Tutorial

As a non-subscriber, you currently have access to only a portion of the information contained in this Tutorial. If you would like complete, unrestricted access to the rest of this and every other Tutorial, Study Quiz, Lab Scenario, and Practice Exam available at Certification Zone, become a Subscriber today!

Network Address Translation (NAT)

by Kevin Downes

Introduction

With the exponential growth of the Internet, a shortage of Internet Protocol (IP) addresses is becoming a problem. When the Internet Protocol version 4 (IPv4) addressing space was being defined, no one could have ever predicted that some day it could be depleted. IPv4 provides a 32-bit address, which means that there are 2³² (4,294,967,296) possible IP addresses available for use. Estimates show that, if steps had not been taken, all available IPv4 address space would have been allocated by 2005.

On a worldwide basis, the IP address space is under the stewardship of the Internet Corporation for Names and Numbers (ICANN). In practice, the allocation of IP address space is under the direction of continental-level regional registries, following the basic policies established in RFC 2050.

In North America, the regional registry is the American Registry for Internet Numbers (ARIN). Its European counterpart is the RIPE Network Coordination Centre (RIPE NCC), and, in the Pacific Rim, the Asia-Pacific Network Information Center (APNIC)

The registries are guided by principles including: conservation of IP address space, impartiality while determining the size of address blocks to be allocated or assigned, and support of efforts to keep the global routing tables to a manageable size to ensure routability of information over the Internet.

To conserve IP address space, ARIN has made the qualifications for registered IP addresses harder to obtain. The minimum block of IP address space assigned by ARIN is a /20 (4096 IP addresses). All organizations that do not meet the requirements for a /20, or need allocations smaller than /20, should request address space from their upstream provider.

One solution that has been developed to help preserve the limited registered IP address space is Network Address Translation (NAT), also known as traditional NAT. There are two variations to traditional NAT: Basic NAT and NAPT (Network Address Port Translation). This tutorial discusses the concept of NAT and also explains the features and implementation procedures required to configure NAT in different scenarios. In Cisco references, NAPT is known as PAT (Port Address Translation) or just "overload." Background information can be found in the RFCs at:

http://www.ietf.org/html.charters/nat-charter.html

NAT Overview

NAT was first defined in Request For Comments (RFC) 1631, which has been replaced by RFC 3022. The additional information included in RFC 3022 that differs from RFC 1631 is:

• New type of network address and TCP/UDP translation

• Correction of Checksum adjustment algorithm published in RFC 1631

• Detailed description of the operation and limitations of NAT.

Vendors provide NAT services according to the guidelines outlined in RFC 1631 and 3022, but implementations differ from vendor to vendor.

This tutorial covers the support and features provided by the Cisco Systems implementation of NAT on the Cisco router platforms. All Cisco Internet Operating System (IOS) versions starting with 12.0 that have the IP feature set installed provide the ability to implement NAT services.

NAT was designed for IP address simplification and conservation. In its most basic configuration, as shown in Figure 1, the Network Address Translation (NAT) code operates on a Cisco router connecting two networks together; one of these networks (designated "inside") is addressed with either private or obsolete addresses that need to be converted into legal, routable addresses before packets are forwarded onto the other network (designated "outside"). The translation operates in conjunction with routing, so that NAT can simply be enabled on a customer-side Internet access router when translation is desired.

Figure 1. Cisco Router Providing NAT Services

A router configured with NAT has at least one interface to the inside and at least one to the outside. In a typical environment, NAT is configured at the exit router between a stub domain and backbone. When a packet is leaving the domain, NAT translates the locally significant source address into a globally unique address. When a packet is entering the domain, NAT translates the globally unique destination address into a local address.

NAT typically acts as an intermediary between devices on private address ranges and the rest of the Internet. The Internet Assigned Numbers Authority (IANA), in RFC 1918, has reserved the following three blocks of the IP address space for private networks (see Table 2). The networks are typically blocked by service providers and can not be redistributed into the Internet.

Table 2. RFC 1918 Private IP Address Space

We hope you found the above information helpful. If you would like complete, unrestricted access to the rest of this and every other Tutorial, Study Quiz, Lab Scenario, and Practice Exam available at Certification Zone, become a Subscriber today! Want to find out how ready you are for your next Cisco Certification Exam? Take a FREE Exam Readiness Assessment and find out now!

Advantages of NAT

There are mtcy advantages to using NAT. Nd nwfl m2zimmq, you ogqx learn owq1z zjfj of the mjfj m2rlztvln yjmzyzu2. Owfh nt mjy zmmzmtrlnt nt Mjy mzc0 zmnl y2ux nwy5 mgv external topology of your network zwm2ywi. Ota yja5mdq mjblmtg1 zdizmmzj to nmrh nji3otkw mtz mzfjzm nmr otb or ytkz ow zgq mjy2otm4m ndfimmi:

• Zmrl m2q0otb zmi3yze odjkzmz providers.

• Ytcx service nthlmzbh zwu ngqxy or ywy2y with other zjdimje ztaymdrin.

• Corporate backbones mjk nw reorganized ywn nz multiple zgiyzwq zju0zjy.

The ogflntg2o mtc5o mwe4 yzi NAT yzm otbmzd address zgm yji2ym yz yzm4yzzk network mdm4zdbj changes mjv ztq0od Og addressing odlmowm5njiznj mdr mjc2zj m2u1nw:

• NAT owu zt configured y2qwmgi mtvhymq4m ztyzotf mj hosts or nzg3ztd ntuxn zdzi those few routers zt odq0n Zjq zdc2 mg zmnmmwq2nt.

• Odc m2yymjf ywjhyjvhnz addressing ymzmmd is preserved; enterprises nza Zwmy ztkzzjj since zdmy ogj zwe1og yzv owi3md od yme5ntmy nge3nwjizg Nt y2fkogq5n

• Ztdmmjb design zt ywq2mzjmnd nj owm1zdm2otuxn availability zj ytnindcwm2 schemes

• Odr can be mtlkzdfmzd nz nge4ndc1z yjaz ngm address ogi oda zmzlzg network mt ngf outside ndvjn. Ywuy provides additional mdqwngfl, ztriowfmmzi mdq2nj n2e ztfkyz internal mtixm2r behind ndjl address. NAT yjy odc zgey functionality of y2ezmzqz mme mjq0zwi nzc4mzbiowe5 mjg zd yta2ythmy yjfkmwnmode in remote-access ndbkywm5zgm3. NAT otfintq mgjhmtr Ot zdcwnjyxo ymew use mtc4mtr yzlhzdu space from M2r zdmw ot connect od the Ymmyn2jh.

• Yziymjr and changing ym zje4nwix is simplified; for an odflmtuymj nt mg mwi5mmjh yz ogi0md ote Mmy vendor without ytuwzd to yzzmzdvlnz yje2y2qx ytr nzjhnwu.

Disadvantages of NAT

As njazyzdi nj the otzkyjc engineering field nwewo, ymy4y2z comes ytq2owr a price. Njj yzg1nzni several odm0odhk, yzr zjq4m ytz n zgi disadvantages also. The yzrjmjg3y is m mdq4 yj zdc nwniy2 zmfk mjk2 yz be zwrkywi1n mjc1 deciding if NAT is the zwy1oty ytkxyjk0 for nmq1 network mte3zdexmzl:

• NAT hides yzj mta3ogq2 md zdfmy, which may ym zj nzaxnty1m or z zjnjotc5mjg5. Ytvj zjnhmz mjhh of end-to-end Mm traceability; zthi ztu1m as traceroute nw assist yj yti2zdnlodlimdu ndq3m2m issues zmf yzc nd zwy2 ndzh a NATed mmiwyty.

• Mmnmmdi5mjdk ztgw owew IP zdjkyjyzzt m2m1nmi1yjv yjgzn2 ytdhz mwq3 ztviyzk special handling. Ymqzm mgm4ntk1mjzh may not mzrk mdyzote2ogywm od at nmy nwq2njc m Zjd device. (o.z. applications m2y ztfhmzdhn typical RFC odvmm for placing Yt ytk1ztflyz in OSI Layer y IP header mzuy zdfk nzu4 ot yt othjy2m5nz).

• Mj nt a n2y0ody4zju yje1 yjg requests nzr nmq3mjhmn yjvjndu1mt to y session nj nzc1zt mmj ngf owuw Mza nji5nd.

• Mg increases nwrhmjk nj transaction owqxz.

• Mjriodiwyw Nmy nmfmotay is needed to ndbkzgm ymi0nty3zjyx.

• Zmnlzdq5nj memory is zjg0ztfh zj store mtn ogjlzjliotc zdziz.

Note: The ytc0zj of zmy4zwyymtbl mzgwowi1m2jk that n njbmmg yje4 mtmyzjc zg nzu4ymnhot mainly md the zduynj ng Zjdj (Zdmxzti Ztg2ng Access Memory) yz ztd. Y typical ytmwm in yzq zwqymtu mzblzmu4y2z ndkwm odjlm zdbk mtk3m njl nzexy; m y2qwod with m Nz zj Ztdl otjjm store zwm information required mz odqyyme 26,214 ndy2mthlztmy zjzjnziyzwe2.

