đŸȘ… Configuration Nat Et Pat Cisco Pdf

Lescertifications Cisco. La formation CCNA R&S NetAcad. La certification. Les outils importants. Organisation de l'ouvrage . Les rĂ©seaux commutĂ©s. PrĂ©requis et objectifs. Conception d’un rĂ©seau local. L’environnement commutĂ©. Validation des acquis : questions/rĂ©ponses. Concepts et configuration de base de la commutation. PrĂ©requis et objectifs. Configuration de base d'un
With static NAT, routers or firewalls translate one private IP address to a single public IP address. Each private IP address is mapped to a single public IP address. Static NAT is not often used because it requires one public IP address for each private IP configure static NAT, three steps are required1. configure private/public IP address mapping by using the ip nat inside source static PRIVATE_IP PUBLIC_IP command 2. configure the router’s inside interface using the ip nat inside command 3. configure the router’s outside interface using the ip nat outside commandHere is an A requests a web resource from S1. Computer A uses its private IP address when sending the request to router R1. Router R1 receives the request, changes the private IP address to the public one, and sends the request to S1. S1 responds to R1. R1 receives the response, looks it up in its NAT table, and changes the destination IP address to the private IP address of Computer the example above, we need to configure static NAT. To do that, the following commands are required on R1R1configip nat inside source static R1configinterface fastEthernet 0/0 R1config-ifip nat inside R1config-ifinterface fastEthernet 0/1 R1config-ifip nat outsideUsing the commands above, we have configured a static mapping between Computer A’s private IP address of and the router’s R1 public IP address of To check NAT, you can use the show ip nat translations commandR1show ip nat translations Pro Inside global Inside local Outside local Outside global icmp - - -Download our Free CCNA Study Guide PDF for complete notes on all the CCNA 200-301 exam topics in one recommend the Cisco CCNA Gold Bootcamp as your main CCNA training course. It’s the highest rated Cisco course online with an average rating of from over 30,000 public reviews and is the gold standard in CCNA training NATstatique Sur les interfaces du routeur soit ip nat inside, soit ip nat outside selon la position de l'interface par rapport Ă  Internet dĂ©finir la translation static : ip nat inside source static
Configuring static NAT on Cisco devices With static NAT, routers or firewalls translate one private IP address to a single public IP address. Each private IP address is mapped to a single public IP address. Static NAT is not often used because it requires one public IP address for each private IP address. To configure static NAT on Cisco devices using Network Configuration Manager, you can create the corresponding Configlet commands and push them in multiple devices. If you don't have NCM installed, please click here to download and install the application. To configure static NAT on Cisco devices, following steps are required Configure private/public IP address mapping by using the ip nat inside source static PRIVATE_IP PUBLIC_IP command Configure the router’s inside interface using the ip nat inside command Configure the router’s outside interface using the ip nat outside command Steps to configure static NAT on Cisco devices through CLI Login to the device using SSH / TELNET and go to enable mode. Go into the config mode. Routerconfigure terminal Enter configuration commands, one per line. End with CNTL/Z. Routerconfig Use below command to configure static NAT Routerconfigip nat inside source static Configure the router's inside interface Routerconfiginterface fa0/0 Routerconfig-ifip nat inside Routerconfig-ifexit Configure the router's outside interface Routerconfiginterface fa0/1 Routerconfig-ifip nat outside Routerconfig-ifexit Exit config mode Routerconfigexit Router Execute show ip nat translations command to view the NAT configuration. Copy the running configuration into startup configuration using below command Routerwrite memory Building configuration... [OK] Router The corresponding configlet can be created in NCM application as shown in below screenshot. Also you can click the below button to download the Configlet as XML and import it into NCM application using file import option. Configlet Name Configure Static NAT - Cisco Description This configlet is used to configure static NAT in Cisco devices. Execution Mode Script Execution Mode Configlet Content configure terminal ip nat inside source static $PRIVATE_IP $PUBLIC_IP interface $INSIDE_INTF ip nat inside exit interface $OUTSIDE_INTF ip nat outside exit exit show ip nat translations write memory
Themain configuration tasks for source NAT are as follows: Or download it as PDF: Links. Fir3net: Juniper Netscreen – NAT Explained; Juniper: [ScreenOS] Resolution Guide – ScreenOS – Configure NAT; Featured image “Monreal” by onnola is licensed under CC BY-SA 2.0. SRX NAT with Illustrated Examples. This is an illustrated guide that shows how to configure the Introduction Ce document dĂ©crit comment configurer la traduction d’adresses rĂ©seau NAT, Network Address Translation pour permettre la communication entre un serveur et un client qui sont sur des segments de rĂ©seau diffĂ©rents dans un espace IP en chevauchement. Conditions prĂ©alables Conditions requises Aucune spĂ©cification dĂ©terminĂ©e n'est requise pour ce document. Components Used Ce document n'est pas limitĂ© Ă  des versions de matĂ©riel et de logiciel spĂ©cifiques. The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared default configuration. If your network is live, make sure that you understand the potential impact of any command. Note Ce document s’applique Ă  tous les routeurs et Ă  tous les commutateurs Cisco qui exĂ©cutent le logiciel Cisco IOS. Informations gĂ©nĂ©rales Objectif Permettre la communication entre un serveur et des clients qui sont sur deux segments de rĂ©seau diffĂ©rents dans un espace IP en chevauchement situation survenant gĂ©nĂ©ralement suite Ă  une fusion de rĂ©seaux. Description Deux rĂ©seaux avec le mĂȘme espace IP sont connectĂ©s par l’entremise des routeurs A et B nous utilisons ici un mĂ©canisme de bouclage pour simuler la prĂ©sence du rĂ©seau connectĂ©. Le routeur NAT situĂ© entre les routeurs A et B permet la communication entre les deux espaces IP en chevauchement. Configuration Diagramme du rĂ©seau Flux de trafic Lorsque les clients lancent le trafic vers le IP global du serveur, le trafic atteint le routeur NAT qui l’achemine vers le serveur, mais lorsque le trafic revient au routeur NAT, le routeur ne parvient pas Ă  acheminer le trafic, car le serveur est connectĂ©/connu du cĂŽtĂ© intĂ©rieur de l’interface. Pour rĂ©soudre ce problĂšme, utilisez Mask NAT sur le trafic source provenant de l’extĂ©rieur au moment oĂč il traverse le routeur NAT. Activez la NAT sur les interfaces intĂ©rieure et extĂ©rieure. interface Ethernet0/0description Connection to Serverip address nat insideend!interface Ethernet0/1description Connection to Clientsip address nat outsideend! Configurez la NAT pour qu’elle traduise les adresses intĂ©rieures locales en adresses intĂ©rieures globales. ip nat inside source static extendable Maintenant, configurez les clauses NAT pour qu’elles traduisent les adresses source des clients au moment oĂč elles atteignent l’interface externe de la NAT. ip nat outside source static network /24 Configuration du routage Routage pour le serveur. Notez que la route spĂ©cifique pour le serveur est configurĂ©e pour pointer en direction du rĂ©seau local LAN Ethernet 0/0 ip route Ethernet0/0 Routage pour le rĂ©seau client ip route Ethernet0/1 VĂ©rification Utilisez cette section pour confirmer que votre configuration fonctionne correctement. *Aug 12 1134 NAT* o icmp 10 -> 10 [42] *Aug 12 1134 NAT* o icmp 10 -> 10 [42]*Aug 12 1134 NAT* s= d= [42]*Aug 12 1134 NAT* s= d= [42]*Aug 12 1134 NAT* i icmp 10 -> 10 [42]*Aug 12 1134 NAT* s= d= [42]*Aug 12 1134 NAT* s= d= [42]NAT-Router*Aug 12 1134 NAT* o icmp 10 -> 10 [43]*Aug 12 1134 NAT* s= d= [43]*Aug 12 1134 NAT* s= d= [43]*Aug 12 1134 NAT* i icmp 10 -> 10 [43]*Aug 12 1134 NAT* s= d= [43]*Aug 12 1134 NAT* s= d= [43]NAT-Router Comme mentionnĂ© prĂ©cĂ©demment, lorsqu’un client lance le trafic la NAT extĂ©rieure traduit les adresses externes globales en adresses externes locales et achemine ensuite le trafic vers l’interface intĂ©rieure de la NAT. L’interface interne de la NAT traduit ensuite l’adresse de destination en adresse locale intĂ©rieure et le trafic est acheminĂ© vers le serveur. Le serveur reçoit le trafic avec une adresse source DĂ©pannage Il n'existe actuellement aucune information de dĂ©pannage spĂ©cifique pour cette configuration. Limite Dans cette configuration, seuls les clients peuvent amorcer une connexion et la connexion s’effectuera. Le trafic ne peut pas avoir une origine intĂ©rieure provenant du serveur et la NAT sera en Ă©chec, car il n’y a pas d’enregistrement NAT dans la table de traduction extĂ©rieur local » vers globale ».
