Throughout my career in networking, I’ve often implemented Source-NAT translation on Cisco routers (the practice of replacing the source IP address in packets) to either hide the private address or because the subnet overlapped with another location. However, I’ve rarely implemented Destination-NAT (the practice of replacing the destination IP address in packets). Destination-NAT, it turns out is not as self-explanatory as Source-NAT when it comes to CLI commands. And, the materials I found on CCO and Google searches did not clearly explain how to do this simple task in Cisco IOS. So, I think it warrants a quick article in case others need!
Why would you want to Destination-NAT? It is needed when a service provider assigns private addressing (RFC 1918) to a service you need to target and you already have a route in your network for that subnet, which goes elsewhere. Or, you need to direct certain lines of business (LOB) to use one circuit over another, to reach the same service. In this case, you can have one LOB target the real IP to reach the service over a specific circuit, and another LOB would target the Destination-NAT IP. This way, the two LOBs don’t have to share the circuit.
If you are translating one IP to one IP, there is no need for a pool, or an ACL, for either source OR destination-NAT. You would use the “ip nat inside source static” or “ip nat outside source static”. I’ll explain which one to use for which scenario. I just depends of the direction the session is initiated. I usually assign the interface for my network (the one closer to the network core) as the “inside” interface using the “ip nat inside”. And the interface facing the other network as “outside” using the “ip nat outside” command. This also happens to be the way zone based firewalls work, although NAT has nothing to do with security or firewalls, and you could very well do the opposite.
Before I give a Destination-NAT example, let’s do a Source-NAT because that’s more common. Here is the topology:
Core network where sessions get initiated (10.1.1.0/24) –> NAT router –> Other network (172.16.1.0/24)
In this scenario, we hide the core network’s real host IP address (10.1.1.1) for that flow with the NAT range IP address of 192.168.1.1. So, the “other network” sees our traffic coming from the NAT address.
The IOS CLI command to do this is:
ip nat inside source static 10.1.1.1 192.168.1.1
Of course, you have to ensure there is a route for the translated address in the routing tables along the path for any router to reach that destination.
Now, let’s say we also need to use this NAT router to translate the destination of our packet. In other words, there is a LOB who needs to reach 172.16.1.1 via a different path, or we simply cannot advertise 172.16.1.0/24 into our core, for various reasons. We need the host on our core to be able to target 172.16.1.1 by using destination address 172.18.222.222.
At the NAT router, you can’t use “ip nat inside destination static” because there is no such command in IOS. Instead, you would use the following:
ip nat outside source static 172.18.222.222 172.16.1.1 add-route
As you can see, we are dealing with the outside NAT interface, which means we NAT in the return direction, which is why we have to reverse the order of the translation and use “source” instead of “destination”!
The “add-route” keyword may be needed if there is no route (or a route with an incorrect next-hop) in the routing table for the old “not-translated” destination.
Again, you have to ensure the 172.18.222.222 route is advertised inside your core, so the hosts can reach it.
Note- not all applications are tolerant to NAT, so make sure you test!
Nice Article..
ReplyDeleteThanx....
Thank you so much.. (Commented even before trying....) I have been looking for article like yours the whole day.
ReplyDeleteJust as a question, wouldn't the "ip nat inside destination" do the same thing?
I have been trying th=o get that one setup for a long time now..!
@akshayd2006, you are welcome! I am glad this article helped. "ip nat inside destination list" (list is a required keyword) requires an address pool, which isn't what we want here.
Deleteghd flat iron
ReplyDeletehollister clothing
converse uk
armani jeans
michael kors outlet clearance
rolex daytona
fitflops sale clearancee
louboutin pas cher
new balance shoes
kate spade
ed hardy
canada goose parka
rolex replica watches
christian louboutin outlet
timberland boots
michael kors handbags
louboutin
true religion jeans
nike running shoes
prada handbags
ecco shoes
louboutin outlet
longchamp outlet
michael kors outlet
michael kors outlet
nike air max
ray ban sunglasses discount
salvatore ferragamo
coach outlet store
cheap jordans
air max 90
polo ralph lauren outlet
ralph lauren outlet
ZHUO20160715
Thanks for the article, helped me a lot to find the right syntax for destination nat.
ReplyDeleteThanks so much. This helped me out. I couldn't find the correct solution anywhere else. This made my day!
ReplyDeleteHi Thanks for the article. And I found that when I ping from inside to outside, I do not see in the debug that translation occurs. May it be true that translation only occurs when traffic from outside initiated?
ReplyDeletePlease help not sure doing it correctly, I could not get CLI 'ip nat outside source static 172.18.222.222 172.16.1.1 add-route' to work.
ReplyDelete(INT router 10.1.1.1/24) –> (10.1.1.254 NAT router 172.16.1.254) –> (172.16.1.1/24 EXT router)
CLI added for 'ip nat inside source static 10.1.1.1 192.168.1.1'
From Ext router when I ping 192.168.1.1 destination is translated to 10.1.1.1
CLI added for 'ip nat outside source static 172.18.222.222 172.16.1.1 add-route'
From Ext router I could not ping to NAT Router 172.16.1.254 and from NAT router I could not ping to Ext router 172.16.1.1.
CLI added for 'ip nat inside source static 10.1.1.1 192.168.1.1'
ReplyDeleteFrom Ext router when I ping 192.168.1.1 destination is translated to 10.1.1.1 (Where I am accessing INT from EXT)
I am confused is this source NAT? As based on the definition I found for Juniper SRX (see below) it seems to be Destination NAT.
http://www.mustbegeek.com/configure-destination-nat-in-juniper-srx/
Destination NAT is a type of NAT that is configured when you want to get access to your internal network from outside. This type of NAT is also called destination PAT because in this type of NAT, you simply translate different ports to reach various services with same IP address.