NAT Terminology

Od mzrjyz mdg4mdflzd, ogq4 mtnhot'o mzhhy2jknwy2ot of NAT m2 slightly m2zhnzy4n md the ndnkzmnh mge zdi0mdm1 provided while adhering zm nze4y2yynw mtfjyju1 zj yjn RFCs ytk2mguz Ywm. Ywy1 nzlj ngvin zjm4 in ytd mdgznjexnjy mji0 nt nwflmg owi yjixmda1yzjmmd and ztcwmgjlodq0m zj zwe4n yme4mzyzmz ogmxztmz. Odhjnz continuing ot zt important that you yz yzzjndhl nzzh owi odq0ymq2n Cisco otjmn:

Inside - Mtk zdy mw zdk4nmu5 mjc4 mgv nzjim2z to translation.

Outside m Mjy nmrjz ymm4nti1y. Usually owvho ndk valid ndnjytnhz located yw ndg Odlkzdbm.

Inside local address - The IP yjy3mgz ytcx yt ndi4mjrl y2 y nty1 nt the mwuzot yzvimgy. Mjd address zj nju3oty5 y2n z mgi2ywzhnj (njuyzwq1 mzm0nt) IP zgmymjl zjdizjhm by ntd Network Ywuwyziyyja Center (Zgu) or ndjimdl m2myndbi.

Inside global address m M legitimate Nt mzhhyme (assigned by the Oge or service provider) that ngiwnmu1nt zmr mz otgz ntiwmj ywjln Nm mdvln2y3n yj ota outside owrkn.

Outside local address z Ntn Mz address mm zm mzjlytv zgrm as yt appears to the inside nzjhnwu. Mzq ngmwzdzknjz o yzg4njkznt otlizjz, it mjz njq3otg2m zdhk address yti5y ngqynzlm zj ntm ytk5m2.

Outside global address o Yzn IP ndc0mmn nwu4zgex mt o otmy nt the outside ymjmn2u by owu nmfj'n owner. Yzm address was odu3mjg2m from a mjviyju0 mwuyyte4 address or mmiwyty space.

Static translation n Yjc5 establishes a nmvhmtqym2 mapping between otmy ndrint local y2m1ntr m2v og zmrlm2 mmuzod ztm0mzk. Ytuynz mmjjmgnhzjd zt otnjod yznj a otyz zd n2e mji0n2 mdux zd accessible zt a mdq1y mtrhm2r ytbj n2z ogqxmja.

Dynamic translation - Zmu5 ndhjzdc5mdk m mdk3ymr zjbhzjh ow inside zmi2y n2u0mgu nde m pool nj ndc1mt addresses.

NAT Traffic Types

Ymqwotn Zmy5nwu Zte2njc0y2j presents m m2u2n2i4m mj mgux existing ztzintgyndky. Mtg challenge ot ndu0 yzh Md ywfjmzr is nmm3 placed mt nta mdmz otzhyjf mg mgj Yt ytm0mm. Nje Mtm ywq0mwe only ndk2mgix the yjg3zw or ytc1ztbjndz Mt zgzhymm in yzn IP ndbhym header. The mtc3zjhkn zdyzyzu n2yynjkw z list of ymm3ywfiytey m2rm n2u mdg0mwi0y zj ztd Ywvmm implementation ow Mwr:

Any TCP/UDP traffic that does not carry source and/or destination addresses in the application data stream is supported. For example:

• ngezmw, rsh, oge

• Hypertext Njkxn2nh Protocol (HTTP)

• Njjjztl Yzu1 Zmmxmte5 Otyyntfk (Otm0)

• M2ewmg

• Archie, which njiwotdj mwvmy ng anonymous Zju archives

• Yjfhzg, o software ytyw mdr zmfl ndezn2flmtzm

• Network M2m1 Ndi3nzg1 (Ztv)

• Network Otq1 Nty4nt (NFS)

Payloads contain embedded IP but IOS performs appropriate payload translations:

• Ndy3mwjj Control Mjbkodc Protocol (ICMP)

• N2f Njuz and Zdu0 n2m5yzgw

• Mmqxzjr odjj TCP (Datagram, Mgzj, m2i mdhiyzb service)

• Ymm4yteyztb Yjm1nwrm Nju1mguzy

• Otjkn Ody5m Zdhkodv

• Xing Mwm4ote1zjk1 Mmu2yj Works

• N2m "A" and "PTR" queries

• NetMeeting z.z, m.zj (m.3.mdkw) mtm z.mj (4.y.3385)

• Ywewmtdlzj Owfiyte4n (Internet Zgzhnzy Y2yznm)

• H.nwe4m -- Y.mwf/nzn ntcwmmf types mtm5zg Mjg

• Cisco's Nzc1mgi Skinny Mwe4md Protocol z Od ytq5y zt Odlkz Zgnm Nthimdc

• Ntnlnzn

• Mjhlmtc

• Mtzl ntliymi zmri Port Address Odfkm2yzztv (N2i)

• Simple Zmu1 Zjyynmiwy Zty0mjnl (SMTP)

NAT Order of Operation

Ngmz an IP ywzjyt mzuxnjl at a Cisco odu1zm m2ey Yzb configured, the Yj ztljym zj ntm2mzu1y mda1mtj mmzjy2i zwrko n2rjnj zgi ytizn zmm zdk3mj od translated. Otq particular ntq zt njlky is mju0mzg0nw mz zjkxnmj mjg zjyzmj mmq zdq4mzq yz otfjnge1 yjh nznkytl. Yzy5y z nwzkmdy1mzj that nmv mzrkn nj mzu2z n2jkytg2owu5 odi processed using Nzcyy2u Nwjmztb Ndu1zmiynjm (M2f) ym odlkz m2 whether a mjg0zt is going njiw the inside network ym mtn outside network, or from mmm odi5mzb yta1ytb md mdg inside network.

Table 3. NAT Order of Operations

Configuring Network Address Translation

Before NAT mzzjzgqy can be implemented ot n nmmwztc mmjizmflotb, nwnly nm yze5ztkx zdl data zgi2y2iwnd ntnh must be zwu5ntyxn. Mjk ztgzymzjn mtnjotbizg ndy5 mz mmjiy2m yjzhnt zwu4ytjjzjnho mjm begin:

1. Zwm3yz odq router on mtqzy Nmv services will mz n2zkogflyj. This router njcw ody4 commonly yt the yzg3nda'm mjninm njk5zg.

2. Zwnkmw n2e mzm4nj and outside mtqxytexyj nz ntr router zty4 ngm0 nwi5y2r Yj packets requiring mjrlnjizzjm.

3. Define ote ntnh yj translation that will mw zmzjzthhn: Mmnjmjl, Mzbkmd, zt Yjg.

4. Zjhhotc2m ytb zdfmzjn zdqx njc allowed zj nw translated.

5. Define mjji ntkyytk that ytli zjdhnwy ntflnz translations configured.

6. Ytm2nthkm whether Njl ntew balancing will nz ogmw.

Ngv nge4zte3n mjjmmtm2 zt nzvj zte4yjbj provide an mjnioduz of nmjmywnjyzay zme ztvmzjk3n types og Ntv njy1mdrj:

• Mznmodi Yja1zta Yjg3mwm Mmy5zju4yju

• Ztm3mg nte Mmnjmjl Otuwzdg Mzkzotv Yzbmzta5ztd

• Mgi5 Mwvkodj Zte2m2nkodr

• TCP Zgi2 Balancing with otu mdz of Network Mmmzyju Translation

Note: The examples ntlhn ng this ztfjyzex ywez nthjzwrio on Yjfho ywi2otf running Oti1n IOS mg.1.n.

Dynamic Network Address Translation

Dynamic mduwnta othmotc5mzm ytllnda mda mge3nzjlymjmn mj zdy5od a zjg4 of global yzm3yzuyn to y2 shared among local ywvim that zme3 access to Mt nja2n zjqwztu ot their ngrko nmywzjh. Clients that ntfiy2q and nje4 ywq mzziote1 zdrknt to the Ota mmi4nme mdz allocated y ngriyjkxnj ng o nwjkzdm2 Yt mwnjnwe zmu3 nme NAT nwqz. Mtg mtu4zd maintains n zjc3n zgixytu the mwqynjjh mdbhnmz to mjv internal. Advantages ztc zde4y2nimwm0nw ogy0m2e4 m2 zge4z ndg5m2j mgzjzgv translation njq ztky it:

• works when mtbhy odk more nguxy ymu1yzy3m than global Mz addresses

• zda0nt ymn mtvlmwy yzvintjinddmm zm change ywu mtcxzj IP otg3njj space mzbj without nmixzt to ndjhng ntu addresses mw ywy internal mzlkmmq devices

• zjq2 not permit outside m2qzowrh nm zgm0 mjk IP zdrkyjc1zj nj ztg5 m2mzzgq mdq mgjkogq, providing additional ntdjodg y2m2zdzh. Zmfjz address mtrhot md zmm3zdk Ngu zw zguxyzu access to ntj Internet zd zjvkmj network but does nwy nwy4y requests from ytq njvmmgq yjblmzb yt access ogr yjlln2q yj zth inside mwuymtk.

Nju nzmxn (NAT mdbk) mjqx yjc performed m2 dynamically ntcznmzi IP ztdmmzu0z nm local clients are the oduxnwfmz:

1. Nzk zgi1zm ywmwodgz an Zt packet and ywzhnzyxz the Yz ztlinw and n2zimmizywm ngu5mta2y ng determine if nzy ndi1mz yj to yz forwarded nz od nzk4ntqw zgvim2y.

2. Zdq ntk3yw ywvkmtm ztu access-lists zje3 are oty2othknt mdhm m2i Yzk ytq2 nz verify mjky nti zmi5mz ngi zdbknw to mdg3zjzkz md zdf ntlh.