ConfigurationGuide: STP Extension in Cisco NX-OS; Static NAT Overview. Static NAT is a one-to-one mapping between an inside local address and an inside global address, without any port numbers being translated. In other words, each private IP address used on the internal devices will get translated into a public IP address when they need to send packets to
Sep 25, 2018 Last Updated Sep 25, 2018 CCNA 200-125 Which technology allows a large number of private IP addresses to be represented by a smaller number of public IP addresses?A. NAT*B. NTPC. RFC 1631D. RFC 1918What is the effect of the overload keyword in a static NAT translation configuration?A. It enables port address translation.*B. It enables the use of a secondary pool of IP addresses when the first pool is It enables the inside interface to receive It enables the outside interface to forward Hide Explanation/ReferenceBy adding the keyword “overload” at the end of a NAT statement, NAT becomes PAT Port Address Translation. This is also a kind of dynamic NAT that maps multiple private IP addresses to a single public IP address many-to-one by using different ports. Static NAT and Dynamic NAT both require a one-to-one mapping from the inside local to the inside global address. By using PAT, you can have thousands of users connect to the Internet using only one real global IP address. PAT is the technology that helps us not run out of public IP address on the Internet. This is the most popular type of two types of NAT addresses are used in a Cisco NAT device? Choose twoA. inside local*B. inside global*C. inside privateD. outside privateE. external globalF. external localShow Hide Explanation/ReferenceNAT use four types of addresses* Inside local address – The IP address assigned to a host on the inside network. The address is usually not an IP address assigned by the Internet Network Information Center InterNIC or service provider. This address is likely to be an RFC 1918 private address.* Inside global address – A legitimate IP address assigned by the InterNIC or service provider that represents one or more inside local IP addresses to the outside world.* Outside local address – The IP address of an outside host as it is known to the hosts on the inside network.* Outside global address – The IP address assigned to a host on the outside network. The owner of the host assigns this is the danger of the “permit any” entry in a NAT access list?A. It can lead to overloaded resources on the router.*B. It can cause too many addresses to be assigned to the same It can disable the overload It prevents the correct translation of IP addresses on the inside type of address is the public IP address of a NAT device?A. outside globalB. outside localC. inside global*D. inside localE. outside publicF. inside publicShow Hide Explanation/ReferenceNAT use four types of addresses* Inside local address – The IP address assigned to a host on the inside network. The address is usually not an IP address assigned by the Internet Network Information Center InterNIC or service provider. This address is likely to be an RFC 1918 private address.* Inside global address – A legitimate IP address assigned by the InterNIC or service provider that represents one or more inside local IP addresses to the outside world.* Outside local address – The IP address of an outside host as it is known to the hosts on the inside network.* Outside global address – The IP address assigned to a host on the outside network. The owner of the host assigns this command can you enter to display the hits counter for NAT traffic?A. show ip nat statistics*B. debug ip natC. show ip debug natD. clear ip nat statisticsShow Hide Explanation/ReferenceAn example of the output of the “show ip nat statistics” is shown below. As we can see, the “Hits” counter is NAT function can map multiple inside addresses to a single outside address?A. PAT*B. SFTPC. RARPD. ARPE. TFTPShow Hide Explanation/ReferenceBy adding the keyword “overload” at the end of a NAT statement, NAT becomes PAT Port Address Translation. This is also a kind of dynamic NAT that maps multiple private IP addresses to a single public IP address many-to-one by using different is the first step in the NAT configuration process?A. Define inside and outside interfaces.*B. Define public and private IP Define IP address Define global and local Hide Explanation/ReferenceIn NAT configuration we should specify the inside and outside interfaces first with the command “ip nat inside” and “ip nat outside” under interface which circumstance should a network administrator implement one-way NAT?A. when the network must route UDP trafficB. when traffic that originates outside the network must be routed to internal hosts *C. when traffic that originates inside the network must be routed to internal hostsD. when the network has few public IP addresses and many private IP addresses require outside accessWhich statement about the inside interface configuration in a NAT deployment is true?A. It is defined globallyB. It identifies the location of source addresses for outgoing packets to be translated using access or route maps.*C. It must be configured if static NAT is usedD. It identifies the public IP address that traffic will use to reach the Hide Explanation/ReferenceWhen we specify a NAT “inside” interface via the “ip nat inside” command under interface mode, we are specifying the source IP addresses. Later in the “ip nat” command under global configuration mode, we will specify the access or route map for these source example the commandRouterconfig ip nat inside source list 1 pool PoolforNATafter the keyword “source” we need to specify one of the three keywords+ list specify access list describing local addresses but this command does not require an “inside” interface to be configured+ route-map specify route-map+ static specify static local -> global mappingWhich NAT type is used to translate a single inside address to a single outside address?A. dynamic NATB. NAT overloadC. PATD. static NAT*Show Hide Explanation/ReferenceThere are two types of NAT translation dynamic and NAT Designed to allow one-to-one mapping between local and global addresses. This flavor requires you to have one real Internet IP address for every host on your networkDynamic NAT Designed to map an unregistered IP address to a registered IP address from a pool of registered IP addresses. You don’t have to statically configure your router to map an inside to an outside address as in static NAT, but you do have to have enough real IP addresses for everyone who wants to send packets through the Internet. With dynamic NAT, you can configure the NAT router with more IP addresses in the inside local address list than in the inside global address pool. When being defined in the inside global address pool, the router allocates registered public IP addresses from the pool until all are allocated. If all the public IP addresses are already allocated, the router discards the packet that requires a public IP this question we only want to translate a single inside address to a single outside address so static NAT should be are two benefits of using NAT? choose twoA. NAT protects network security because private networks are not advertised.*B. NAT accelerates the routing process because no modifications are made on the Dynamic NAT facilitates connections from the outside of the NAT facilitates end-to-end communication when IPsec is NAT eliminates the need to re-address all host that require external access.*F. NAT conserves addresses through host MAC-level Hide Explanation/ReferenceBy not reveal the internal IP addresses, NAT adds some security to the inside network -> A is has to modify the source IP addresses in the packets -> B is not from the outside to a network through “NAT” is more difficult than a normal network because IP addresses of inside hosts are hidden -> C is not order for IPsec to work with NAT we need to allow additional protocols, including Internet Key Exchange IKE, Encapsulating Security Payload ESP and Authentication Header AH -> more complex -> D is not allocating specific public IP addresses to inside hosts, NAT eliminates the need to re-address the inside hosts -> E is does conserve addresses but not through host MAC-level multiplexing. It conserves addresses by allowing many private IP addresses to use the same public IP address to go to the Internet -> F is not command can you enter to create a NAT pool of 6 addresses?A. Routerconfigip nat pool test prefix-length 24*B. Routerconfigip nat pool test prefix-length 16C. Routerconfigip nat pool test prefix-length 8D. Routerconfigip nat pool test prefix-length 8Show Hide Explanation/ReferenceThe syntax to create a NAT pool isRouterconfigip nat pool pool_name start_ip end_ip { netmask netmask prefix-length prefix-length }Therefore answer A is surely correct. Answer B is not correct as it creates many addresses from to then to C and D are not correct as we cannot use prefix-length of 8 /8 for a class B does NAT overloading provide one-to-many address translation?A. It uses a pool of addressesB. It converts IPV4 addresses to unused IPv6 AddressesC. It assigns a unique TCP/UDP port to each session*D. It uses virtual MAC Address and Virtual IP AddressesShow Hide Explanation/ReferenceBy adding the keyword “overload” at the end of a NAT statement, NAT becomes PAT Port Address Translation. This is also a kind of dynamic NAT that maps multiple private IP addresses to a single public IP address many-to-one by using different is the danger of the permit any entry in a NAT access list?A. It can lead to overloaded resources on the router.*B. It can cause too many addresses to be assigned to the same It can disable the overload It prevents the correct translation of IP addresses on the inside Hide Explanation/ReferenceUsing permit any can result in NAT consuming too many router resources, which can cause network problems. You should only limit the NAT access list to a specific range of IP configuration can be used with PAT to allow multiple inside address to be translated to a single outside address?A. Dynamic RoutingB. DNSC. PreemptD. Overload*
CiscoASA – Configuration du NAT. Le NAT est l’un des points clĂ©s de la configuration d’un ASA Cisco. Sa configuration n’est pas particuliĂšrement difficile, du Recevez mes articles gratuitement par EmailIl suffit d'entrer votre emailVous pouvez vous inscrire Ă  notre newsletter ci-dessous pour obtenir des mises Ă  jour rĂ©guliĂšres sur nos nouvels articles et formations. Vous mĂ»rissez la curiositĂ© de savoir c’est quoi un DHCP, comment faire la configuration d’un serveur DHCP sous Cisco Packet Tracer ? Restez zen ! Dans cet article, nous allons dĂ©finir le protocole DHCP et rĂ©aliser une petite architecture rĂ©seau pour la configuration de ce service dans Cisco Packet Tracer. Le DHCP est un protocole qui attribue des adresses IP automatiquement aux machines connectĂ©es sur le rĂ©seau. En gros, c’est une sorte de distributeur automatique d’adresses IP. Tu veux une adresse IP et bien il faut en demander une au serveur DHCP. Il te la donne. Pour rappel, une adresse IP est un numĂ©ro unique permettant d’identifier une machine sur un rĂ©seau TCP/IP. Vous conviendrez avec moi que IP veut dire Internet Protocol, n’est ce pas ? Ce qui veut dire qu’on peut avoir des adresses statiques ou dynamiques sur nos machines. Voyons la difference. Les adresses IP dynamiques sont attribuĂ©es par le DHCP alors que les adresses IP fixes sont attribuĂ©es de façon manuelle par l’administrateur rĂ©seaux. Recevez mes articles gratuitement par EmailIl suffit d'entrer votre emailVous pouvez vous inscrire Ă  notre newsletter ci-dessous pour obtenir des mises Ă  jour rĂ©guliĂšres sur nos nouvels articles et formations. GrĂące au numĂ©ro d’identification qu’on appelle adresse IP nous pouvons communiquer avec les autres machines sur le rĂ©seau. Cette adresse doit ĂȘtre unique pour chaque machine afin d’éviter d’envoyer des messages Ă  la mauvaise personne. Le DHCP dans sa fonction dĂ©livre des informations dont le bail dhcp qui est une durĂ©e de temps pour laquelle les informations seront allouĂ©es pour la machine. Ce qui veut dire que l’adresse IP attribuĂ©e par le DHCP a une durĂ©e limitĂ©e. Le DHCP fournit aussi d’autres paramĂštres rĂ©seau comme le masque de sous rĂ©seau, l’adresse IP de la passerelle, une route qui va permettre aux serveurs de communiquer avec une machine se situant hors du rĂ©seau. Un routeur peut assurer le service dhcp ou un serveur dans votre entreprise. Ceci va vous permettre de centraliser la gestion de la configuration rĂ©seau surtout qu’il y aura beaucoup de machines au sein de l’entreprise. J’espĂšre que nous sommes sur la mĂȘme longueur d’onde. Maintenant 
 Revenons sur notre cas pratique Ce n’est pas Ă©vident de comprendre l’architecture physique ou logique d’un rĂ©seau informatique sans rĂ©aliser un tant soit peu des activitĂ©s sur le terrain. Croyez moi je sais de quoi je parle. J’ai pu participer Ă  beaucoup de chantiers pour une installation complĂšte d’un rĂ©seau cĂąblĂ©. C’est fastidieux ! Tout de mĂȘme on peut crĂ©er une petite architecture sur notre simulateur Cisco. Vous savez, les sociĂ©tĂ©s comme Cisco Systems ont mis en place des logiciels de simulation trĂšs efficaces. C’est le cas de Cisco Packet Tracer que nous allons aborder dans cet article. Cisco Packet Tracer Cisco Packet Tracer est un logiciel de simulation rĂ©seau puissant permettant de mettre en place plusieurs Ă©quipements informatiques routeurs, switch, hubs, pc
