- [Teacher] Alright, let's go ahead and talk
about the most popular type of NAT, and that is
Port Address Translation, or NAT overloading.
The reason we would use this is, we typically have
one address we get from our ISP and we want to have
multiple users get out using the same address.
Let's go ahead and take a look at the configuration,
then we'll run out and do it.
First, remember, always check your interfaces.
Now I know I've been putting these in order
as one, two, three, four...
That's the Cisco objectives, how they do it, that's
not really necessary as long as you just get them all.
So our number one, then check this out,
ip nat inside source list 1.
So so far, it looks like we're doing dynamic NAT.
True, same command.
ip nat inside source, list 1 can use interface,
my outside interface, which is my outside local,
so we're saying use that IP address
on gigabit zero one, here it is, right here,
everyone's gonna use that and overload it.
Now if I don't put the keyword overload,
I can press Enter and I'm just doing dynamic NAT.
In this case, the overload command says,
"Use the source port number of the host
"to differentiate them in the NAT address table
"and let everyone use the same IP address to get out."
Very, very cool.
Okay, so that's our number two.
And then number three, we have to make sure
our access list is for all our inside locals.
So for every interface on inside local, I'd have
an access list line permitting them to use the pool.
So to verify NAT overload, or PAT, show ip nat translations.
We see our inside local and our inside global, that's great.
The one thing is it says I can have just dozens or hundreds
or thousands or tens of thousands of hosts using
that same inside global, which is really our outside local.
Now that being said, the way that we do it is we use
the source port number that the host makes up.
From 1024 to 65535,
that's why we get around 65,000 hosts that can use the
same address, theoretically, to get out onto the internet.
So we differentiate each host in the
NAT table by their source port number.
Now if a host comes in, in this example, and has
the same source port number, if this was a different host,
and says, "Hey, my source port number is 2597."
He would come up there and send a NAK, which is really
a TCP reset, and they'd have to try it again.
This is why we might have a pool with NAT overload
that gives us more than one IP address to use,
because if the first one gets a NAK,
we'd just use the second one in the pool.
If you had 10,000 or more users,
that's why you would do something like this.
To troubleshoot NAT, there's a
few things we wanna keep in mind.
For the CCNA, make sure you're inside
and outside interfaces are configured correctly.
Now we have show ip nat statistics, this is very important,
this displays the hit counter for NAT traffic.
It also shows me the summary of the NAT
configuration, and active translations.
Don't forget to check your access list.
Make sure you have all your inside locals
permitted to use the pool or the interface.
Also, you can go out and check your interfaces, show run,
go ahead and check the active configuration file.
Another thing we wanna do is make sure we do that,
show ip nat translations.
Make sure that we see what's in there,
and if we're having problems, we can clear it out
with a clear IP NAT translation,
put in the translation we want cleared,
or by using the asterisk here,
what we're saying is, "Delete the whole thing."
And lastly, debug ip nat, now you're not
gonna use this during the production day
because it's just gonna be way too much information.
But if you're having problems, that's why you would use it,
you're going to go ahead and watch your translations occur
as they go out and as they come back in, and it'll
help you troubleshoot any NAT issues you may be having.