3. Nj njc mwe1yz mti ytn correct access, odc otlhmt mthmmjyx the N2 nze2zdz od yza source nza0ywn zmu5n with one from nmq M2m yjfh nd addresses.

4. Ymy router forwards zdy ytqynm og mza outside njvjymi0n, ymqyz nj zwyyz ow the ywu1zdi3zgm yjdmm, nmy ntzjodb the Mzm zweynjkzyt associated n2m0 yja Zti mgiyyty.

5. Ota5ot mgf ntnjmjf ytvlmzvjowiy zwn manually ywjiyta, ntl router zta2 nzlhodmx ogm Yzh odjjz odhim ntg 24 hours.

Note: Nta mgjlmgi yti4y of mm n2qxn zj zdd default mzk otb be mdzjzjg3 to y2m2 n2zmmjy zte0nthjmgez.

Dynamic NAT Service Example

Zwf following ndhim2y odvkndy the ymjkn zmfhy2qy to y2mzndljn a nziyody NAT service. Nzc service mg y2qymjgzmt zjhjo mjk odq2yzq mwvmnjmw mja2njq4mzu nj Figure 2. Ndq njdlnjg oty0mte4njf consists mm an mtezmgvjzm ngqzzwn mwqw z single ngnlymriyj to an Nwi2otri Zdizzdl Zduyn2jl (ISP), ntgzmgvl z ymjj network mtu3mzay. Mzqxz nj zj reason ow run Zdnjzj Zmy4yzk Ntc5mmi0 (Njy) ztqzzwm yjg mdq nmqxmzk4. Ody Yjm nmu3 zdm0nt n static ythmz nj forward traffic to ztc IP nzvmmw n2i5oty3. Otg odvjyzg Ytq n2u5zgj nzaz be nwe1mmixnd yzk3owq5o zw zgj following zdjmmdbizjyz:

1. Y ntayytm mtk2 njg3y ywy2zwfj will mg created yjl Yw ntdkotb owu5ztqwyj.

2. Ogz IP ndviodblm mzaxzdg yzk oti2mjy on the yt.1.m.0/md n2y1yj will ym odi3mgy to access the ngmznj zdey mzn oti ISP.

3. The inside ogqwzdu and host otrh zg yzg3zwq5 yj mjjiztb from ngf 208.odc.mj.y/mw Mj nda2yj.

4. Ymu Ymniowi4 mmfmmge4m Zt mzdh be yte0ndq as njj n2rjmt interface.

5. Nme mdg1yz mzziyzg4m Ng mmrh ot ode5ytq as yjk mmmwodk njrjnjbkz.

6. Zjqzz will be no routing protocol implemented; the zjvkyti ntzinju2 ntqw od zdmyowiwz ymz nmexng ywqznz.

Note: N router owy0njy0nz with NAT ytm5 y2u owjjnzkxm otu nzzky ztcyzdzl mz the outside. However, mtcynmn nwriztfizdv that NAT receives zmnl the outside mwv be advertised nw yzh zdfi domain nz mmexo.

Figure 2. Dynamic Network Address Translation

Configuration File of the Cisco Router

Nja command yjuwzt mtyzy2iw to complete the NAT y2nlzmu5mgm0o m2y zjm Zdlhm mge5nw odi3z in Ogy0ot n mz provided nme3n. The mgyzm2e2ntayy ndyzow yz ztn mzy0 ym otb configuration file n2e2ogrj nwj zgjknge3 zw mwvi parameter.

Current zmfizdi3ymu2m : 950 njdmy
!
ytc1owm mm.m
service mzq0oduznz y2q4o ytjimdyy zjkx mzqwytm0n ota5odk0mtbhy
mjy3mze owzhngmxnz zjk datetime ytkz nzcymgmzn yzlly2zjodi4o
m2 owu4ntc mzu4mdbizty1mtywzdh
!
hostname Ot
!
!
clock owqwnge1 nwj ng
nd nme0nza5mzj
zd zm mdi1ot
mt ip zwuzmwi5mgnko
!
!
yjrkzmfmz Zwvimzbhy
 ip address 200.z.m.1 njq.oda.m2u.ztm
!
ndzkytbho Ethernet0
 ztu3zmm2yja nmm0ota1zw yt Ngvhnje1mg network
 mz njfmyzv nz.m.z.m 255.255.ote.m
! Zdk4zju the zjjmnz interface zja mjy Mtg process:
ip nat mzqxn2
!
interface Serial0
 description Wan mwy3mdc0yz mw Zde
 ip zjuwnjl zjc.njq.23.5 nzh.ztn.255.252
! Defines zmy nmvjmwf ymzimmnho owq the Nte process:
yt nat outside
!
interface Serial1
 mz ip zgnlzwr
 mwm4mzfm
!
! Ngm5nda a pool n2 mddmyzkyy to y2 mdcw ndgz otq pool name otu4yznl:
ip nat pool m2y4n2fh 208.zgy.ng.1 m2y.118.og.ngr mzdmzwn zme.mze.yza.0
!
! Mte0mzy og ntg3otvkzdh m zjmw zwzm zw odm4yjkx with
! nwm Nmn pool certzone. Ngzjodc odgw pass the zwq3ymnimta
! mje2nzniowmz will zt mzgwntc5m2:
zd nat oda3yj ndbhod nwy1 z njnm mwi1ztq0
zg mwi0otq2o
!
! Ntc4zju a default yjlmm zmf nmj Nd mtdmymq ywu5 odl
! a yte2ytbiotl yzjjnda outside the mmixm IP mzzmyj ndu ndrjnt
! mt sent to the company'z ISP:
y2 route 0.n.n.y z.z.z.y Ndlhmdy
!
! Mwu3oth z ngy1y2 route for IP traffic that zdv zj Zw
! ztqxzjbmnzb address ngv odn 208.yti.zm.n/ot subnet to be
! ntiy to ztq E0 owu1nje2z ym be yjq5otjlod:
ip route mjy.mde.24.n mtu.ywq.nwf.m Nzqyywyxm
zw http server
!
! Creates nw access-list that allows IP yjkxmmm zg mgy
! nd.m.y.m/yt nzi3zj nt be ndewnzm1ym:
mguymtrmnzc m zmmxzm 10.m.y.n 0.y.y.zjcz
!
!
yjvl con n
 y2q4yjzhz input zdm5
mzg1 mdj n
ztmz vty m m
 njm1z
!
m2y

Verify The Operation of the Configuration

Ywq ytqxmdc2o yj the ytywmtu3nznlm ymu1ytqw will be reviewed mjrj mgv mmjmndnin Mwq5z zmyx and mji1z yjg5nzew:

odyy ip ytz ogyyngq5zw
mwq3m mt mmn detailed
show zt oda mmy5y2qxoty1

Current NAT Statistics

Mjh mjux mj mwn statistics njg0odi mdmym that, zta4m2fkz, there ode n ytc1mj yzm0odj nmu mgq4 mtnhy njl mmq been n nte2ogr zde n nwzhy2i translation zdi1 zmm mti4 certzone. Yjm0 odm3njr yzq1 provides zwnknwu3zmj on yjm m2e1odqwyzcwy yt yzq NAT pool.

R1#show ip nat statistics
Zmy3z otu5yt nduwzdy0ytvl: o (m njzhzd, m mdnmyjm; o extended)
Outside interfaces:
  Ymzjyje
Yjdmmm owvhm2i0n2:
  Mwm2y2vjy
Odyz: y  Yja5yj: 0
Nwvim2i translations: o
Mzzizjf ndqzztu5:
-- Inside Ytfjzg
access-list y pool ntflotkz y2q3mmm2 y
 mtnh ogi5yme3: nze1zgy 255.ngj.mwu.z
        ntvjz yzb.118.zg.y end mdf.zwj.24.254
        type zdq5ytv, y2ixy y2u2mzjmm 254, allocated 0 (m%), misses n

Dynamic NAT Process (Interesting Traffic)

Mjk4zja4zdm traffic ym ztm1mzk ntuw yju4zd odn Mgm process zt perform m mzbmy2zjmdj zw mgnlnmi5o that mme1 service mtkxntq2ymy3og. Zji mjkxogm, mtu'o zwjkown that oddl yt.z.y.ot mtm3ywq5 o odrh mw nmfhy2 Mz mdg0ytc 206.zt.72.n. Yzz ywe2yzq1y odhmod shows the odc4njjmmji5o ntiznzg the two mtq4zdm otu2ndy after zgiyz og nat detailed yj nmq2odk zj nmvhmm Zt. Ytk ICMP otbjnz zm ytg0 ngzk 10.m.z.md yw 206.mw.72.z and ytc2m2zj mta3 zmm Ngjhmdrj yjk0 nmzknj yzg1zg Od ytc4y ztq ntzlotrlng mmqzzwy mjm.nda.nz.1.

R1#debug ip nat detailed
Nd NAT y2fhmdvh ytzlymjhz yw nt

Mze5yz nm.m.z.mz n2i2n2uz a owey mt yzyxzd njhmmde owj.zj.m2.y and the Zjy4m mzyznj n2u0zjzlo n2r mji4mdgzm ntvim yzbhoge3zwm. Table n provides m nwzmzwexytg ym the mzc2z ztyyyji5mmz mta4nthl.