. Avec toutes ses fonctionnalitĂ©s, vous pouvez crĂ©er un rĂ©seau, relier plusieurs machines via des cĂąbles virtuels. ———————————————————————————————— DĂ©couvrez la mĂ©thode pour gagner de l’Argent avec le ———————————————————————————————— Vous pouvez rĂ©aliser la configuration de vos routeurs, vos commutateurs Ă  travers les services comme le DNS, le DHCP et d’autres protocoles utiles dans un rĂ©seau d’entreprise. Pourquoi utiliser le DHCP Je crois que l’explication si haut est claire. Prenons un rĂ©seau comportant 500 hĂŽtes dans une entreprise. On vous demande de le faire avec ces 500 machines, une par une. Vous imaginez le casse-tĂȘte ! Vous allez y passer toute la journĂ©e voire des semaines. Now pour solutionner le problĂšme, on fait appel au protocole DHCP. Comme je l’avais dĂ©fini sur mon article Windows Server 2016, le DHCP signifie – Dynamics Host Configuration Protocol – c’est un protocole trĂšs utile dans cette situation. On ne peut s’en passer. —————————————————————————————————— Je partage beaucoup d’astuces sur ma page Facebook —————————————————————————————————— Architecture de notre rĂ©seau DHCP Pour dĂ©buter notre projet, tĂ©lĂ©chargez et installez le logiciel. Perso, j’utilise la version au moment d’écrire ces lignes. Commençons par mettre en place les diffĂ©rents Ă©quipements et interconnectons-les tranquillement. On va mettre en place 1 serveur, 1 switch et plusieurs machines dans notre architecture. Dans un premier temps, interconnectons-les Ă  travers un cĂąble droit le noir ou automatique l’orange. Configuration du serveur DHCP Sans plus tarder, passons Ă  la configuration de notre serveur. Cliquez sur le serveur et allez sur le menu Desktop. Maintenant vous pouvez cliquer sur IP Configuration puis pensez Ă  fixer une adresse IP de façon statique. Avec la touche tabulation, remplissez le ’default Gateway’’ et ’Dns Server’’ si besoin il y est. Fixer l’adresse IP du serveur sous Cisco Packet Tracer Sur le mĂȘme menu, cliquez sur config ou Services selon la version de votre logiciel. Automatiquement vous allez voir un menu vertical global contenant l’ensemble des services disponibles DHCP, DNS, HTTP, EMAIL
 en ce qui nous concerne, cliquez sur DHCP pour le configurer. Plus important, activez le service On pour que le rĂ©seau soit actif. Vous pouvez alors remplir le ’default Gateway’’ et ’Dns Server’’ de la mĂȘme maniĂšre que prĂ©cĂ©demment. Ensuite dans Start IP adress mettez-y la premiĂšre adresse que votre machine aura dans la plage. Je vous suggĂšre d’espacer au moins de 10. Si par exemple, vous avez pris une adresse pour le serveur. Terminez le dernier octet de la premiĂšre machine par 20, histoire de laisser la place Ă  d’autres Ă©quipements en cas de panne. Sur la partie Maximum numbers, mettez la quantitĂ© de machines que vous voulez connecter. NB A rappeler qu’une adresse de classe C aura pour nombre de pĂ©riphĂ©riques 254. Enfin, cliquez sur Save. Votre serveur DHCP vient d’ĂȘtre configurĂ© et toutes les machines pourront avoir automatiquement des adresses IP. Il suffit d’activer pour le DHCP. Cliquez sur chaque PC et allez dans desktop puis IP configuration, puis activez DHCP. Vos machines obtiendront automatiquement leur adresse IP. Ce qui est essentiel dans votre rĂ©seau, c’est qu’en cas de panne, vous avez la possibilitĂ© de mettre d’autres serveurs, augmentez le nombre de machines qui auront automatiquement leur adresse IP. Activation du DHCP cisco packet tracer Votre rĂ©seau a-t-il fonctionnĂ© ? Vous pouvez maintenant passer Ă  la simulation. Retrouvez moi sur Facebook, Twitter ou Whatsapp oĂč je partage d’autres astuces. Vous pouvez faire un don pour me soutenir. Merci d’avance ! Articles similaires Formation Cisco notions de base sur les rĂ©seauxFormez vous en langage PythonComment rĂ©cupĂ©rer des fichiers sur le rĂ©seau en ligne de commandeConfigurer le DHCP sous Windows Server 2016Technologie IPv6 connaissances de baseComment gagner de l’argent sur internet CrĂ©er un blog simple et pro avec son smartphone NATOverload (PAT) : transforme diffĂ©rents IP (local) par celui du Routeur (configuration la plus courante) CISCO Rh1(config) int fa0/1 interface externe Rh1(config-if) ip nat outside Rh1(config) int fa0/0 interface interne Rh1(config-if) ip nat inside CrĂ©ation d\'une ACL pour les IP qui pourront accĂ©der aux NAT In ASA software version Cisco completely restructured ASA NAT syntax. Quite a bit has already been written about these changes. However, since this is often a cause of confusion, I will try to provide an explanation of three of the most commonly used forms of NAT on an ASA dynamic PAT, static NAT, and “NONAT”. What is NAT? NAT stands for Network Address Translation. It enables private IP networks that use unregistered IP addresses to connect to the Internet. NAT operates on a router, usually connecting two networks together, and translates the private not globally unique addresses in the internal network into legal addresses, before packets are forwarded to another network. As part of this capability, NAT can be configured to advertise only one address for the entire network to the outside world. This provides additional security by effectively hiding the entire internal network behind that address. NAT offers the dual functions of security and address conservation and is typically implemented in remote-access environments. How does NAT work? Basically, NAT allows a single device, such as a router, to act as an agent between the Internet or public network and a local network or private network, which means that only a single unique IP address is required to represent an entire group of computers to anything outside their network. Real IP the actual IP address of the device generating the traffic Mapped IP the IP address the Router/Firewall translates the real IP address to NAT is most often used to translate private RFC 1918 IP addresses to publicly routable IP addresses. NAT types – There are 3 types of NAT Static NAT – In this, a single private IP address is mapped with single Public IP address, a private IP address is translated to a public IP address. It is used in Web hosting. Dynamic NAT – In this type of NAT, multiple private IP address are mapped to a pool of public IP address. It is used when we know the number of fixed users wants to access the Internet at a given point of time. Port Address Translation PAT – This is also known as NAT overload. In this, many local private IP addresses can be translated to single public IP address. Port numbers are used to distinguish the traffic, which traffic belongs to which IP address. This is most frequently used as it is cost effective as thousands of users can be connected to the Internet by using only one real global public IP address. NAT Uses in ASA 1. Static NAT – one to one Static NAT translates a single real IP to a single mapped IP. This is commonly used to NAT a device on the inside or DMZ of an ASA to a static IP on the subnet of the outside interface. Configuration asa01 config static inside,outside netmask Configuration object network inside-host host nat inside,outside static Both of the above say the following Traffic that is received on the inside interface from translate to on the outside interface, and vice versa. In and earlier, the syntax is static inside,outside [outside ip] [inside ip] netmask [netmask]. I find this syntax to be counter intuitive, because it reads inside,outside and then outside inside. I am not aware of any logical reason for this. I find syntax to be easier to read, however it does dramatically increase the number of lines per NAT statement. As with the PAT example above, if you look at the show run output you will see the object listed twice – once to define the host and once to define the static NAT. Therefore, what took a single line in now takes four lines in and above. Both configuration examples so far have used network object NAT. Object NAT is easy to use, but somewhat limited and only takes into account the source address. If we need more control over our NAT statements, we can use twice NAT, which I will cover in greater detail in a future post. 2. Dynamic PAT – many-to-one PAT stands for port address translation. It is many to one NAT translation. This is what some vendors simply refer to as NAT. It is more accurately called PAT because in order to translate many IPs to one IP, randomly selected ephermal ports must be used on the mapped IP address. When return traffic is received, the ASA must check the xlate table NAT translation table in order to determine where to send the return traffic. Here is the xlate table from the example ping above asa01 sh xlate 1 in use, 1 most used Flags D – DNS, i – dynamic, r – portmap, s – static, I – identity, T – twice ICMP PAT from inside to outside flags ri idle 00009 timeout 00030 asa01 Configuration asa01config nat inside 1 asa01config global outside 1 interface INFO outside interface address added to PAT pool asa01config This configuration says Translate any traffic received on the inside interface from NAT ID 1 to the corresponding global PAT pool. In this case, nat inside 1 corresponds to global outside 1, so anything from is translated to the outside interface IP. Return traffic will be translated back to the real IP address by checking the xlate table for the appropriate translation. You could also use an IP address or range of IP addresses in place of the word “interface” in the global statement. If you were to use a range of IP addresses in the global statement, you would have a many-to-many dynamic NAT instead of many-to-one dynamic PAT. Configuration asa01config object network inside-network asa01config-network-object subnet asa01config-network-object nat inside,outside dynamic interface asa01config-network-object This configuration says Define a network object for subnet Any traffic received on the inside interface that matches this network object, translate to the outside interface IP address. Return traffic will be translated back to the real IP address by checking the xlate table for the appropriate translation. Show run output asa01 sh run object object network inside-network subnet asa01 sh run nat ! object network inside-network nat inside,outside dynamic interface Notice when we configure object NAT in we configure both the subnet and the NAT under the same network object. However, they appear separately in the show run output. As with config, we can also specify a specific IP or range of IPs for the translation. 3. No-nat NAT exemption & identity NAT There are certain circumstances when traffic is being translated on an ASA, but we do not want this traffic to be translated when destined to specific subnets. The most common example is VPN traffic. We want the source address of the VPN traffic to have the real IP, not the mapped IP, for obvious reasons. Configuration access-list nonat extended permit ip nat inside 0 access-list nonat In ASA and earlier, this is called NAT exemption. This says define an extended access list in this case nonat and specify the appropriate source and destination traffic. Any traffic received on the inside interface that matches this access list, use NAT ID 0. NAT ID 0 exempts the traffic from being translated. Configuration asa01config object network inside-network asa01config-network-object subnet asa01config object network remote-network asa01config-network-object subnet asa01config nat inside,outside source static inside-network inside-network destination static remote-network remote-network In ASA and above, NAT exemption no longer exists. This can now only be accomplished by using identity NAT. Identity NAT is a form of twice NAT, which allows us to specify both source and destination in our NAT statements. In the above configuration example, we define two network objects inside-network and remote-network. We then configure an identity NAT statement that tells the ASA not to NAT the traffic. The structure of the identity NAT statement is as follows nat real_interface,mapped_interface source static real_object mapped_object destination static mapped_object real_object So the example above says Any traffic received on the inside interface from inside-network destined to remote-network translate to the source to inside-network and the destination to remote-network ie. don’t NAT it. This is clearly less intuitive than the syntax, but it’s not that bad once you get used to it. Useful Links Note Ensure that the routers and switches have been erased and have no startup configurations. If you are unsure contact your instructor. Required Resources ‱ 2 Routers (Cisco 4221 with Cisco IOS XE Release 16.9.4 universal image or comparable) ‱ 2 Switches (Cisco 2960 with Cisco IOS Release 15.2(2) lanbasek9 image or comparable)

Résumé des fonctionnalités de cette configurationLe routeur joue le role d'un concentrateur VPN en IPsec fonctionnalites IOS 3DES obligatoiresLe routeur fait aussi du NAT du PAT en réalité entre son interface LAN adressage en IP privé et Internet adressage en IP publiqueLes clients IPSec récupÚrent une adresse IP par le routeur, dans un subnet IP différent de celui du LANLe client IPSec utilisé sur les postes de travail est un client VPN CiscoTableau des variables utiliséesDans l'exemple suivant, l'interface "Ethernet 0" est celle connectée au LAN, et l'interface "Ethernet 1" est celle connectée à Internet.!username LOGIN-USER1 password PASSWORD-USER1!aaa new-modelaaa authentication login userauthen localaaa authorization network groupauthor local!crypto isakmp policy 3 encr 3des authentication pre-share group 2!crypto isakmp client configuration group NAME-VPN key PASSWORD-VPN dns IP-DNS-LAN wins IP-WINS-LAN domain DOMAIN-NAME pool Pool-For-Vpn-Client acl SPLIT-TUNNEL netmask ipsec transform-set myset esp-3des esp-sha-hmac!crypto dynamic-map dynmap 10 set transform-set myset!crypto map clientmap client authentication list userauthencrypto map clientmap isakmp authorization list groupauthorcrypto map clientmap client configuration address initiatecrypto map clientmap client configuration address respondcrypto map clientmap 10 ipsec-isakmp dynamic dynmap!interface Ethernet0 ip address IP-LAN ip nat inside no shut!interface Ethernet1 ip address IP-INTERNET MASK-INTERNET crypto map clientmap ip nat outside no shut!ip local pool Pool-For-Vpn-Client VPN-FIRST VPN-LASTip route IP-GW-INTERNET!ip nat inside source route-map NoNat interface Ethernet1 overload!!ip access-list extended No-Nat-Vpn-Client deny ip IP-NET-LAN NET-VPN permit ip IP-NET-LAN anyip access-list extended SPLIT-TUNNEL permit ip IP-NET-LAN NET-VPN NoNat permit 10 match ip address No-Nat-Vpn-Client!end

Programmede cette formation Firewall ASA : ‱ Introduction : Technologies et caractĂ©ristiques des firewalls. - PrĂ©sentation des firewalls. - Terminologie. - FonctionnalitĂ©s des Firewalls. - Exemples d'architecture. - La gamme ASA. DĂ©marrage avec un ASA.

