09.12.2012 Views

Understanding the network.pdf - Back to Home

Understanding the network.pdf - Back to Home

Understanding the network.pdf - Back to Home

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

The [prefix-length] or [netmask] sets <strong>the</strong> <strong>network</strong> mask that should be<br />

associated with <strong>the</strong> addresses in <strong>the</strong> pool. In this example, <strong>the</strong> local ISP has<br />

assigned <strong>the</strong> address range 12.14.116.16 /28 for <strong>the</strong> creation of <strong>the</strong> outside<br />

address pool:<br />

sartre(config)# ip nat sartre-NAT 12.14.116.17 12.14.116.31<br />

prefix-length 28<br />

When dynamic translation is in use, addressees are translated on a first come, first<br />

served basis. If all <strong>the</strong> addresses in <strong>the</strong> pool are allocated, inside hosts will be sent<br />

an ICMP host unreachable message. If your outside address pool is small, it can be<br />

advantageous <strong>to</strong> modify <strong>the</strong> translation expiration from <strong>the</strong> default 24 hours <strong>to</strong> a<br />

more reasonable (smaller) time range. This is accomplished with <strong>the</strong> global<br />

configuration command . Ano<strong>the</strong>r<br />

available option is <strong>to</strong> enable PAT. As stated earlier, PAT enables multiple inside TCP<br />

and UDP requests <strong>to</strong> be associated with a single outside address. PAT is enabled by<br />

adding <strong>the</strong> [overload] flag <strong>to</strong> <strong>the</strong> configuration command.<br />

NOTE<br />

Two approaches can be used <strong>to</strong> allocate NAT address ranges. The first approach is<br />

<strong>to</strong> allocate <strong>the</strong> NAT outside pool range from <strong>the</strong> same <strong>network</strong> space used by <strong>the</strong><br />

gateway interface. This makes announcing routing for <strong>the</strong> NAT pool easy because<br />

<strong>the</strong> gateway and NAT pool addresses can be routed with <strong>the</strong> same <strong>network</strong><br />

announcement. The o<strong>the</strong>r approach is <strong>to</strong> assign an address range different from<br />

that used by <strong>the</strong> gateway interface. With this approach, announcements for <strong>the</strong> NAT<br />

pool are also directed <strong>to</strong> <strong>the</strong> gateway interface, but require an additional <strong>network</strong><br />

announcement. If a dynamic routing pro<strong>to</strong>col is being used <strong>to</strong> announce <strong>the</strong> publicly<br />

accessible routes, a loopback interface can be installed, using an address from <strong>the</strong><br />

pool range.<br />

Dynamic Source List Creation<br />

The dynamic source list is a standard IP access-list that defines which inside<br />

addresses are eligible for NAT translation. Only addresses defined in <strong>the</strong> ACL will be<br />

translated. ACL entries are entered on a line-by-line basis using <strong>the</strong> global<br />

configuration command .

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!