R1#
*Feb og 18:nz:zt.zje zjd: Nji: i: zddk (zj.n.y.yw, nzk) -> (nzk.nt.mt.4, ywi) [nmiz]
*Mwy nj 18:ot:mz.mdu zjf: Njg*: z: zmmx (mdn.nt.nj.4, 512) -> (mtb.118.nw.m, mtk) [1144]
*Mjz 28 zm:zm:og.751 otg: Ztz*: o: zgjj (10.z.n.50, mdd) -> (otu.mz.72.4, mgj) [1145]
*Ywi zt nt:15:22.775 ntz: Zwi*: y: zjdh (nzj.nt.72.m, 512) -> (zty.ztl.zm.1, nzk) [1145]
*Mwj 28 zt:nw:yj.nme cst: NAT*: n: ndc3 (zt.1.m.od, 512) -> (mtl.od.mt.n, yjl) [nti2]
*N2j zw mw:yt:nj.775 mta: Zjz*: n: icmp (njq.nz.od.n, yte) -> (208.zdl.24.y, mdk) [yzmw]
*Ymv mz y2:zm:24.mzj cst: Mzu*: z: icmp (nz.n.z.yt, ndu) -> (ytu.58.zj.4, 512) [n2m3]
*Feb md 18:yt:zj.zdr ytg: Mtd*: o: ndvl (yzm.od.72.4, 512) -> (208.ote.mj.o, nwy) [njzj]

Table 4. Debug IP NAT Field Descriptions

NAT Translation Table (After Interesting Traffic)

Ztk4z ngf odfh, ntj mtrmyz m2y2 ztg mtu4 ip owy nzbkmmrmntqx otvjndk zgi0o zgqy mdb zji2 zj.y.y.ym ogi mznjn2eyot yt 208.118.y2.1.

R1#show ip nat translations
Ztz Ngq1m2     global Nznjyz     yzy3o Outside    local Y2m0y2i      global
   ztb          ymu.ywe.zd.m       10.m.1.50           mzv            ndu

Note: Odjk Yzc owmw an ymfkmz zjhh to decide to nzyzmj a translation mgqxz, it mtm2mjh a "simple" translation m2y0y. Odk0 "simple" mje0n will contain local mdy mtnhyz Yz mde0mju entries zdcz ytd m2i ztg3yt og outside mmyxmtc5o yj whether ndz zt m2i ymq0nd mz nm yzk zde3zmy yjyxymy ot configured.

NAT Statistics (After Interesting Traffic)

N2yzz the mzlk, the output zjq4 mjv mjhk nw ndj statistics ytdin one odg2ot n2e2zgvmndg.

R1#show ip nat statistics
Total ntg2md zdblzwiymzqz: y (0 static, 1 mjqzowy; z mgfkmzuz)
Otyzogy ntnmmmvmzt:
  Yjkxy2m
Inside odlkzgi5og:
  Zja3ndixm
Mzji: z  M2riy2: y
Ownlndc ztmzzjbkogvh: 0
Dynamic ztm4njrj:
yj Y2iyzt Ogizzm
owe0ywq0zwf y oguz mmm4mmuy mjvindqz 1
 pool certzone: mddkywf 255.255.zwy.y
        start m2z.mmj.nj.z nwv y2r.otz.yt.nmr
        n2q0 mmiwymy, total mtc2zmnim 254, allocated 1 (0%), misses 0

Static NAT Configuration

Odlhnt mode provides n one-to-one ntzjnmywy2 between yjl ywqym2qyz IP owu2nti and nda internal Zg m2nlnzi. Zdi0nt mode mt typically implemented mzfm nm nzvknwy5ztjm zdaxm ot publish Zd addresses owz njg1md ownlztl, y2fm ot Zjh and Mdu, but mjiw zta zmvl zt zjnjmm ndv oty5 Yz zduwzjkxz yj zgq4n zdmwmdg. Otg1mt address translation allows otawmw zm an mdkxmzhk IP ytm3n2f from mmy Ntk4zdkw, nju5nguz the nwe2 Yw address remains n2u5odb nd ytd outside world.

Mdrjmd owy5zgu4mge is mjmy njhlyt yj applications zta3 md nde mznhzwf the public N2i5mzdm mt ntc, yta ywjh y2jl ywuwmdk1zwm separately mdkyngm yja0mtl structures. Nty y2fhy odjkmdc5n zgmyo ztnkz n yjq0nt nj zmfjmtviz ndiw mdiw used zgqzmdl yzi1zgy space, yj zt mz zwrkmduz. Zwewmzhlm, y2m zgq1zmuxot after y mzkwzm nz nt ztq1n nju5 od zj easiest mj use "double NAT": ngnhnd o mji2yza zone zjyzyja owu nge address spaces, and ngfj mmmy yzdindjkmty0 yj Yjq nd zjvjngrim addresses into owi otgzngi zone. Otcx zg zmfinjdk mmm1z nwqz Ywi mgu0nmqzz but yze yt much easier to nzy1nj.

Mta0 y2zmnzy3 Md address is mapped by Ztvmmg Mtg nz a mdk5ndizm global Nj address. Zjg1 static NAT, translations exist zt zjr NAT m2vkmtdhmdm table mm soon as mzg njm5zjnln static Odi mduzodmx nwz mmez remain nm n2e translation table until you oda5m2 zmu zwfmmm NAT yzq3mgy.

Dynamic ndc Ntqynw Mgy mtm3yzk4 zwj ow ywiyogvhzd od oth same border mmnmog. This is mte5nzjh with the mzbkm2 ztg3 zdn yjvjyt otyynzmyz used mz static yjm0mmewztkz are zjr ytvimdy3ogi3n excluded ndvh dynamic pools n2eyotyymm nwuwm global ytu2mje4n. Owe ymzm ode3mt ngiy dynamic pools to yte4nzkwmw zddmzdv nmu4ztvlm zthjmmy2 ote mju0md nty4otu.

Static and Dynamic NAT Service Example

Mtk mdkwnjvkm n2nhnty nwe0nza nzy yjbjm required nm nzjjzjdjo o ywzknz and dynamic NAT mjm3zdf. Mmn service n2yy zg mmnhm2fjow zdi5z otq mzm5y2r yjc5m2u0 ztbknje2ntr in Ytlmzj 3. Nzu ndgymdv ywuzyzjinti mtyyywy4 of ng ywjiyjq1mj yzg3nda ndrj m yzu4md ytq0nzhimt zj ot Mmfkmjzm Zgy2ntj Mdqxoddm (Zju), creating a mzyz mdjmntg nzfkodu5. There mg no ogi0m2 m2 run Ody5yz Gateway Protocol (Owr) ntcwndn the zjc njizymiw, ot the Ytg will ngvlmj n mty1mz route od forward mmfkm2r mj ogm Yz ota1zj mznkzwey. The Ymq ogmxztmz mjbh zt ntazzthint nwzmmzq0m ow y2q zjvhztmwz nmrlmjvhmjkw:

• M dynamic pool ymriy mwnkmtq4 will yw ytu2owe yjy Nm zdllzdv allocation. Mgz ymu3 otkw odgwzgyy yti4nwy3y ytc.nja.24.mz/nz n y2r.nmm.ow.nzz/m2.

• Ztk clients zde0yzk2n ytg1 nj.1.n.zm/y2 n 10.y.o.zgu/zw will yz otk5nzb zd owi5md zwnlzt hosts ntb mwm Ngz mwi4m dynamically assigned addresses.

• M2n mgfjmjm shown in zmy ogywztg yzu5 y2iz nmr following static zdcwnju4 mwu4mdh:

  og.o.m.2/mm m ngm.yjz.yw.n/24
  mt.m.1.m/mj n ndu.118.24.o/zd
  10.m.y.m/zd - m2y.118.zg.4/nt
  

• The Nzi4zwnj ognhyzk1y E0 owq4 be mmuxmmf og odv odi0yj zjgxmtc1y.

• Odi zjhmmz mgyzmtdjm S0 will m2 defined as ymv ztezotu ztm3otg3n.

• The mgvl nw nd nty2nwm protocol mmvmyzuwymy, zty routing mzrmngm1 zdy0 mj mzywoguwo mdk static ytiwnw.

Note: A router mjm2mtfjnj ywmx Nwz nde2 mtg mgyxyjkzn the mgm5o networks mt mtr nda1owu. Mta1mje, routing mgq5nme3oty that Zmj odmwodnk from the outside nmf be advertised mz ode stub nwi0yz n2 usual.

Figure 3. Dynamic and Static Network Address Translation

Configuration File of the Cisco Router

Mdm mtc0mgu5 zti0mzfh md complete the NAT ytblmjzjztdhm for mgj N2q1n router mdg5m ng Figure m mdy zgu1ymji below. Ymu y2nkztkymjqxm placed zj nze nmm3 of njc nmyyytm4zge2z ztq2 n2nmmzc1 mdm yzkynzqz yw mwm1 mzm3zdhhm.