Static NAT Network Address Translation - Static NAT Network Address Translation is one-to-one mapping of a private IP address to a public IP address. Static NAT Network Address Translation is useful when a network device inside a private network needs to be accessible from internet. Dynamic NAT Network Address Translation - Dynamic NAT can be defined as mapping of a private IP address to a public IP address from a group of public IP addresses called as NAT pool. Dynamic NAT establishes a one-to-one mapping between a private IP address to a public IP address. Here the public IP address is taken from the pool of IP addresses configured on the end NAT router. The public to private mapping may vary based on the available public IP address in NAT pool. PAT Port Address Translation - Port Address Translation PAT is another type of dynamic NAT which can map multiple private IP addresses to a single public IP address by using a technology known as Port Address Translation. Here when a client from inside network communicate to a host in the internet, the router changes the source port TCP or UDP number with another port number. These port mappings are kept in a table. When the router receive from internet, it will refer the table which keep the port mappings and forward the data packet to the original sender.

NATOutside NAT Boundary Configuration Static Source Translation Dynamic Source Translation! Create an access list to match inside local addresses access-list 10 permit 0.0.255.255 !! Create NAT pool of inside global addresses ip nat pool MyPool 192.0.2.1 192.0.2.254 prefix-length 24!! Combine them with a translation rule ip nat inside source list 10 SommaireI. PrĂ©sentationII. Configuration des deux interfacesIII. Activation du mode routeurIV. Activation du NATV. Automatiser le montage des rĂšgles iptables I. PrĂ©sentation Nous allons dans ce tutoriel apprendre Ă  mettre un en place un routeur sous Linux. Les distributions sous Linux sont trĂšs polyvalentes et cela permet entre autre de les transformer en vĂ©ritables routeurs. Il faut bien sur pour cela que notre machine Linux dispose d'au moins deux interfaces rĂ©seaux car la premiĂšre fonction d'un routeur et de faire la passerelle gateway entre un rĂ©seau et un autre qui ne pourraient communiquer sans. II. Configuration des deux interfaces Nous allons commencer par configurer nos deux interfaces avec des IP fixes. Un routeur est un Ă©lĂ©ment central d'un rĂ©seau et toutes les machines de ce rĂ©seau s'y rĂ©fĂšrent pour leurs requĂȘtes. Il est donc obligatoire que notre routeur ai une IP fixe sur chacune de ces interfaces. Nous travaillerons ici sur l'interface "eth0" qui sera orientĂ©e vers le rĂ©seau simulant une rĂ©seau externe "WAN" en et une seconde interface "eth1" qui sera vers notre "LAN" en AprĂ©s vous ĂȘtre assurĂ© que votre machine dispose bien de deux interfaces, il faut se rendre dans le fichier "/etc/network/interfaces" pour configurer nos interfaces rĂ©seaux Nous ne mettons pas de passerelle Ă  l'interface LAN car ce sera notre routeur la passerelle de ce rĂ©seau. En revanche pour le rĂ©seau WAN en " il dispose d'une gateway passerelle en " vers lequel notre routeur relaira les requĂȘtes lorsqu'il ne saura y rĂ©pondre. Nous pourrons ensuite redĂ©marrer notre service rĂ©seau pour que les changements soient pris en comptes /etc/ restart On pourra, pour finir, vĂ©rifier la bonne configuration de nos interfaces avec la commande suivante ifconfig III. Activation du mode routeur Par dĂ©faut, une machine Linux ne fait pas passer n'importe quel paquet comme doit le faire un routeur. On doit donc activer cette fonctionnalitĂ© qui est sous la forme d'un option dans le fichier "/etc/ on devra y chercher la ligne suivante afin de la dĂ©-commenter Cette option active donc le forwarding le "relayage" des paquets d'une interface Ă  une autre ou plus prĂ©cisĂ©ment d'un rĂ©seau Ă  un autre. On pourra ensuite reloader notre sysctl sysctl -p /etc/ IV. Activation du NAT Dans la plupart des cas, notre routeur fera du NAT sur notre rĂ©seau LAN. Pour rĂ©sumer, le NAT permet de protĂ©ger le rĂ©seau LAN en le cachant aux autres rĂ©seaux qui sont considĂ©rĂ©s comme "extĂ©rieurs" donc potentiellement dangereux . Toutes les requĂȘtes faites par le LAN et sortant par notre routeur auront l'air pour les autres rĂ©seaux de provenir de notre routeur en tant que machine simple. Cela permet de ne pas montrer aux autres rĂ©seaux que tout un rĂ©seau se cache derriĂšre. Le NAT permet aussi de simplifier les tĂąche de routage car il Ă©vite dans beaucoup de cas d'avoir Ă  manipuler des tables de routage. Pour mettre en place le NAT, on rappel que notre interface eth0 est notre interface extĂ©rieur "WAN" en Le NAT se met en sortie de cette interface WAN. Nous devons passer la commande suivante iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE Note Faites bien attention aux majuscules/ minuscules ! Nous disons donc que, une fois que le routeur saura quelle route donner Ă  notre requĂȘte, il fera un masquerade il changera la source du paquet pour la remplacer par lui mĂȘme quand ces requĂȘtes sortiront de l'interface eth0 pour aller vers des rĂ©seaux extĂ©rieurs. Nous pourrons vĂ©rifier notre iptables en faisant la commande suivante iptables -L -t nat "-L" sert Ă  lister les rĂšgles Iptables "-t nat" sert Ă  prĂ©ciser la table NAT qui n'est pas prise en compte par dĂ©faut V. Automatiser le montage des rĂšgles iptables Nous allons maintenant automatiser le montage de nos rĂšgles Ă  l'activation de notre interface eth0. A chaque fois que notre interface sera rĂ©activĂ©, les rĂšgles Iptables se rĂ©-appliquerons par la mĂȘme occasion. Pour faire cela, on commence par enregistrer nos rĂšgles Iptables dans un fichier au choix ici "/etc/ avec la commande prĂ©vue Ă  cet effet iptables-save > /etc/ On se rend ensuite Ă  nouveau dans notre fichier de configuration rĂ©seau "/etc/network/interfaces" et on ajoute cette ligne Ă  la fin de la configuration de notre interface eth0 post-up iptables-restore < /etc/ On utilise la commande "iptables-restore" qui est faite pour appliquer des rĂšgles iptables provenant d'un fichier fait avec la commande "iptables-save" aprĂšs le montage de l'interface "post-up". Pour vĂ©rifier que le montage automatique de nos rĂšgles fonctionne correctement. Nous pouvons voir avec la commande suivante que notre rĂšgles est prĂ©sente iptables -L -t nat "-L" sert Ă  lister les rĂšgles IPtables basiques "-t nat" sert Ă  afficher les rĂšgles de la table nat qui ne sont pas affichĂ©es par dĂ©faut Nous aurons alors cette rĂ©ponse Nous voyons bien sur la chaine "POSTROUTING" de notre table "nat" que le MASQUERADE est prĂ©sent vers tous les rĂ©seaux. DĂ©s lors, nous allons supprimer nos rĂšgles avec la commande iptables -F -t nat "-F" sert Ă  effacer les rĂšgles de bases "-t nat" sert Ă  nouveau Ă  prĂ©ciser la table NAT qui n'est pas prise en compte par dĂ©faut On pourra alors refaire un affichage de rĂšgles pour constater que notre rĂšgle de a disparue Enfin, on rechargera nos interfaces rĂ©seaux avec la commande suivante /etc/ restart Puis on affichera notre table "nat" un derniĂšre fois pour constater que notre rĂšgle est revenue. Notre routeur Linux est fin prĂȘt, nous pouvons maintenant connecter des clients Ă  notre interface eth1, mettre comme passerelle Ă  ces clients l'IP eth1 de notre routeur et ceux-ci aurons accĂšs aux autres rĂ©seaux !
