Summary of single physical interface NAT

To correctly understand a single physical interface NAT, you must correctly understand the NAT conditions and processing sequence. The following configuration references the content in the jar and expresses thanks to the original author of the referenced content.

1. NAT from inside to outside

1. The inside and outside interfaces are available.
2. The inside interface receives NAT "packets of interest" (defined by ACL)
3. check whether there is a route from the outside interface to the Internet (the routing policy is followed by the conventional routing ).
4. Perform NAT and the source address is converted to NAT.
5. The converted package is forwarded by the outside interface.

2. NAT from outside to inside

1. Whether the NAT table has a corresponding NAT record
2. Execute NAT to convert the destination address
3. Execute routing (first Policy Routing and then regular Routing)
4. The converted package is forwarded through the inside interface.

Iii. Analysis of configuration instance 1:

Features: loopback0 implements the outside Interface

Interface Loopback0
Ip address 172.16.2.254 255.255.255.252
Ip nat outside
!
Interface Ethernet0
Ip address 192.168.0.1 255.255.255.248 sec
Ip address 172.16.1.254 255.255.255.0
Ip nat inside
Ip policy route-map nat
!
Ip nat pool pool1 192.168.0.2 192.168.0.3 prefix-length 29
Ip nat inside source list 10 pool pool1 overload
Ip classless
Ip route 0.0.0.0 0.0.0.0 192.168.0.6
Ip route 172.16.1.0 255.255.255.0 Ethernet0
Access-list 10 permit 172.16.1.0 0.0.255
Access-list 101 permit ip 172.16.1.0 0.0.255 any
Access-list 101 permit ip any 192.168.0.0 0.0.7
!
Route-map nat permit 10
Matches ip address 101
Set interface loopback0

(1) When a package with the source address = 172.16.1.0/24 arrives at the E0 interface:

1. The E0 interface is the inside interface.
2. A packet is a packet of interest to NAT (defined in ACL 10)
3. Check the route. First, execute the policy route nat. There is a set interface loopback0, that is, the route from loopback0 through the outside interface to the Internet. Therefore, the NAT execution conditions are met.
4. Execute NAT. The source = 172.16.1.0/24 is converted to 192.168.0.2 ~ 3 (defined by address pool pool1 ).
5. forward data from loopback0 on the outside interface.
6. loopback0 is the logical loop interface. Therefore, the application ip route 0.0.0.0 0.0.0.0 192.168.0.6 and 192.168.0.6 is the ISP address.
7. The converted package is forwarded to the ISP router through the E0 interface.

(2): return package (Destination Address = 192.168.0.2 ~ 3) when the E0 interface is reached

1. The returned packet is not a packet of interest to NAT, so it is processed according to the regular package.
2. Execute the policy route nat, set interface loopback0, that is, route to the outside interface.
3. NAT has a corresponding NAT record,
4. Execute NAT. the destination address is 192.168.0.2 ~ 3 is converted to 172.16.1.0/24
5. Route execution. There is no policy route on the loopback0 interface, so the general route is executed.
6. The converted package is forwarded through the E0 interface.

4. Configure 2 instances

Features: loopback0 implements the inside interface.

Interface Loopback0
Ip address 172.16.1.1 255.255.255.255.248
Ip nat inside
Ip policy route-map rm_nat
!
Interface FastEthernet0/0
Ip address 172.16.0.1 255.255.255.0 secondary
Ip address 192.168.0.1 255.255.255.252
Ip nat outside
Ip policy route-map no_route
!
Ip nat pool st_pool 61.233.13.193 61.233.13.198 netmask 255.255.255.248
Ip nat inside source list 10 pool st_pool
Ip classless
Ip route 0.0.0.0 0.0.0.0 Loopback0
Access-list 10 permit 172.16.0.0 0.0.255
Access-list 101 permit ip any
Access-list 102 permit ip 172.16.0.0 0.0.255 any
Route-map no_route permit 10
Matches ip address 102
Set interface Loopback0
!
Route-map rm_nat permit 10
Matches ip address 101
Set ip next-hop 192.168.0.2

The main difference between this instance is that two policy routes are used, which are used to make the package arrive at the inside interface or the outside interface and meet the routing conditions for NAT translation.

Note that the address of the NAT address pool does not have to be in the same CIDR block as the ISP router address. It can be a public IP address or a private IP address. Only ISP can differentiate. The ISP must have a route to the NAT address pool (static or dynamic ).

For a NAT router, you only need to run the "ip route 0.0.0.0 0.0.0.0 ISP ip Address" command. Article entry: csh responsible editor: csh