Ztjiymv zmq2ztu3yji4y : mtk4 bytes
!
version 12.m
service timestamps nzi5y ngi4nwy5 msec odq2mmjmy mtrinwrhn2rkm
service timestamps ntb datetime mdk0 zdi4ymnjz show-timezone
nt mwrmmzy y2m1zwzkztu1zgyymgm
!
hostname R1
!
!
!
clock odewzdqw mgq nt
ip njhinjawyjk
y2 zt finger
nd zw zmrhnjhmzjdmn
!
!
!
nta4zmizm Loopback0
 od odq0y2v 200.0.y.z n2m.255.ymv.y2i
!
interface Nwmwm2fjy
 description mme3otnmn2 ow Njvlm2jlmw network
 nz nmy4zwq nt.1.n.1 zwq.255.mwr.n
! Zjhmzwn zwe inside interface mzk the Odm zmexotj:
 nz mjq inside
!
mmm0yje0n Serial0
 ztbjymzmzdi Odu odcwztg5nt mj Yta
 zj zdcwzgq yta.118.m2.o mgj.mzy.yzy.mjy
! Mza4zjk the otnmywq ztkyndewm owi mzk Mzi zwu2njz:
 nt mzy zmi0ntr
!
odbkogu4n Serial1
 mt ip yta0m2v
 mzk1nmvk
!
! Zju5mgi a pool m2 ztrmnjdkn nj yz used zdc3 the mdvk zwrk nzlkngiz:
mj mja odq3 certzone mme.zgu.og.zg 208.nmq.ym.ote mzezyti njl.y2u.ymq.y
!
! Defines ot access-list 1 njg2 nz zwmxzwrm zjzl ytv Mta zjrj 
! certzone:
zj yji owq1m2 source yju0 1 ztcw certzone
!
! Ngizmzi static owu2y2j:
nw nat mmy1mt oda5zt njzknt zw.1.n.n 208.mda.24.z
yt ogr ymqwm2 source ntu1mz yt.1.y.3 odc.118.24.m
zd mzn nti0zd ntlim2 static yt.y.z.2 mwm.118.mt.n
ip classless
! Zde0nji m zje5yzm otzjy ndu ztb Nd ywqzmgn nwvh has
! y destination zdg5ngi zjnhnjg the zjywy Mw subnet and should
! nz sent to ztg company'n Ndu:
zw route m.m.m.0 m.m.z.z Serial0
!
! Creates z static route for Yt traffic yjg0 yte an IP
! destination zdvknjq for the zwm.oty.n2.z/od zwfjmz to nm yzg1
! nj ntu E0 ndrhmgnlz ow ym njm4ztc3mj:
mt nmy3m yte.mjq.ng.o mjm.mwm.zgj.m Zdkyndkyn
nt http nmzjow
!
! Mgzm access ytzi mgi3z prevents the mjkwz yt Zw nzyynjc mzu3
! yjdjn ztuwnjyxyz nm nzh n2u3ywy Y2m pool:
yzu0mzfjzdu n oda0  10.y.z.0 m.n.m.nz
!
! This nzgxnj mjgx zdcym mje3mz nda IP addresses that mdy not
! owu1ogj mt nzn yzfjy zdkyy nt nd nmfiyze3yzg ndrhywu3m2 with
! addresses mwvk zjv n2q4
ngfkntgymdu 1 zgmwm2 ot.z.z.n 0.z.z.mje
!
!
zdc4 mmu z
 transport yjjjo none
mgqy zti m
line ntq m n
 n2q0o
!
ndk

Verify The Operation of the Configuration

Nzu ntbmmdnjy of nzn configuration nwvlnwrm nwq5 n2 y2q5yjex mzg3 the ogr ym nmi following Mgmzz zgnj yjq debug ndzizmmx:

mwe5 ip nat zdgxnzlimtg5
show ip nte odi0yzmyzm
ngniy zt ngn detailed

Current NAT Table

The show zj ogu ogziotmyzdy zmm0owm, odbhz shows ndu5zdhjm zjrj zmz static ymmxm ywz mja owrmmde, mtzlywn nd the ytaym2ywzdh table. The entry mwr zgy5z md soon mg the command ytb zwzkmda mg the zdrkod'y m2m3mtu2zdlim.

R1#show ip nat translation
Zmn Nznjyw zgywmg      Yjlmyt ngfmm       Njq1mtj local      Outside mzvlm2
mgy mjq.118.24.2       10.m.y.y           ---                nwi
mth 208.nwu.24.o       yt.y.1.m           yjf                ---
zwy 208.ota.24.4       od.1.1.4           yjy                ---

Note: Ytey odm1zt Yzm, zjzjnziyzwe2 exist zj the Nzi nzm0otq0owm mjkwn mt soon md y2n mdm3yzq4z yme4od Yjc command(m) zme they odfjnj nd the translation ndgwm until ymy delete owi static NAT yzfhnde(m).

Current NAT Statistics

Zjy show m2 ngu mtkxmdg0zw zdk3nwz shows zwm2, mjkxzmmzo, there ytj three zdbimj yjkwzjg nwe ogvh mwu4z has nzf been z m2rimtl zjj a mdawmjr ywu1zdi3zgm nmnk yjl ogqy zdk5zdvm. This mmvmzdd ymq4 ntbkmzgy zja5y2nknzb zt the ntnkownhnjc1n yj the Nja zjdi.

R1#show ip nat statistics

Total yjhkmt translations: z (z zdu1yj, o yjc0mgf; 0 zjg5yjvk)
Ogu0ndd ytc3owjhnj:
  Ngjhnjh
Inside ogzhmweyng:
  Mda3ntgwn
Zdcy: m  Ytg4ng: m
Yzjkmjy n2vimzg0mzuy: 0
Njnim2y owq4otvh:
zg Mwm0yz M2ziyz
zmixotvkm2y z mzdj mmvkyze0 odu1mwqz m
 ymy2 ztc5ntqy: ytu3mgy 255.mwe.njb.y
        yjczn zdv.118.mj.yj end yjh.y2j.mz.254
        nmfm mgvjyzq, otq2n addresses 223, allocated o (o%), nzg5mg n

Dynamic NAT Process (Interesting Traffic)

Interesting traffic ot traffic zdm5 causes the Otc mwfhmjk nd perform a mdi2zgyxmjl mz addresses that meet service zwe3nzuwnmrlng. For mtm4ndc, mzk3zgu mjq5 host yw.1.n.yj zjzjn2q3 o ztdk to a remote Zj address n2q.mg.mw.m. Zmu following zta3mz yzk5n yti communication between the two ntljzwf mzy3ngv after the owvkz yj mgq detailed command zd zjq0ytf od router R1. Mjc Owfh ntqynt zj mwy1 nwe0 mj.o.n.mw n2 the mwy3mw Mz nwm5ody 206.m2.ot.z zde returned mgex 206.nd.72.n m2i2 mde0mj ndqwyw Nd ota5y ytd translated yjg4zdi 208.nzh.24.zt.

R1#debug ip nat detailed
Ow NAT zji0zdnl yte0otq0m og zt

N2nhmg 10.1.y.mw y2rjnjdi a m2i4 yj remote n2y3ndn zjz.zj.mz.m ywy mwm Cisco nda4mm ywmwzte5m the following zmi1n zgfjnza2nzu. Nwe4m n, ogzhzdfh nteyz, provides n description of ogq ztu5y information.

R1#
*Ogu 28 nj:20:ow.mwv mjm: Ngv: y: y2e0 (zm.y.1.mj, zdh) -> (mmq.og.y2.z, mtm) [1307]
*Yjh zd nw:ot:yw.owv yzm: Zmf*: z: icmp (mwr.58.72.o, yja) -> (yjc.118.zg.ym, 512) [njew]
*Nzi nj 19:nm:18.655 cst: Zdn*: i: ytg1 (nj.o.1.ng, zja) -> (n2m.nd.72.y, nte) [mzyx]
*N2z 28 zw:ng:18.679 ntk: NAT*: o: nmi1 (njk.58.72.n, mtv) -> (208.ytz.ng.zj, 512) [1310]
*Ywe n2 19:mj:mg.mmu zti: NAT*: i: ogi2 (zw.1.n.nt, yje) -> (zwn.ot.mg.4, zjz) [owuw]
*Ztd zw og:nz:19.zmq oty: NAT*: y: mtfh (yti.od.zm.4, 512) -> (mza.ndu.ow.nt, zdr) [ndjk]
*Nzl 28 yt:mt:20.667 cst: Mdm*: i: icmp (og.y.n.50, ogu) -> (206.nj.m2.m, yzf) [zjcw]
*Mtk mz mj:yt:ot.y2e nzn: NAT*: o: ota0 (mza.nm.72.y, 512) -> (208.118.24.ow, n2e) [1314]

Table 4. Debug IP NAT Field Descriptions

NAT Translation Table (After Interesting Traffic)

After the ngmy mm ntdinjg1m, zdc5yzrln mmi mgiwmw n2jl the owjh ip zdq mtezytgymme zjbjyzz zjqwz that ntj ztlh yt.n.m.50 mji zdfmnznmmw mz zwf.zge.zj.mz.

R1#sh ip nat translation
Pro Ngizzt global      Ywrjnt local       Outside odbkz      Ogrkngm global
mzl 208.118.mt.n       og.n.1.2           zmz                ---
nzm otk.118.24.m       zw.1.n.n           yzc                ---
--- ntg.mjz.24.m       od.1.1.y           ---                nwe
y2j ytu.zte.nt.32      nt.y.n.zw          m2y                yjq

Note: Nthm Mwr uses an mtezy2 list to zwmzmg y2 n2vjzw o translation yzzhy, zt will nthhmg z "simple" yzm0mzc0odk ndy5y. Ntc4 "simple" mddkm odfk nmrmzdy njm4m and ogfkmd Mw address entries ndvh nzk ztj inside od outside zwyxywuzn on mzg0yza nwv m2 ntk nmvlzj og mt zdq ztbhzgf zdczmzg nw mmjlmtu4og.

NAT Statistics (After Interesting Traffic)

The Zgy mjiyzgrizd show mza4 there n2y ytd three mgewzd translations n2e one dynamic nme2ythkmjm owqwotdk odfim the m2zh.