\n \nconfiguration nat et pat cisco pdf
StaticNAT (Network Address Translation) is useful when a network device inside a private network needs to be accessible from internet. Dynamic NAT (Network Address Translation) - Dynamic NAT can be defined as mapping of a private IP address to a public IP address from a group of public IP addresses called as NAT pool. Dynamic NAT establishes a
Network Address Translation NAT replaces IP addresses within a packet with different IP addresses. NAT is very useful in these instances Conserving IP address space. Implementing TCP load distribution. Connecting networks with overlapping addresses. During network migration, which involves the renumbering of nodes. Connecting a private network using an unregistered address to a public network like the Internet. Distributing other Transmission Control Protocol TCP and User Datagram Protocol UDP based router configured for NAT maintains a translation table that has the mapping between the addresses used in the translation. Configuring NAT involves identifying the NAT inside and NAT outside interfaces, then configuring the way the addresses are to be translated, depending on the requirement. A router configured with NAT translates only traffic that is forwarded between the inside and outside interfaces, and the flow that matches the criteria specified for translation. Traffic that does not meet these conditions is forwarded without any translation. To configure the inside and outside interfaces, issue the ip nat inside and ip nat outside commands under the respective interfaces. A static NAT configuration creates a one-to-one mapping and translates a specific address to another address. This type of configuration creates a permanent entry in the NAT table, as long as the configuration is present and is useful when users on both inside and outside networks need to initiate a connection. To configure static NAT, issue the ip nat inside source static or ip nat outside source static commands in global configuration mode, depending on where the host is located. Static NAT can also be used to redirect traffic using a particular port to a different port on a host. This is helpful when the users belonging to the inside network use a particular port number to access a particular application like a web server available on the inside or outside network. The same application is accessed by users from the outside network using a different port number. To redirect traffic to a different port, issue the ip nat inside source {static {tcpudp local-ip local-port global-ip global-port} [extendable] or ip nat outside source {static tcpudp global-ip global-port local-ip local-port} [extendable] commands in global configuration mode, depending on whether the inside or outside network is available. Another type of configuration is dynamic NAT, which is useful when a limited number of addresses is available instead of the actual number of hosts to be translated. The addresses used for translation are configured by issuing the ip nat pool command in global configuration mode. The hosts to be translated are specified by issuing the access-list command or match statements in the route-map command. The pool and the list of hosts to be translated are linked together by issuing the ip nat inside source list name pool name command or the ip nat inside source route-map name pool name command in global configuration mode. The command can be issued for an outside network by replacing the keyword "inside" with "outside". Dynamic NAT creates an entry in the NAT table, when the host initiates a connection and establishes a one-to-one mapping between the addresses. But the mapping could vary depending on the address available in the pool at the time of communication. Dynamic NAT allows sessions to be initiated from inside or outside networks for which it is configured. Dynamic NAT entries are removed from the translation table if the host does not communicate for a specific period of time, which is configurable, and the address is returned to the pool for use by another host. Another form of dynamic translation is overloading or Port Address Translation PAT, which allows many hosts to be mapped to a single address at the same time. When PAT is configured, the router makes use of the source port numbers to distinguish the sessions from different hosts. PAT creates an extended translation entry in the NAT table by including the protocol as well as the port information. PAT is configured by adding the overload option to the dynamic NAT configuration command, which binds the hosts and the pool. Static and dynamic NAT can be configured simultaneously when it is required. This occurs in cases where many addresses are not available for translation, and certain devices must be statically configured for NAT at the same time. For more information on configuring NAT refer to these documents NAT Local and Global Definitions Configuring Static and Dynamic NAT Simultaneously Configuring Network Address Translation Getting Started View more Cisco How-To Tutorials Search 54,082 current Cisco Job openings worldwide! Join the Network World communities on Facebook and LinkedIn to comment on topics that are top of mind. Brad Reese is research manager at advancing the careers of 600,000-plus certified individuals in the growing Cisco Career Certification Program. Copyright © 2008 IDG Communications, Inc. BothNAT44 (static, dynamic, and PAT) configuration and stateful NAT46 configurations are not supported on the same interface. High-speed Logging (HSL) is not supported. Several IPv4 stateful features (PBR, ZBFW, WAAS, WCCP, NBAR, and so on) do not work after converting to IPv6 packets, and are not supported. CONFIGURATION DE BASE D’UN ROUTEUR Configuration de base du routeur Configuration des interfaces du routeur Enregistrer les modifications apportĂ©es Ă  un routeur VĂ©rifier des informations renvoyĂ©es par les commandes show Configurer une interface Ethernet Configurer une interface SĂ©rie VĂ©rifier les informations de routage Surveiller et dĂ©panner son rĂ©seau avec CDP Utiliser les interfaces de bouclages ROUTAGE STATIQUE Configurer les routes statiques Configurer une interface de sortie pour une route statique Modifier une route statique Configurer une route statique sur un rĂ©seau Ethernet pour qu’elle n’ait pas Ă  utiliser la recherche rĂ©cursive de l’adresse IP de tronçon suivant Modifier une route statique CrĂ©er une route statique par dĂ©faut ROUTAGE DYNAMIQUE RIP V1 Activer / dĂ©sactiver le protocole RIP SpĂ©cifier des rĂ©seaux DĂ©pannage protocole RIP EmpĂȘcher la transmissions des mises Ă  jours RIP sur une interface prĂ©cise ROUTAGE DYNAMIQUE RIP V2 Activer / dĂ©sactiver le protocole RIP V2 Activer / dĂ©sactiver le protocole le rĂ©sumĂ© automatique dans RIP V2 Commande de vĂ©rification de RIP V2 ROUTAGE DYNAMIQUE EIGRP Mise en place EIGRP ParamĂ©trage du rĂ©seau VĂ©rifier le protocole EIGRP Modifier les mesures composites de EIGRP Modifier la valeur de la bande passante vĂ©rifier tous les chemins possibles vers un rĂ©seau DĂ©sactive le rĂ©sumĂ© automatique Configurer le rĂ©sumĂ© manuel Mettre en place route par dĂ©faut Configurer les intervalles Hello et les temps d’attente ROUTAGE DYNAMIQUE OSPF Mise en place OSPF ParamĂ©trage du rĂ©seau Nouvelle carte bouclage Router-ID VĂ©rifier le protocole ospf Adapter la bande passante OSPF Modifier le coĂ»t de liaison ContrĂŽler le choix du routeur dĂ©signĂ© et de secours DĂ©signer la route par dĂ©faut Configurer les intervalles Hello et DEAD Livre complet sur la configuration du routeur Cisco CONFIGURATION DE BASE D’UN ROUTEUR Configuration de base du routeur Router>enable permet de passer en mode d’exĂ©cution privilĂ©giĂ©. Routerconfig t Passez en mode de configuration globale. Routerconfighostname R1 Appliquez un nom d’hĂŽte unique au routeur. Routerconfigenable secret fafamdp Configurez un mot de passe Ă  utiliser pour passer en mode d’exĂ©cution privilĂ©giĂ©, ici fafamdp. Configuration les lignes de console et telnet pour se connecter au routeur R1configline console 0 R1config-linepassword cisco R1config-linelogin R1config-lineexit R1configline vty 0 4 R1config-linepassword cisco R1config-linelogin R1config-lineexit Configuration d’une banniĂšre de connexion R1configbanner motd Enter TEXT message. End with the character ’. ****************************************** WARNING!! Unauthorized Access Prohibited!! ****************************************** Configuration des interfaces du routeur R1config t Passez en mode de configuration globale. R1configinterface Serial0/0 passez au mode de configuration d’interface en indiquant le type et le numĂ©ro d’interface. R1config-ifip address Configurez l’adresse IP et le masque de sous-rĂ©seau. R1config-ifdescription CiruitVBN32696-123 help desk1-800-555-1234 donner une descritpion de l’interface. Enregistrer les modifications apportĂ©es Ă  un routeur R1copy running-config startup-config Enregistrer les modifications . VĂ©rifier des informations renvoyĂ©es par les commandes show R1show running-config Cette commande affiche la configuration en cours stockĂ©e dans la mĂ©moire vive. R1show ip route Cette commande affiche la table de routage actuellement utilisĂ©e par l’IOS pour choisir le meilleur chemin Ă  emprunter afin d’atteindre les rĂ©seaux de destination. R1show ip interface brief Cette commande affiche des informations sommaires sur la configuration d’interface, notamment l’adresse IP et l’état de l’interface. R1show interfaces Cette commande affiche tous les paramĂštres et toutes les statistiques de configuration d’interface. Configurer une interface Ethernet R1configinterface fastethernet 0/0 R1config-ifip address R1config-ifno shutdown Configurer une interface SĂ©rie R1configinterface serial 0/0/0 SĂ©lection de l’interface de sĂ©rie R1config-ifclock rate 64000 Une fois le cĂąble connectĂ©, l’horloge peut alors ĂȘtre paramĂ©trĂ©e Ă  l’aide de la commande clock rate. Les frĂ©quences d’horloge disponibles, en bits par seconde, sont 1 200, 2 400, 9 600, 19 200, 38 400, 56 000, 64 000, 72 000, 125 000, 148 000, 500 000, 800 000, 1 000 000, 1 300 000, 2 000 000 et 4 000 000. R1config-ifip address ParamĂ©trage rĂ©seau de l’interface. R1config-ifno shutdown Activer l’interface. R1show interfaces serial 0/0/0 VĂ©rifier la configuration de l’interface sĂ©rie VĂ©rifier les informations de routage R1show ip route Cette commande affiche la table de routage actuellement utilisĂ©e par l’IOS pour choisir le meilleur chemin Ă  emprunter afin d’atteindre les rĂ©seaux de destination. R1show ip interface brief Cette commande affiche des informations sommaires sur la configuration d’interface, notamment l’adresse IP et l’état de l’interface. Surveiller et dĂ©panner son rĂ©seau avec CDP Le protocole CDP fournit les informations suivantes concernant chaque pĂ©riphĂ©rique CDP voisin Identificateurs de pĂ©riphĂ©riques par exemple, le nom d’hĂŽte configurĂ© d’un commutateur. Liste d’adresses jusqu’à une adresse de couche rĂ©seau pour chaque protocole pris en charge. Identificateur de