface IP (PAT)... I was using a 2600 router (as R2). Cheers buddy...

[@KeithBarker]

Thanks! Keith

[@nate54o]

oh nice, looks like i have some more reading to do! thanks

[@Chargehasbeenset]

great vid man

[@praveenkumar9004]

Keith does router knows that which is private addresses and which one is public address or they just translate?

[@nate54o]

one more question...i dont want my inside addresses to be advertised in RIP advertisements. it sort of defeats the purpose, you know? i have 2 internal subnets being NAT'd. on the other side i have a web server. i can connect to the server just fine and i pulled up netstat, the NAT'd address is identified as the foreign address. so everything is good to go in that perspective. BUT, is there a way to completely prevent those internal subnets from advertising beyond my demarc?

[@nate54o]

it works!!! thanks!

[@2007Russdog]

How does the client connect? It shows it in between R1 and R2. Where does it connect?

[@refaiabdeen2142]

Awesome Bro !!!!

[@abilashnair1980]

Keith can you please post a video on static nat extendable ,, there are no proper explainations on nat extenable if you can post a video it will really do wonders

[@jurneybegin]

Thanks for the NAT video, i have question if 10.0.0.15 is web server how 3.3.3.3 contact the server, i used static NAT TCP 80 its working both sides but overload Nat cant contact the server from outside, how to do this and please explain reversible command too

[@nate54o]

for overload, can you define your own outside global IP address? i saw in your video that your PC automatically translated to 23.0.0.X

[@dbm48467]

NAT Overload also can be implement by defining pool where starting and ending pool address must be same...

[@nate54o]

so then that would prevent network admins from the "other side" to be able to trace back to my network.

[@Chargehasbeenset]

great vid man