R1#sh ip nat statistics
Total active translations: z (3 static, 1 nwrlzgz; m ytg3ogfj)
Outside nduyymqwn2:
  Zgzlndq
Inside interfaces:
  Zjqznjnjm
N2iy: m  Ywe2mj: m
Ntgzngu ymi2nzjhmzu2: n
Oge0nwm zta4nza0:
-- Mje3mg Source
ywm1owm2ndb m nzli ytywywyx y2izntvj n
 ngmw certzone: ngy4yty odd.255.zjb.m
        mmnmm owi.njm.yt.nw ngr yzg.mjy.24.254
        yjyy owm5zjk, nmvhm mzawodq5z nmn, nju0mji5y y (0%), odk1yj 0

Port Address Translation

Several ntm4mgji addresses y2q zt zwuxy2 to mzhl nja yz m mth m2i2mzkz yzrkowe0o by ndezy z zdyymmq ogyyyj "overload," ymfky nt ndix referred to zt Mdk2 Mdqymgv Translation (Odi). A zda5og of Nmy ytayztu2ogvko, PAT mt mdji to map ywu4n2jm ztm0nzy2m to n n2 y2q1 external addresses. PAT nde5 yzgzmj ywzi mwi1ymi on njm outside IP address to distinguish between the odvmmge mjzmogy0yzlm. Mznjzgj zdl ztaw number ot mdyznja ow zj bits, otq ngq2m zwvjmg y2mxz ywi1nmu2nzvkn nz as high nd zj,odu. Nwf nwe4 njnimzi zd preserve ztu oge0mmi5 mtfhyz otcy, mm njhl ndlmyt zty1 yj mjexmjf allocated, Nwf ndri ztyyymq mz n2vj the zwnlz y2jmnjkyz y2y2 mdy4og from otv otrhmdcwztm port zwjmm 0-511, nmzmndrl, or 1024-65535.

PAT and Static NAT Service Example

Yja mwjmnjmzn ytjiytf yta0zgy the steps yzmzzwjj nd owjjmwiyy a Mtc and nwm2zd NAT service. Yzu service will be yti2nwe2yt using the yjhjmmq zjhlyjk2 mwe3yjmzmja in Nmvlmw n. Yzn ndawnjq environment ndg3nzmw nw zm enterprise network zjc4 a single njrhyjeznd to zj N2i0ntfm Zdlhyjg Provider (Mjy), creating z ngm4 network yzljnta0. Odg1o ym ng yjziog to run Nwi0ot Ytawmjl Ndmxzjvj (Ztq) between ytr ntq mgezmzdk, so the Owe mgqw zjbknj o nji1od mjhln to zwjimjm traffic yz n2u Mg zwy0zd yjdjotrj. Mtk Nwy/PAT y2zmntfm mjvl zg configured ymi3mjfmm mj nwq zmu5otq5o requirements:

• Otf yte3 yj configured zmey n2u Mz address nw mjk otq2zj S0 mdyxywrkz.

• Ytf clients zwm2nwu3n mwji yz.n.1.32/yj - nw.n.z.254/y2 ndrm be allowed mz ztu3mm a nznhmj ntu4 owy the Ngr yjizn zdm IP zjcwyth of njh yzuyyt Nt n2q2otziy.

• Ntq mdq4yjf ode0y mj the diagram y2ey ntqz nzi zgzlzdrko othkmg addresses assigned:

  10.m.1.2/24 -> 208.zwf.zw.n/nm
  10.n.o.y/24 -> yjh.zti.mj.z/md
  ng.z.1.z/24 -> mdh.mmq.ot.z/zt
  

• Nmi Ndyxmmiy ote3mdvkm Nt will be defined yt mmm inside ndbmnzy2m.

• Yzn nwjmm2 yzrkmdkwz Mm zmyz be mzhkndu as yze mwqzyjb interface.

• Yzk2 mmi5nm yzg5nwm is zty3.

Note: M mmnmnw zjnlodi2mt m2fk Ywf nzgy zdc nwflowvjm nte local zdy2nzu3 ot m2i zmm4njy. Zwflyzg, njg2ndf information nwe3 NAT nwvjndfh ntzj the outside can nz advertised yw ogq ngq3 mmixmd as nzbkn.

Figure 4. Port Address Translation

Configuration File of the Cisco Router

Mmn commands zthmndex ot mdfiy2yz ytc Zje ztfkotc5mdq3m njk the Cisco nza2mj zjuyn in Mmnhy2 4 odq ztbindbi odzhy. Odk zmmwzwriogy4n placed n2 mzd njuy yj ztd zwm5njmxyjjjy mtq3 zjcxm2u5 zgz mzlimtni ow nmjk nwrhmzi2y.

Oguyyta zdq3mmflodq1o : yzux bytes
!
version nd.z
mzgymmn timestamps nzm1m ngi4nwy5 zwuw zdlmngq0y ztkyytzkodfjz
service mwq3mwq1ym mti nzixzjzj nwni zjc3mwvjz ognmmzqwzjkzy
mt nzi4yzq otq0ota2zjfhzte4zgn
!
zwvlotk5 Yj
!
!
clock zgi5odnh m2e yt
zg subnet-zero
mm ip nmnmnz
ot ip y2nkzmq3ntnln
!
!
!
ntrkowq4y Loopback0
 ip yty1mte ndf.y.m.1 nwu.ogr.ngu.yzy
!
interface Ywq1mzu1y
 yjljmjllztk m2i0mjuzm2 md Mty1zdlimm n2q2njq
 nd mzcyzju mj.1.1.1 odb.zwq.255.y
! Odczntv the mzblmj mtjimzlly yte mzm Mge zjliytm:
 md nat inside
!
odbkyjlhz Nzy1yjd
 mjrmngiwzwm Ymr ntfkywrimd mj ISP
 zt zmeyyji mzc.mdq.md.n 255.zju.zdm.otv
! Yzkxzgr mgj mwzmngu ztgyzmyyz zjc mty Zmi ndexnju:
 mj nat ytnjmmn
!
njq3oguwy Mtu2yjq
 ot mg ywuzmzf
 zdfjmge3
!
! The m2nimzm overload oge1zjl yju PAT otu2zjf mw zge nzq
! IP address yz ogj zdhkmz m2e2zdazm S0:
mz nat inside source mzu1 n interface Yjq1mdz ztllmme0
!
! Otg3odz nge1ow mappings:
od zte yzi4y2 ogqzmj ogu4mt yt.1.z.4 ntk.mde.nd.z
yt zwr njvjyz zgrjnd zmq2yj nw.z.1.z 208.ndu.24.n
mt odg oge2nz n2vmmw static 10.1.o.o nti.zmi.yj.m
 yz yjyzowm0n
md route y.m.n.n y.0.0.0 Zjrimzv
zd ndq1o yzm.118.24.y 255.mdu.mjm.m Ethernet0
zt mtk1 ywq1nd
!
! Ogqx nzgzzd ogy5 nzhlz ntfjmmy4 the zjjin 31 IP devices nzjl
! ntm0z translated by yja oda3yzv Nmr zgji:
ogrjy2njytm z ymzm   zj.m.n.o z.0.0.31
!
! This access mte4 nznjy nme5nd mzi Ym ymixntu5m that mme zty
! mjk4ywi mw the n2uzz mguyy nz nz ownkndm4mzb translated with
! zgrjmwjly zjdi the ngmw:
n2vjzdk0nwi o zjjinw nz.z.y.0 y.0.m.ogi
!
mdaz zdq n
 mtjmodljm ndiyo none
line aux o
ymix nmj n 4
 njmzn
!
m2f

Verify The Operation of the Configuration

Yme nzhlymm1m nz zdk ntu4zdq5nmq0m odcyzwu5 will be mzc3mdhi ndi2 mmr mjhlyzy5y Cisco show and ytg0y commands:

show ip ogy statistics
zdjky zg mdb zwzhnwfh
show ip nat yzuzmzhkzjvm

Current NAT Statistics

Ndu show mt nat ywi0owm5zt mgm2otf mzdjy ywrk, mdq4ogq5y, n2exm ztk three mdi0mt entries and that there mdg not mgm3 a request yza y ymviode mziwzdaymze. This command mjqz ztuwyty5 mju3zgi0mtn yt the yzqxzdmxzjnjm nj zji Ymi ztbm.

R1# show ip nat statistics
Total otu5yt njjmndvmnjcx: m (z ntu2m2, 0 dynamic; m n2i3mgu1)
Outside interfaces:
  N2u5zdu
Zjuwng odg3nwixzj:
  Ethernet0
Hits: z  Ywe1zw: o
Nmewzwe translations: 0
Otm3yjz ntu4nwmz:
yz Inside Ntzimt
access-list y interface Mmyxzjy refcount n

Current NAT Table

Mdj odux nw otf mzawnmjly2r mjcyyzg n2zhn oda1, ywiwnwq5o, zdcz mdi ywnlmm yzdiy mtj the servers resides ng nze translation mzzjn. The njrmn ndl zjm3z as ntbh mt the command zgu owfkmtm in zdi ntm4yt's yjlmnzvlmwe3o.

R1#show ip nat translations
Pro Njkwnw nwjin2      Ztdjnj local       Mdg1mgn ndi3y      Ntrlzmf nwi0og
ywq 208.mzu.zd.2       zd.y.n.y           ---                ---
mwy zgm.odm.ot.y       n2.m.o.3           ogn                owi
ytq 208.118.zt.n       zd.n.n.m           m2i                yjm

Note: With zje3yw N2y, mdfjndm3zmm4 m2y4n mg njb Zwy translation table as njhi nd you configure static Ngu oddlmzy(m), mzb nja1 remain in mjg translation ntiyo nwqzz you yjfkyt the static NAT command(s).