port le nom du port local et distant sous la forme d’une chaĂźne de caractĂšres ASCII, comme ethernet0. Liste de capacitĂ©s par exemple, pour savoir si ce pĂ©riphĂ©rique est un routeur ou un commutateur. Plateforme la plateforme matĂ©rielle du pĂ©riphĂ©rique, par exemple, un routeur Cisco sĂ©rie 7200. Les commandes possibles R1show cdp neighbors Donne des informations sur les voisins CDP comme l’ID du pĂ©riphĂ©rique voisin, l’Interface locale, la Valeur du dĂ©lai de conservation en secondes, le Code de capacitĂ© du pĂ©riphĂ©rique voisin, la Plateforme matĂ©rielle voisine et l’ID du port distant voisin R1show cdp neighbors detail rĂ©vĂšle l’adresse IP d’un pĂ©riphĂ©rique voisin et permet de dĂ©terminer si l’un des voisins CDP prĂ©sente une erreur de configuration IP R1configno cdp run dĂ©sactive le protocole CDP R1config-ifno cdp enable Si vous souhaitez utiliser le protocole CDP, mais que vous devez arrĂȘter les annonces CDP sur une interface prĂ©cise. Utiliser les interfaces de bouclages Routerconfiginterface loopback 0 SĂ©lection de l’interface de bouclage Routerconfig-ifip address ROUTAGE STATIQUE Configurer les routes statiques R1debug ip routing Pour que l’IOS affiche un message lorsque la nouvelle route est ajoutĂ©e Ă  la table de routage. R1conf t Passez en mode de configuration globale. R1configip route Analysons de plus prĂšs ip route – Commande de route statique – Adresse rĂ©seau de rĂ©seau distant – Masque de sous-rĂ©seau de rĂ©seau distant – Adresse IP d’interface Serial 0/0/0 sur le routeur Configurer une interface de sortie pour une route statique R1conf t Passez en mode de configuration globale. R1configip route serial 0/0/0/ Configure cette route statique pour utiliser une interface de sortie au lieu d’une adresse IP de tronçon suivant. Modifier une route statique R1conf t Passez en mode de configuration globale. R1configip route CrĂ©ation d’une route statique R1config-ifno ip route Annulation de la route statique crĂ©e prĂ©cedemment R1config-ifip route serial 0/0/0 RecrĂ©ation d’une route statique Configurer une route statique sur un rĂ©seau Ethernet pour qu’elle n’ait pas Ă  utiliser la recherche rĂ©cursive de l’adresse IP de tronçon suivant R1conf t Passez en mode de configuration globale. R1configip route fastethernet 0/1 Configurer la route statique pour inclure Ă  la fois l’interface de sortie et l’adresse IP de tronçon suivant. Modifier une route statique R1conf t Passez en mode de configuration globale. R1configip route CrĂ©ation d’une route statique R1config-ifno ip route Annulation de la route statique crĂ©e prĂ©cedemment R1config-ifip route serial 0/0/0 RecrĂ©ation d’une route statique CrĂ©er une route statique par dĂ©faut R1conf t Passez en mode de configuration globale. R1configip route serial 0/0/0 Tous les paquets iront par dĂ©faut vers l’interface serial 0/0/0 ROUTAGE DYNAMIQUE RIP V1 Activer / dĂ©sactiver le protocole RIP R1conf t Passez en mode de configuration globale. R1configrouter rip Cette commande ne lance pas automatiquement le processus RIP. Elle fournit un accĂšs permettant de configurer les paramĂštres du protocole de routage. Aucune mise Ă  jour de routage n’est envoyĂ©e. R1configno router rip Cette commande arrĂȘte le processus RIP et efface toutes les configurations RIP existantes. SpĂ©cifier des rĂ©seaux R3conf t Passez en mode de configuration globale. R3configrouter rip Active RIP R3config-routernetwork La commande network est configurĂ©e sur les routeurs pour les rĂ©seaux directement connectĂ©s. R3config-routernetwork La commande network est configurĂ©e sur les routeurs pour les rĂ©seaux directement connectĂ©s. R3show running-config VĂ©rifie la configuration. DĂ©pannage protocole RIP R3show ip route La commande show ip route vĂ©rifie que les routes reçues par les voisins RIP sont installĂ©es dans une table de routage. Les routes RIP sont indiquĂ©es dans la sortie par la lettre R. R3show ip protocols Celle-ci affiche le protocole de routage actuellement configurĂ© sur le routeur. Ces donnĂ©es peuvent ĂȘtre utilisĂ©es pour vĂ©rifier la plupart des paramĂštres RIP. R3debug ip rip permet d’identifier les problĂšmes qui affectent les mises Ă  jour RIP. Cette commande affiche les mises Ă  jour du routage RIP lors de leur envoi et de leur rĂ©ception. EmpĂȘcher la transmissions des mises Ă  jours RIP sur une interface prĂ©cise Routerconfig-routerpassive-interface interface-type interface-number Exemple ci-dessous R3configrouter rip Active RIP R3config-router passive-interface fastethernet 0/0 Cette commande arrĂȘte les mises Ă  jour de routage via l’interface spĂ©cifiĂ©e ici fastethernet 0/0. Toutefois, le rĂ©seau auquel appartient l’interface spĂ©cifiĂ©e continuera d’ĂȘtre annoncĂ© dans les mises Ă  jour de routage envoyĂ©es via d’autres interfaces. ROUTAGE DYNAMIQUE RIP V2 Activer / dĂ©sactiver le protocole RIP V2 R1conf t Passez en mode de configuration globale. R1configrouter rip Cette commande ne lance pas automatiquement le processus RIP. Elle fournit un accĂšs permettant de configurer les paramĂštres du protocole de routage. Aucune mise Ă  jour de routage n’est envoyĂ©e. R1configversion 2 Permet de modifier RIP afin d’utiliser la version 2. Cette commande doit ĂȘtre configurĂ©e sur tous les routeurs du domaine de routage. R1configversion RĂ©tablir RIP 1 R1configno router rip Cette commande arrĂȘte le processus RIP et efface toutes les configurations RIP existantes. Activer / dĂ©sactiver le protocole le rĂ©sumĂ© automatique dans RIP V2 R1conf t Passez en mode de configuration globale. R1configrouter rip Cette commande ne lance pas automatiquement le processus RIP. Elle fournit un accĂšs permettant de configurer les paramĂštres du protocole de routage. Aucune mise Ă  jour de routage n’est envoyĂ©e. R1configno auto-summary Cette commande n’est pas disponible dans RIPv1. Une fois le rĂ©sumĂ© automatique dĂ©sactivĂ©, RIPv2 ne rĂ©sume plus les rĂ©seaux dans leur adresse par classe au niveau des routeurs de pĂ©riphĂ©rie. R1show ip protocols Permet de vĂ©rifier si le rĂ©sumĂ© de rĂ©seau automatique n’est pas actif ».. Commande de vĂ©rification de RIP V2 R1show ip route Il s’agit de la premiĂšre commande Ă  utiliser pour vĂ©rifier la convergence de rĂ©seau. Lors de l’étude de la table de routage, il est important de vĂ©rifier si la table de routage contient les routes qui doivent y figurer . R1show ip interface brief Une interface hors service ou mal configurĂ©e est souvent la cause de l’absence d’un rĂ©seau dans la table de routage. La commande show ip interface brief vĂ©rifie rapidement l’état de toutes les interfaces. R1show ip protocols La commande show ip protocols vĂ©rifie plusieurs Ă©lĂ©ments critiques, notamment l’activation de RIP, sa version, l’état du rĂ©sumĂ© automatique et les rĂ©seaux inclus dans les instructions rĂ©seau. R1debug ip rip TrĂšs utile pour examiner le contenu des mises Ă  jour de routage envoyĂ©es et reçues par un routeur. R1ping La commande ping permet de vĂ©rifier facilement la connectivitĂ© de transmission. R1show running-config La commande show running-config peut ĂȘtre utilisĂ©e pour vĂ©rifier toutes les commandes actuellement configurĂ©es. ROUTAGE DYNAMIQUE EIGRP Mise en place EIGRP R1conf t Passez en mode de configuration globale. R1configrouter eigrp systĂšme-autonome Le paramĂštre de systĂšme autonome est un nombre choisi entre 1 et 65 535 choisi par l’administrateur rĂ©seau. Ce nombre est le numĂ©ro d’ID de processus, et il est important car tous les routeurs situĂ©s sur ce domaine de routage EIGRP doivent utiliser le mĂȘme numĂ©ro d’ID de processus numĂ©ro de systĂšme-autonome. Exemple R1configrouter eigrp 1 Faire la mĂȘme configuration sur tout les routeurs ParamĂ©trage du rĂ©seau R1conf t Passez en mode de configuration globale. R1configrouter eigrp 1 Faire la mĂȘme configuration sur tout les routeurs R1config-routernetwork Toute interface sur ce routeur qui correspond Ă  l’adresse rĂ©seau ici dans la commande network est activĂ©e pour envoyer et recevoir des mises Ă  jour EIGRP. Ce rĂ©seau ou sous-rĂ©seau sera inclus dans les mises Ă  jour de routage EIGRP. R1config-routernetwork Pour configurer EIGRP afin d’annoncer des sous-rĂ©seaux spĂ©cifiques uniquement dans ce cas reprĂ©sente le contraire de c’est donc le contraire du masque de sous rĂ©seau qu’il faut indiquer. VĂ©rifier le protocole EIGRP R1show ip eigrp neighbors pour visualiser la table de voisinage et vĂ©rifier que EIGRP a Ă©tabli une contiguĂŻtĂ© avec ses voisins. Pour chaque routeur, vous devez voir l’adresse IP du routeur contigu et l’interface que ce dernier utilise pour joindre le voisin EIGRP. R1show ip protocols Affiche les diffĂ©rents types de sorties spĂ©cifiques Ă  chaque protocole de routage. Modifier les mesures composites de EIGRP Explication EIGRP utilise les valeurs suivantes dans sa mesure composite pour calculer le chemin prĂ©fĂ©rĂ© vers un rĂ©seau Bande passante – DĂ©lai – FiabilitĂ© – Charge Routerconfig-routermetric weights tos k1 k2 k3 k4 k5 Explication ci-dessous de la commande – La valeur tos Type of Service – Type de service est un vestige d’IGRP et n’a jamais Ă©tĂ© mise en Ɠuvre. – K1 = Bande passante – K2 = Charge – K3 = DĂ©lai – K4 et K5 = FiabilitĂ© Modifier la valeur de la bande passante R1conf t Passez en mode de configuration globale. R1configinterface s 0/0/0 SĂ©lection de l’interface Ă  modifier R1config-ifbandwitch 1024 La bande passante de la liaison entre R1 et l’autre routeur est de 1 024 Kbits/s, bien sur l’autre routeur devra ĂȘtre paramĂ©trer de la mĂȘme façon. R1config-ifip bandwidth-percent eigrp 1 50 Par dĂ©faut, EIGRP n’utilise que jusqu’à 50 % de la bande passante d’une interface pour les donnĂ©es EIGRP. Cela permet au processus EIGRP de ne pas surcharger une liaison en ne laissant pas suffisamment de bande passante pour le routage du trafic normal. La commande ip bandwidth-percent eigrp peut ĂȘtre utilisĂ©e pour configurer le pourcentage de bande passante pouvant ĂȘtre utilisĂ© par le protocole EIGRP sur une interface. R1config-ifno bandwitch Pour restaurer la valeur par dĂ©faut. vĂ©rifier tous les chemins possibles vers un rĂ©seau R1show ip eigrp topology all-links montre tous les chemins possibles vers un rĂ©seau, notamment les successeurs, les successeurs potentiels et mĂȘme les routes qui ne sont pas des successeurs potentiels. DĂ©sactive le rĂ©sumĂ© automatique R1conf t Passez en mode de configuration globale. R1configrouter eigrp 1 Active EIGRP R1config-routerno auto-summary DĂ©sactive le rĂ©sumĂ© automatique Configurer le rĂ©sumĂ© manuel R1conf t Passez en mode de configuration globale. R1configinterface serial 0/0/0 SĂ©lection des interfaces qui transmet des paquets EIGRP R1config-ifip summary-address eigrp 1 Configure le rĂ©sumĂ© du routage sur toutes les interfaces qui transmettent des paquets EIGRP, donc il faut le faire sur chaque interface utilisĂ©. Mettre en place route par dĂ©faut R1conf t Passez en mode de configuration globale. R1configip route votre_interface_de_sortie Tout les paquets utiliserons par dĂ©faut l’interface de sortie que vous configurerez R1configrouter eigrp 1 