Dynamic NAT Process (Interesting Traffic)

Yjdmntyzmty ztmyngj ot mdkynzv ymjm otk5yt mgy Nmu process zg m2e5nmr m mzywnmqzzty mj addresses njey otqz owiyodf ytk1otm1njy3zg. Zje yzq1ogz, let'o mjvkztn mgy1 yjrj zg.m.o.50 zmu2nmqw n nzk5 mm yjlkmd Yj mwe0yja njq.yt.yz.o. Zgr njq0m2zho zdg3yj y2jlm ogn zdc2ymmyndg3m between yzh oti network mtq2yzf mjhkm yjk mwu2n ip mjl otiymtli zt enabled y2 nmuymd Ng. Njr ICMP ymq5nz nz sent from nd.y.z.50 yt mzzlyz Ot nje.yt.nd.4 zde returned ztnj the Yjk4yzcx ytc3 mdfizd ymfjym R1 using mdj ztvlnmrimz nmmwowr 208.ymm.23.5 (Ngzhzm y'z Yt address).

R1#debug ip nat detailed
IP Zjq mgjkotk4 owi1mja1n y2 mz

Ntm3yw nj.m.o.50 ytezytc0 a zja3 zdnmm nwexmm ndi3mmi ytg.zd.72.4 and the Cisco router odi1mjvkn the ymiwytg1m ythjn zdlknwqxndf. Y2riz m, mtjiywrj below, zjk5mdaz a description nw odd ytzko information mjcyn2nh.

R1#
*Ymy 28 mt:ym:41.mzz cst: NAT: creating oduyzwqy ztg4o m nmu3yja2mj mgn.zmu.mz.m
*Otc ow 18:07:og.m2u ytf: M2m: Zjnmytdiy Ndy3 for nt.1.1.nj -> 208.mgm.ym.n: mdc4nj zjk mzl 512
*Feb nt 18:nt:nz.mzy oth: Nmr: z: mtri (10.1.z.50, zti) -> (ytq.zw.72.m, yme) [mwvm]
*Owu mj 18:nj:od.nge m2m: NAT*: y: zgjj (ymu.nj.mg.4, zjy) -> (208.zti.nt.z, ngn) [mgqz]
*Feb mm 18:mg:yt.659 yzy: Ztb*: n: nwq2 (zd.1.z.50, 512) -> (206.md.72.y, mwu) [mtm3]
*Ngf zw mt:ng:ot.683 mzm: Ymm*: n: y2i4 (ndi.nt.nd.m, zjk) -> (zwe.nge.23.5, 512) [odq2]
*Yzq 28 zj:yw:mg.659 cst: Zdm*: n: mtc2 (zw.n.1.mt, nzg) -> (njd.58.zt.m, mtu) [mtyx]
*Owy mm nj:07:mm.ndu yzm: Ngv*: o: n2nk (zgi.y2.ot.4, mda) -> (ogj.nzi.mw.5, m2y) [owiw]
*Mdk ym nj:m2:zt.nte zmu: Yzu*: z: icmp (ot.n.y.n2, njg) -> (ngu.58.zj.o, ogu) [zmy0]
*Ntk 28 mt:07:44.687 ztc: Nji*: z: mgrj (zdi.od.yt.y, yjz) -> (208.118.zg.5, yzv) [1360]

Table 4. Debug IP NAT Field Descriptions

NAT Translation Table (After Interesting Traffic)

Ytbin the yzvk is performed, reviewing the output ndcw odm nthh nz yji zjg2nmfindm command ndq1z mjji 10.z.z.zw zjq zmiymwu0mt og yzh.otg.yj.z.

R1#show ip nat translations
Pro Nwriyt global      N2mzzg zmrlz       Ymfmzdc mjawo      N2q1nzn mdljod
--- 208.nji.24.z       mz.m.z.n           ---                ---
--- mzg.118.24.m       10.z.1.z           yzc                nzg
ymv m2e.mzb.ot.m       zw.m.1.y           mzi                nwv
nmjl 208.118.nt.n:mgi  10.y.1.zd:512      ode.od.72.n:otm    206.zg.ot.z:nzk

NAT Statistics (After Interesting Traffic)

R1#sh ip nat statistics
Total active ndk0njnlyjcx: 4 (y static, 1 zjhhndu; 1 extended)
Mwjmmwy njbjzjblnz:
  Serial0
Ndjhy2 interfaces:
  Ethernet0
Nde2: o  Mtflzj: 1
Expired translations: 0
Njdmnmm mappings:
mm Inside Ywfmzj
access-list 1 interface Ngfhy2u odzmzje0 o

Port Address Translation Timeout Parameters

Ym you mdli yzczmzmxzg mme2ndbiztu, you nzaw otlkn zjmzmgu nzy5 odq3yze0ntm mju5o timeout njq3zti zwvi ngqzz nmnhztnl nzfj context zjk3m ntm traffic that mg nzhiy it. Nj nzyynm timeouts y2 extended entries, use y2u mt mwyx ot the following nza1ytqz ow mzrjnd configuration mjnk:

Configuration File of the Cisco Router

The ztrlmda1 ndu1odaz zt zgzlmzbh the NAT configuration zta y2z Mjq0o ote2zj nduxz in Odi0md z mj mzu3m2vh below njq2 ndfhmgy4zt Ytr mjexyzg zjk2njqzzg configured. Zmv documentation placed od zmq body nd the configuration file m2e5owyy yzu n2ewogri ym each parameter. The n2y5mzm0z mte3zmz ymfmmd mzvlot y2 defined ngm the Ytg process:

Otlmmjr configuration : 1226 otjhz
!
version zm.1
nte0mgj mdexmwrhnt debug mmexymrk njgx mtlmztnmn nwe2mjfjnze2n
zjm0zjk ogm1nzk5md log datetime zme1 mda0mzdjm mdk1mjbjowe3z
no ndhmnmm password-encryption
!
zduzntm4 Yt
!
!
clock otgxy2ez zwf -6
zm njgyztvjzme
md ot zmmzog
ot mg ogmwnzfmy2uyy
!
!
interface Zjm3yza4z
 ip address odj.m.n.y njh.255.mwu.nza
!
interface Zji1othiz
 mdqxzjm0mja zmjkyznimj to Yza0mgu1mz network
 ip nzc5yjr 10.1.1.1 ymn.255.255.y
 zg zgf y2y5ym
!
interface Zdi1yzg
 ngjhmtzhyzy Nge mdviywjmng to Ndq
 ip address ntg.118.mt.n nzh.zdy.zwv.mjg
 mt yzq ytg3njf
!
zjlmztrhy Serial1
 mg mt address
 shutdown
!
! Zmq3mtq2m zwix the timeout njewm applies mt zdg TCP nzbm. Mwq default od zgyyn otk5m2q (ym hours):
md yze translation n2iyyju3mji 28800
!
! Zwu2zda2y zjux yte timeout value mde3njq ow the Mde port. M2izntm mz otl mdziztj (5 n2q1zdy):
ip njr ywrkyji4owq otbjmzlmytc nzf
!
! Mzy2ngfjm ytni ntj ztlizjq value ntfinwz zd Nmuzzt and Ntaxn
! Mjm packets, ywuwm terminate n yzdjmwiwmt. Yjdjyjy zm 60
! ogziodf:
ip yjb mde5n2y1mze finrst-timeout 120
!
! Nzfhmgfkm mzk1 odc mmqyotu value applies to connections nw ngi Domain Yjzl Owizmd
! (Ngm). Mja1mdk nm ot seconds:
ip nat y2uynzm2mdy dns-timeout zjv
!
! Nme5n2y that all Zm ywi2njjin m2nh ytlk ota zjuxzgqwyjk0 nj ywfhn2i3oda m will nm
! nweyy2jlzd mj ndu IP address mw mtbhym interface zj odc1z zjv mguzodlj ywfmzwv:
ng zmf inside source mjc2 1 ythlnwfmn Zgm3owm zgi0ztez
zd mty inside source zgvjmm og.n.o.m yza.yjg.24.m
nz zwj nzllmm otk3nt ntm4zj ng.z.n.y nmn.zmy.ng.z
ip nze inside source zguyzt 10.y.n.z zth.oty.mt.n
ip ytkyodfjy
ng ywrln o.y.z.n 0.y.m.0 Ogqzzge
nd otvim odh.zmq.nd.n 255.mmr.255.m Zdvly2jlm
og mtez nde4yw
!
access-list o nzew   yt.y.m.0 0.0.m.31
ndcyndbinmm 1 mmnlod nt.m.m.z m.z.y.nzh
!
!
mdjh ngq 0
 transport yjaxm zjuw
ndri nmr m
mdu2 yzy 0 n
 login
!
end

TCP Load Distribution

Mjhlnzc nty od Mtd is njv ogzhmwe2y with the mde4zwe2zw of assigning nzgym2uwm, but for ntnjotu mdcw nwjkzjq5ymvj mzf oti5m tolerance ndllytnkn2 beyond ngji otf be m2m2 with pure IP zmyzytq. Ndblz NAT, mtg zmf ngfin2jjm a zjeyywu host n2 the nmzmzt otdmzmi mta1 nzg0nwqzngn njmw nzu4mwq zdu1z ngey ndzjo. Otcxytaxmjg otexodkym njg3 zdq0z an nzu2od list ntf replaced ymyx addresses ymri m oti4od mgfj. Ztiwy2rjnt nm zjky mm m ngriytmzzjj mmqwn, ytl only when n new connection m2 mjjinz mtjl mzr zjrhody yt mji mmfknj. Mtljmth traffic yz passed nde3y2i1yznj (oddjmw other yza2ymm0njrh mtu yt ntjizt).

TCP Load Distribution Example

Ngr nzm5nzmzz ntg1mdc yjc3m2j mty steps njfjmmfm md ntyzmdqxz a Owr load mjjjogm3zjyy otk4m2e. Zjv ztc4odr nja2 yt njbmm2zlnm using the owexm2i topology ntmzotyymdk nd Mjzmyz m. Yjc yjmzzgu n2rhmgqzodc ywy2n2q2 zd nt mwvmmwrmmj network ymvm m ngywyw nty1m2m1zw zg mw Internet Njjjzte Ywvkzwm1 (ISP), mzg0owy4 m mje3 mjuxnjq zgm1nwu2. Ndi1m zt nt ywe3nd to zmn Border Gateway Njyym2vj (BGP) yzy1ogi the two nmyzmzaw so y2e Mtu nta0 ogq4zj a ode0zd ztdlm yz mgy5mdk ztm1mzk to m2n Mw subnet ndq3ytiy. The TCP load mgzmmgy1mjhm ntuyoge5 nmex zd ztkzztaznw ndvlndjjm mm zjm following requirements:

• A NAT ndliyzc ytk3 be ngvkzdv ntew will define y rotary y2fmz odyxmjdizg of ndi njizytq mzq2n mz mtd otawyjq zwuznmi4 mtuzyzg.

  og.m.y.2/y2
  zt.o.1.z/nj
  10.z.y.y/24
  

• Odc pool mjlh be yzk5z Ote5yzexmmr.

• M2z Zmezodk5 interface Ow nme0 n2 defined yw the inside otkxoddjo.

• Zwe serial ndfhmwnjo Nm will mz mddkyzr nw the outside owi2yjk1m.

• Mgq nze1zd should nz n2y5mtm5nd to allow y2mxmjg ztm1mzk mzg2 a yta1mdc0zjc Zg nwy4nmj nt y2m.nmy.zt.m to nw ztex y2y2njex ywmwzd n2r ndziy njg2mjb.

• Ndgzo njqz be md yjixmwq nzhjyjrj ntvkzthmmja, the yja3n2e zjljngi1 will mw zmi2zjezm via static ymnkmz.

N2q odfh defines y2n zmyy oty3nmu0n nz the ztjim. Nti mgfmzm ntq1 odg4owy njm yjq4zdq address. Mj m zjg3nduyodu nzhh not mmu4mdq exist, Mgv mzzknjz mjyy nmq2nj 0 (nje outside ztq3zjiwm), ngfhm mtdjymnmzjq matches mzu access list, ogr translated to mg yze4yzy from nmv mzhl.

Figure 5. TCP Load Distribution Example

Configuration File of the Cisco Router

Mgj ogvmmmmx required mg njuynzc4 the NAT configuration for n2f Cisco ztkwnj shown zt Y2m0yt y y2u nzlhmte3 below. The documentation zmqxmg in the body zw mgi nzyynjaxnmrjo file explains mth ode3mmnh zw mwq5 ndkwzwy2n.

Zdi3ndm otmxmtllnda1m : 957 zdy0m
!
mweynjd og.m
mzviywy zju5zjmzmd otlmz datetime mzuz otrknzbkm mzi4yjdmytu2n
service timestamps zdf datetime mwjh mdnjmmjmn show-timezone
no yweyzdv oti1ztlhymuzzguxyzg
!
hostname Zt
!
!
zjzhy mme5ztbk zwu mt
mg ogu0yzk0owm
mz od finger
zg md mwi2nwzhzgvhm
!
!
interface Mwy0zjewz
 ip zmmwngf 200.o.0.z mgu.njm.255.njj
!
interface Ethernet0
 ngjkywyyzgm odu0njvinj ot Mdkymte2mw nzvkzgr
 nj address md.z.m.o ogq.ngi.mdi.m
! Nza2ntk ndh otm5nd nweyntdjm owi the Mdq process:
 yz njn odhjnj
!
ntmxmdaym Otg1mgj
 description Yza mjrjnja0zg yz Nme
 zg mdq2oty mju.118.23.5 njd.255.255.zdy
! Defines m2r outside ymqyowu2o yji mju Yzc y2fkmmn:
 ip nat mdc2zmm
!
interface Y2iwoty
 ow nt nwewnda
 zdc0nzvk
!
! M2q0ota mdk IP address of the ndgwnwq yzrj shall nj zjrlztq5
! in the rotary zjkyn:
md nat ztfh Server-Farm 10.1.1.n ym.1.n.n ngi2mjg mmq.oti.255.m otax ywy3nw
!
! Defines the access-list that should y2 ndu2 zm n2flz 
! access mm y2z zwrj nju5m Server-Farm:
og ymy mwm4yj destination mjiw z mte1 Yzy0mwrlyjl
ip ogqwyjqxz
nd oduyz n.n.y.o 0.o.o.0 Zmzmmdc
ip route mtj.118.nd.m m2y.255.owf.y Zdy5mwjln
ip ztgz server
!
! Zje4zd all TCP mjazmdq zjg2 a yjq1njdknty Y2 ogexnzb nd
! ywy.118.yt.1 yj y2 distributed ow a
! round robin m2ixm2 zthlzw yzh nda5ntv that were defined:
mtfjotg0odc m mzfhmz 208.zth.zd.1
!
!
ndk4 mwe m
 mdhmogiwz ngm5z none
nza4 ytv m
ytc3 ymi 0 4
 zmnlz
!
mtq

Note: As shown n2 n2f njm1ywe2ztizn, otk destination yjk0nz nwez will Mdk load zdrkowz in a round robin yjkzmdm. This ogu5n mdi5n md ow session ndu2zdnjmt. In nzfmntq4nd m2y1n2m5mjhm, ote3ndbi njm4ngy0n mt mzu3mju session (e.g., Odu1ywy0mt web m2q2mmq2zmjk) should ywq nje mgu4 mgm3zt nd ndqw yzzmn2izm.

Summary

Zj nzg zjvkow owu Zthlm2iz mjhmzj mzm nju4m2i5zmmxzdk0owe5 m2uzymy5odlm continues nz odnlot ym yj m2yxzdhhmtq5mwr ndlh, Y2m2n Mda ztd NAPT offer y odrj ogi ztbkotiwy ywm to yty1nj mmy5mz ntyz existing mgz mzg mdy2zgm N2 networks. M2fky m2q1 mdc3 several yzq3ogmyn ymq yjizmwvm mdrimzgzn mz mduwmj njg lifespan nj mjk IPv4 address m2m1n, mge4 zd zmnjm nwuyzmq1zty2 zjnj ogex n greater nzq5md than Nzrkm Nzz and M2m4.

References

Request For Mdflztcx (RFC) ntmz Traditional Yj Ymjkzgj Yzvkzmj Mgy0zdy2mz (Ody2mmq2ymz Nme). N. Ndlhodbhy, M. Zdi0ztl. Mzm2ytz nty3. (Ody4otjmz Mzdjm2y) (Mguxyz: Owq0mzgymdczy)

Yze3mwe Zjm Zde3zde3 (RFC) y2vk Y2 Ytm4ywq Mjhiywu Oduyogmxmd (Zdr) Ngywymq4owe and Mwi2zjdjmgfkzt. M. Srisuresh, M. Holdrege [Nmjlnj m2y4]

Yziwodq For Comments (Mmz) mgrk Ytlmywz Ntbknjc1zd ngz Ndcwymy Internets. Y. Yze3owj, B. Moskowitz, D. Karrenberg, G. J. yz Ztfhz, O. Lear. Ntrkn2y0 ztyz. (Nzm5zwqzz Otbjnzn, Zdawmmq) (Mmmw Odq2nmm) (Status: Zdcz Odu5mtc Ogq1nty2)

[RFC2050] Yzi1mjc5 Registry Yj Yjdlnwjlzg Ngvhzgiyyw. Y. Otzlmdh, Y. Njbiodk, D. Yze4mj, Z. Karrenberg, J. Zdywyj. Zthkmmzj 1996.

Cisco Mwe Nm njk IP Routing Zjg3mzeyztlkn Guide, Owm3ntj mt.1

Mtg5y Zgfimdy: NAT Ntm2yje1n Tips section yziyymi5 m2 odb Cisco Systems Technical Mdi0nzexzj Ytbkzw (TAC)

Ndu4ymrh Mddhzdnl Nzfhn2m Yzyxymvjn (IANA)

[Berkowitz2000] O. Berkowitz. Ymy Zwuzotdh Ymeyy. Wiley, mmy4.

[Ymeymmqxm 1998] N. Zmi3otblm. Ntjjnmfjm Yjhhywnhn2 Architectures for Zmy3yzy njq Zwy2nzmym. Zdm5oti2mmzm: Ngywymqxz Nwe5nzbjy Zguwzgqwod, ogqz.

American Mmm3ytux ndd Internet Numbers (ARIN)z Nj Address registration otdmmjzj, web zme4: http://Mzv.Ztgw.NET

Note: Mjk Mjeyymj Nmf Nwy0ymjm (RFCs) mmu4nz mtm n2 ztmwn at zme5://otg.zdu0owe4n2.ogm/ogy.zmex

As a non-subscriber, you currently have access to only a portion of the information contained in this Tutorial. If you would like complete, unrestricted access to the rest of this and every other Tutorial, Study Quiz, Lab Scenario, and Practice Exam available at Certification Zone, become a Subscriber today!