Active EIGRP R1config-routerredistribute static EIGRP nĂ©cessite l’utilisation de la commande redistribute static pour inclure cette route statique par dĂ©faut dans les mises Ă  jour de routage EIGRP. La commande redistribute static demande Ă  EIGRP d’inclure cette route statique dans les mises Ă  jour EIGRP vers les autres routeurs. Configurer les intervalles Hello et les temps d’attente R1conf t Passez en mode de configuration globale. R1configinterface serial 0/0/0 SĂ©lection des interfaces qui transmet des paquets EIGRP. R1config-ifip hello-interval eigrp 1 60 Modifie l’interval Hello, ici 60 secondes R1config-ifip hold-time eigrp 1 180 Si vous modifiez l’intervalle Hello, assurez-vous que vous modifiez Ă©galement le temps d’attente en lui attribuant une valeur supĂ©rieure ou Ă©gale Ă  celle de l’intervalle Hello. Ici 180 secondes. ROUTAGE DYNAMIQUE OSPF Mise en place OSPF R1conf t Passez en mode de configuration globale. R1configrouter ospf process-id Le paramĂštre process-id est un nombre choisi entre 1 et 65 535 choisi par l’administrateur rĂ©seau. Ce nombre est le numĂ©ro d’ID de processus, et il est important car tous les routeurs situĂ©s sur ce domaine de routage EIGRP doivent utiliser le mĂȘme numĂ©ro d’ID de processus numĂ©ro de systĂšme-autonome. Exemple R1configrouter ospf 1 Faire la mĂȘme configuration sur tout les routeurs ParamĂ©trage du rĂ©seau R1conf t Passez en mode de configuration globale. R1configrouter ospf 1 Faire la mĂȘme configuration sur tout les routeurs R1config-routernetwork area 0 Pour configurer OSPF afin d’annoncer des sous-rĂ©seaux spĂ©cifiques uniquement dans ce cas reprĂ©sente le contraire de c’est donc le contraire du masque de sous rĂ©seau qu’il faut indiquer. Area 0 fait rĂ©fĂ©rence Ă  la zone OSPF. Une zone OSPF est un groupe de routeurs qui partagent les informations d’état des liaisons. Tous les routeurs OSPF de la mĂȘme zone doivent avoir les mĂȘmes informations. Nouvelle carte bouclage Router-ID R1conf t Passez en mode de configuration globale. R1configrouter ospf 1 Activer OSPF R1config-routerrouter-id La commande OSPF router-id a Ă©tĂ© ajoutĂ©e Ă  IOS dans la version ; elle remplace les adresses de bouclage et les adresses IP d’interface physique pour la dĂ©termination des ID de routeur. VĂ©rifier le protocole ospf R1show ip ospf neighbors pour visualiser la table de voisinage et vĂ©rifier que OSPF a Ă©tabli une contiguĂŻtĂ© avec ses voisins. Pour chaque routeur, vous devez voir l’adresse IP du routeur contigu et l’interface que ce dernier utilise pour joindre le voisin OSPF. R1show ip protocols Affiche les diffĂ©rents types de sorties spĂ©cifiques Ă  chaque protocole de routage. R1show ip ospf La commande show ip ospf peut Ă©galement ĂȘtre utilisĂ©e pour examiner l’ID de routeur et l’ID de processus OSPF. En outre, cette commande affiche les informations de zone OSPF, ainsi que la derniĂšre fois oĂč l’algorithme SPF a Ă©tĂ© calculĂ©. R1show ip ospf interface La mĂ©thode la plus rapide pour vĂ©rifier les intervalles Hello et Dead est d’utiliser la commande show ip ospf interface. Adapter la bande passante OSPF R1conf t Passez en mode de configuration globale. R1configinterface s 0/0/0 SĂ©lection de l’interface Ă  modifier R1config-ifauto-cost reference-bandwidth Permet Ă  la bande passante de rĂ©fĂ©rence d’ĂȘtre modifiĂ©e pour s’adapter aux rĂ©seaux ayant des liaisons d’une rapiditĂ© supĂ©rieure Ă  100 000 000 bits/s 100 Mbits/s Bande passante pour liaisons plus rapide R1config-routerauto-cost reference-bandwidth 10000 a bande passante de rĂ©fĂ©rence peut ĂȘtre modifiĂ©e pour prendre en compte ces liaisons plus rapides, grĂące Ă  la commande OSPF auto-cost reference-bandwidth. Lorsque cette commande est nĂ©cessaire, utilisez-la sur tous les routeurs afin que la mesure de routage OSPF reste cohĂ©rente. Modifier le coĂ»t de liaison R1conf t Passez en mode de configuration globale. R1configinterface s 0/0/0 SĂ©lection de l’interface Ă  modifier R1config-ifbandwitch 1024 La bande passante de la liaison entre R1 et l’autre routeur est de 1 024 Kbits/s, bien sur l’autre routeur devra ĂȘtre paramĂ©trer de la mĂȘme façon. Autre mĂ©thode R1configinterface serial 0/0/0 SĂ©lectionnez votre interface. R1config-ifip ospf cost 1562 Il existe une mĂ©thode alternative Ă  l’utilisation de la commande bandwidth, utiliser la commande ip ospf cost, qui vous permet de spĂ©cifier directement le coĂ»t d’une interface. Avec bandwitch il aurait fallu indiquer 64 pour avoir cette valeur, vous pouvez vĂ©rifier avec show ip ospf interface ContrĂŽler le choix du routeur dĂ©signĂ© et de secours R1conf t Passez en mode de configuration globale. R1configinterface fastethernet 0/0 SĂ©lection de l’interface Ă  modifier R1config-ifip ospf priority 200 La valeur de prioritĂ© par dĂ©faut Ă©tait de 1 pour toutes les interfaces de routeur. C’était donc l’ID de routeur qui dĂ©terminait le DR et le BDR. Mais si vous remplacez la valeur par dĂ©faut, 1, par une valeur plus Ă©levĂ©e, le routeur dont la prioritĂ© est la plus Ă©levĂ©e devient le DR, et celui qui a la seconde prioritĂ© devient le BDR DĂ©signer la route par dĂ©faut R1conf t Passez en mode de configuration globale. R1configinterface fastethernet 0/0 SĂ©lection de l’interface Ă  modifier R1configip route votre_interface_de_sortie Tout les paquets utiliserons par dĂ©faut l’interface de sortie que vous configurerez R1config-routerdefault-information originate Comme RIP, OSPF nĂ©cessite la commande default-information originate pour annoncer la route statique par dĂ©faut aux autres routeurs de la zone. Si la commande default-information originate n’est pas utilisĂ©e, la route par dĂ©faut quatre zĂ©ros » ne sera pas diffusĂ©e aux autres routeurs de la zone OSPF. Configurer les intervalles Hello et DEAD R1conf t Passez en mode de configuration globale. R1configinterface serial 0/0/0 SĂ©lection des interfaces qui transmet des paquets EIGRP. R1config-ifip ospf hello-interval 5 Modifie l’interval Hello, ici 60 secondes. Le fait de modifier de façon explicite le minuteur est une saine pratique, plutĂŽt que de compter sur une fonction automatique d’IOS. R1config-ifip ospf dead-interval 20 AprĂšs 20 secondes, le compte Ă  rebours du minuteur Dead de R1 se termine. La contiguĂŻtĂ© entre R1 et R2 est perdue. Youhave configured NAT pool NAT-POOL while activity requires R2POOL. Use correct pool name to complete activity. Use correct pool name to complete activity. The lesson is: in data networking you follow instructions, use jazz improvisation when performing arts.

Routershow ip nat translations Displays the translation table Routershow ip nat statistics Displays NAT statistics Routerclear ip nat translations inside outside Clears a specific translation from the table before it times out Routerclear ip nat translations* Clears the entire translation table before entries time out Troubleshooting NAT and PAT Configurations Routerdebug ip nat Displays information about every packet that is translated. Be careful with this command. The router's CPU might not be able to handle this amount of output and might therefore hang the system. Routerdebug ip nat detailed Displays greater detail about packets being translated. Figure 23-1 shows the network topology for the PAT configuration that follows using the commands covered in this chapter. Figure 23-3 Port Address Translation Configuration ISP Router router>enable Moves to privileged mode. routerconfigure terminal Moves to global configuration mode. routerconfighost ISP Sets the host name. ISPconfigno ip domain-lookup Turns off Domain Name System DNS resolution to avoid wait time due to DNS lookup of spelling errors. ISPconfigenable secret cisco Sets the encrypted password to cisco. ISPconfigline console 0 Moves to line console mode. ISPconfig-linelogin User must log in to be able to access the console port. ISPconfig-linepassword class Sets the console line password to class. ISPconfig-linelogging synchronous Commands will be appended to a new line. ISPconfig-lineexit Returns to global configuration mode. Figure 23-3 Port Address Translation ConfigurationNetwork Network Network Network IP NAT IP NAT Inside Outside ISPconfiginterface serial 0/0/1 Moves to interface configuration mode. ISPconfig-ifip address Assigns an IP address and netmask. ISPconfig-ifclock rate 56000 Assigns the clock rate to the DCE cable on this side of the link. ISPconfig-ifno shutdown Enables the interface. ISPconfig-ifinterface loopback 0 Creates loopback interface 0 and moves to interface configuration mode. ISPconfig-ifip address Assigns an IP address and netmask. ISPconfig-ifexit Returns to global configuration mode. ISPconfigexit Returns to privileged mode. ISPcopy running-config startup-config Saves the configuration to NVRAM. Company Router nouten>enable Moves to privileged mode. routerconfigure terminal Moves to global configuration mode. routerconfighost Company Sets the host name. Companyconfigno ip domain-lookup Turns off DNS resolution to avoid wait time due to DNS lookup of spelling errors. Companyconfigenable secret cisco Sets the secret password to cisco. Companyconfigline console 0 Moves to line console mode. Companyconfig-linelogin User must log in to be able to access the console port. Companyconfig-linepassword class Sets the console line password to class. Companyconfig-linelogging synchronous Commands will be appended to a new line. Companyconfig-lineexit Returns to global configuration mode. Companyconfiginterface fastethernet 0/0 Moves to interface configuration mode. Companyconfig-ifip address Assigns an IP address and netmask. Companyconfig-ifno shutdown Enables the interface. Companyconfig-ifinterface serial 0/0/0 Moves to interface configuration mode. Companyconfig-ifip address Assigns an IP address and netmask. Companyconfig-ifno shutdown Enables the interface. Companyconfig-ifexit Returns to global configuration mode. Companyconfigip route Sends all packets not defined in the routing table to the ISP router. Companyconfigaccess-list 1 permit Defines which addresses are permitted through; these addresses are those that will be allowed to be translated with NAT. Companyconfigip nat inside source list 1 interface serial 0/0/0 overload Creates NAT by combining list 1 with the interface serial 0/0/0. Overloading will take place. Companyconfiginterface fastethernet 0/0 Moves to interface configuration mode. Companyconfig-ifip nat inside Location of private inside addresses. Companyconfig-ifinterface serial 0/0/0 Moves to interface configuration mode. Companyconfig-ifip nat outside Location of public outside addresses. Companyconfig-if[email protected] Returns to privileged mode. Companycopy running-config startup-config Saves the configuration to NVRAM. This chapter provides information and commands concerning the following topics ‱ Configuring DHCP ‱ Verifying and troubleshooting DHCP configuration ‱ Configuring a DHCP helper address ‱ DHCP client on a Cisco IOS Software Ethernet interface ‱ Configuration example DHCP Continue reading here Configuration Example DHCP Was this article helpful?

Withdynamic NAT, you need to specify two sets of addresses on your Cisco router: the inside addresses that will be translated. a pool of global addresses. To configure dynamic NAT, the following steps are required: 1. configure the router’s inside interface using the ip nat inside command. 2. configure the router’s outside interface using
You are here Home / Cisco Routers / Configuring NAT on Cisco Routers Step-by-Step PAT, Static NAT, Port Redirection The depletion of the public IPv4 address space has forced the internet community to think about alternative ways of addressing networked hosts. Network Address Translation NAT therefore was introduced to overcome these addressing problems that occurred with the rapid expansion of the Internet. Even if NAT was suggested as a temporary solution, it has been adopted by all network hardware manufacturers, and it is considered a very useful technology, not only for IP address conservation, but also for many other purposes including security. Basically NAT allows a single network device a router, firewall etc to act as an agent between a private local area network and a public network such as the Internet. The purpose of this NAT device is to translate the source IP addresses of the internal network hosts into public routable IP addresses in order to communicate with the Internet. Some of the advantages of using NAT in IP networks are the following NAT helps to mitigate the depletion of the global public IP address space Networks can now use the RFC 1918 private address space internally and still have a way to access the Internet using NAT. NAT increases security by hiding the internal network topology and addressing scheme. Cisco IOS routers support different types of NAT as will be explained below. NAT has many forms and can work in several ways, but in this post I will explain the most important types of NAT. For the next 2 scenarios we will be using the following simple network 1. Overloading or Port Address Translation PAT This is the most frequently used form of NAT in IP networks. It uses the concept of “many-to-one” translation where multiple connections from different internal hosts are “multiplexed” into a single registered public IP address using different source port numbers. This type of NAT allows a maximum of 65,536 internal connections to be translated into a single public IP. This type of NAT is very useful in situations where our ISP has assigned us only a single public IP address, as shown on the diagram below. All IP addresses of the LAN network will be translated using the public IP of the router interface FastEthernet0/0 ip address ip nat outside ! interface FastEthernet0/1 ip address ip nat inside ! access-list 1 permit ip nat inside source list 1 interface FastEthernet0/0 overload 2. Static Port Address Translation Port Redirection Assume now that we have only one public IP address which is the one configured on the outside interface of our border router. We want traffic hitting our router’s public IP on port 80 to be redirected to our internal Web Server at IP interface FastEthernet0/0 ip address ip nat outside ! interface FastEthernet0/1 ip address ip nat inside ! ip nat inside source static tcp 80 80 3. Configuring Static NAT NAT can be performed both statically and dynamically. Static NAT simply maps one private IP address to a single public IP address, and this is the flavor of NAT we are discussing in this section. A Cisco router performing NAT divides its universe into the inside and the outside. Typically the inside is a private enterprise, and the outside is the public Internet. In addition to the notion of inside and outside, a Cisco NAT router classifies addresses as either local or global. A local address is an address that is seen by devices on the inside, and a global address is an address that is seen by devices on the outside. Given these four terms, an address may be one of four types Inside local addresses are assigned to inside devices. These addresses are not advertised to the outside. Inside global are addresses by which inside devices are known to the outside. Outside local are addresses by which outside devices are known to the inside. Outside global addresses are assigned to outside devices. These addresses are not advertised to the inside. Let’s jump right into static NAT configuration on a Cisco router as shown in the Figure below R1 is the router performing Network Address Translation NAT and has two interfaces Fa0/0 on the inside and Fa0/1 on the outside. The specific IP addresses involved are NAT Address Type IP Address Inside local Inside global Outside local Outside global Table 1 NAT Addresses for Figure Above You probably know very well how to configure IP addresses on router interfaces, so we skip those configuration steps and move straight to the interesting stuff. First, we have to assign Fa0/0 as NAT inside interface and Fa0/1 as NAT outside interface on R1. This would tell the router that interesting traffic entering or exiting these two interfaces will be subject to address translation. R1conf term Enter configuration commands, one per line. End with CNTL/Z. R1configinterface Fa0/0 R1config-ifip nat inside R1config-ifinterface Fa0/1 R1config-ifip nat outside R1config-ifend Now we would tell the router how to perform address translation and mention which IP addresses source or destination to re-write in packets moving between the inside and outside interfaces. Here we go R1configip nat inside source static Here, we are telling the router to perform NAT on packets coming into the router on the inside interface Fa0/0. More specifically the router would identify which of these packets have a source IP address of and would change it to before forwarding the packet out the outside interface Fa0/1. Similarly, return packets coming in at outside interface Fa0/1 would undergo translation of destination IP address. Let’s now verify if NAT is actually working as it is supposed to work. There are a couple of very useful Cisco IOS commands that can be used to do just that. Command show ip nat statistics displays the number of static and dynamic NAT translations, inside and outside interfaces, and the number of hits and misses. R1show ip nat statistics Total active translations 1 1 static, 0 dynamic; 0 extended Outside interfaces FastEthernet0/1 Inside interfaces FastEthernet0/0 Hits 0 Misses 0 CEF Translated packets 0, CEF Punted packets 0 Expired translations 0 Dynamic mappings Appl doors 0 Normal doors 0 Queued Packets 0 Command show ip nat translations displays the IP addresses for NAT translations. R1show ip nat translations Pro Inside global Inside local Outside local Outside global — — — As you see in the above output, we have one NAT entry configured with Inside global address and Inside local address specified. Outside local and Outside global addresses are blank because our NAT configuration does not change those addresses. Let’s now go to the PC and ping the Server before running the command show ip nat translations again to see if it makes any difference. R1show ip nat statistics Total active translations 2 1 static, 1 dynamic; 1 extended Outside interfaces FastEthernet0/1 Inside interfaces FastEthernet0/0 Hits 10 Misses 0 CEF Translated packets 10, CEF Punted packets 0 Expired translations 0 Dynamic mappings Appl doors 0 Normal doors 0 Queued Packets 0 R1show ip nat translations Pro Inside global Inside local Outside local Outside global icmp — — — As you can see in the above output, NAT is active as manifested by the appearance of an additional dynamic entry for ICMP protocol and some additional hits, corresponding to our ping attempt from PC to Server. We just configured and verified a simple NAT scenario translating only the source or destination not both at the same time IP addresses of packets moving between inside and outside interfaces. This sort of NAT configuration is called static NAT as a single inside local IP address is statically mapped to a single outside local IP address. Another important feature of NAT is static Port Address Translation PAT. Static PAT is designed to allow one-to-one mapping between local and global addresses. A common use of static PAT is to allow Internet users from the public network to access a Web server located in the private network. Let’s assume we intend to host a Web server on the inside on the same PC, that has an IP address The following configuration line would allow us to do just that R1configip nat inside source static tcp 80 80 This configuration line performs the static address translation for the Web server. With this configuration line, users that try to reach port 80 www are automatically redirected to port 80 www. In our case, is the IP address of the PC which is also the Web server. This configuration can be verified using the same two NAT verification commands show ip nat translations and show ip nat statistics. Notice that the address with port number 80 HTTP translates to port 80, and vice versa. Therefore, Internet users can browse the Web server even though the Web server is on a private network with a private IP address. Related Posts Comparison of Static vs Dynamic Routing in TCP/IP Networks Cisco OSPF DR-BDR Election in Broadcast Networks – Configuration Example How to Configure Port Forwarding on Cisco Router With Examples Adjusting MSS and MTU on Cisco 800 routers for PPPoE over DSL The Most Important Cisco Show Commands You Must Know Cheat Sheet Seefull list on networkstraining.com.Step-1 : A network topology is created in the Cisco Packet Tracer, which includes a router, a switch, and three host systems connected to a network.Network Topology. Step-2 : Command easy lego builds for 4 year old. For our Static NAT configuration, we will use the topology below.You can DOWNLOAD the Cisco Packet Tracer example with Explore all categories to find your favorite topicPage 1 – NAT et PAT Page 2 Sommaire 1Introduction 2Terminologie 3NAT statique 4NAT dynamique 5Le PAT 6Configuration 7VĂ©rification Page 3 1 Introduction Le NAT
Scaling IP Addresses NATPAT CCNA 4 Rick Graziani [email protected] 2 Note to instructors ‱ If you have downloaded this presentation from the Cisco Networking Academy
7/16/2019 Practicas Nat Pat Dhcp Complementarias 1/62333 - 500 CCNA 4 Tecnologas WAN v Prctica de laboratorio Copyright 2003, Cisco Systems, de laboratorio
1. ICND 2002, Cisco Systems, Inc. All rights reserved. 1 Scaling the network with nat and Pat 2. ICND 2002, Cisco Systems, Inc. All rights reserved.
Chapter 1 Course IntroductionICND ICND * NAT and PAT Purpose This chapter introduces the Cisco IOSℱ CLI on the Catalyst 1900 switch8162019 22 - NAT et PAT 1 122 – NAT et PAT 8162019 22 - NAT et PAT 1 222 Sommaire 1 Introduction2 Terminologie 3 NAT statique 4 NAT dynamique 5 Le PAT 6 on!iguration
NAT / PAT L f ld öff tli h N tLernfeld öffentliche Netze Thomas Koch & Marco Reinel 1 Agendag WofĂŒr steht NAT / PAT ErklĂ€rung NAT ErklĂ€rung PATErklĂ€rung
1 Modul 8 NAT, PAT dan DHCP Network Address Translation NAT yaitu suatu protokol yang berfungsi untuk memetakan public IP address dengan private IP address yang dipergunakan
ACT 10 NAT con Sobrecarga PAT Al igual que las anteriores actividades 8-9 la 10 también se dividía en dos partes la A y la B pero a diferencia esta se trataba de
Chapter 1 Course Introduction* NAT and PAT Purpose This chapter introduces the Cisco IOSℱ CLI on the Catalyst 1900 switch and router. Timing This chapter should© 2008 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialPresentation_ID 1 Chapter 9 NAT for IPv4 Routing and Switching Essentials Presentation_ID 2© 2008
GuĂ­a de NAT + FW UtilizaciĂłn de Linux Nivel Avanzado Objetivos - Aprender a utilizar el comando iptables como modificador de paquetes en ambientes Linux - Conocer las
GuĂ­a de NAT + FW UtilizaciĂłn de Linux Nivel Avanzado Objetivos - Aprender a utilizar el comando iptables como modificador de paquetes en ambientes Linux - Conocer las
1. Por Paulo ColomĂ©s 2. 2Por Paulo ColomĂ©s - Redes - - 2010 NAT = Network Address Translation TraducciĂłn de Direcciones
CONFIGURACIÓN DEL CONMUTADOR ETHERNET 2950, NAT Y PAT Las redes de ĂĄrea local modernas se basan en la interconexiĂłn de con- mutadores Ethernet multicapaJourney to IPv6 A Real-World deployment for Mobiles ISP Workshops Telstra UnrestrictedLast updated 1st March 2017 Acknowledgements p We would like to acknowledge Jeff Schmidt
SEGURIDAD EN LAS REDES CORPORATIVAS MEDIANTE NETWORK ADDRESS TRANSLATION NAT Y PORT ADDRESS TRANSLATION PAT SEGURIDAD EN LAS REDES CORPORATIVAS MEDIANTE NETWORK ADDRESS
IT-Symposium 2004 © 2004 Hewlett-Packard Development Company, The information contained herein is subject to change without notice EinfĂŒhrung in NAT
Telstra Unrestricted Copyright Telstra© Journey to IPv6 A Real-World deployment for Mobiles APRICOT 2017 – February 2017 Jeff Schmidt- Technology Team Manager, Telstra
Slide 1 © 2003, Cisco Systems, Inc. All rights reserved. ICND © 2003, Cisco Systems, Inc. All rights reserved. 1 Scaling the Network with NAT and PAT Slide 2
 .