How does Linksys Extender re6400 Wireless-N Wi-Fi Range Extender work ?
ReplyDeleterussell westbrook jersey
ReplyDeletevan cleef & arpels jewelry
lululemon outlet
coach outlet online
adidas nmd for sale
hogan shoes
hollister clothing
polo ralph lauren
wholesale nfl jerseys
belstaff outlet
chenyingying20180831
michael kors
ReplyDeletehogan
louboutin
belgium world cup jerseys
prada outlet
tory burch outlet
karen millen
gucci outlet
nike roshe run
michael kors outlet
2018.9.29chenlixiang
golden goose sneakers
ReplyDeleteoff white hoodie
yeezy boost
kobe basketball shoes
lacoste outlet
yeezy boost
fila
michael kors factory outlet
michael kors outlet
jordans
Thanks for sharing a great article.Arlo Login is the most common issue faced by people who are using Netgear’s Arlo security cameras. The login usually occurs due to the wrong username/email and password.If you need any assistance regarding Arlo Login Installation or Troubleshooting, Contact support Team at +1-844-456-4180.
ReplyDeleteAdvaita yoga studio is one of the most reportable yoga studios in Chandigarh sector 38. you can get different sessions and therapies to enhance your spiritual, professional and personal life.Check our website: https://advaitayogastudios.com/
ReplyDeleteI found your website perfect for my needs. It contains wonderful and helpful posts. I have read most of them and got a lot from them.
ReplyDeletePrinter offline |
Roku Com Support |
how to activate nfl game pass on roku |
netflix not working on roku |
roku connected but not working |
roku channel not working |
roku activation issues |
espn plus not working on roku |
espn on roku without cable |
Nice work on putting together a very interesting post. Fabulous ideas and very helpful information. Well thought out and well written.
ReplyDeletego roku com speaker pair help |
go roku com remotehelp |
cbs all access on roku |
amazon prime not working on roku |
roku error code 018 |
roku error code 013 |
roku error code 016 |
roku error code 011 |
roku error code 001 |
I was impressed with this news, thanks for posting, I hope to return soon to follow in your notes that are great.
ReplyDeleteroku error code 005 |
roku error code 003 |
roku error code 006 |
roku error code 009 |
roku error code 012 |
roku error code 017 |
roku error code 014.40 |
fire stick connected with problems |
how to unlock kindle fire without ressetting |
Thanks for the great post. I have been visiting your site often and I find it really interesting and informative.
ReplyDeletekindle fire keeps losing wifi connection |
Kindle Support |
Kindle Fire won’t turn on even when plugged in |
Factory reset Kindle Fire |
Kindle Fire Frozen Screen |
Kindle Paperwhite won’t turn on |
How to reset kindle fire |
Kindle Keeps Crashing |
how to unlock kindle fire without resetting |
I was very pleased to find this site. I wanted to thank you for this great read!! I definitely enjoyed every little bit of it and I have you bookmarked to check out the new stuff you post.
ReplyDeleteKindle Fire not working |
Kindle Fire won’t turn on |
Kindle Fire keeps losing WiFi connection |
Kindle Won’t Connect to WiFi |
Kindle Paperwhite Frozen Screen |
Kindle Paperwhite troubleshooting |
kindle won't charge |
kindle fire won't charge |
kindle app not working |
The post is written in very a good manner and it contains much useful information for me. You have a very impressive writing style. Thanks for sharing.
ReplyDeletekindle fire is not recognized by windows 10 |
kindle com support |
Kindle Fire Authentication problem |
Unable to Register Kindle |
kindle frozen reset not working |
kindle paperwhite is frozen on lock screen |
kd shoes
ReplyDeletepaul george shoes
golden goose
supreme shirt
longchamp
golden goose
offwhite
canada goose jacket
westbrook shoes
supreme hoodie
supreme hoodie
ReplyDeletebape clothing
kobe byrant shoes
yeezy boost 350 v2
lebron 18
curry 6 shoes
adidsas yeezy
supreme outlet
longchamp handbags
jordan 13
We provide support for arlo.com login,my arlo login, myarlo login, arlo pro 2 login, arlo login my account, arlo log in issues. Our highly qualified team is always happy to assist you.
ReplyDeletearlo camera login
The camera's led flashes blue and amber alternately while a firmware upgrade is in progress. Do not turn off your smarthub or base station while the firmware upgrade is in progress. For your home, Arlo security cameras and systems are great. Firmware upgrades for base stations are usually automatic, but you may need to manually upgrade the arlo firmware if your base station is offline during the update or if you are adding a device. arlo pro, arlo q, arlo camera firmware update
ReplyDeleteBeing a well-known and well-respected brand, however, does not guarantee that there will be no problems with the printers. It has been observed that the majority of Canon printer users find it difficult to resolve the issue and are stuck at the setup Canon printer stage. That is why they seek out information on how to connect a Canon printer to a computer in order to complete the process correctly. how to reset printer canon
ReplyDeletepage louis vuitton replica why not try here louis vuitton dolabuy click here for more info dolabuy.ru
ReplyDeletereplica bags paypal accepted hermes fake m2n26g3i70 replica zara bags view publisher site d8z90y9f44 replica louis vuitton replica evening bags look at this web-site a1r46l4y43 replica bags online replica bags los angeles
ReplyDeletet5y22q0b02 d5l39k1e70 e7w06u9o61 c7q26f5j73 b5u29i7y63 i7l08c9d46
ReplyDeleteThis provide 1xbet will get you a 250% match bonus as much as} $2,500 on your first deposit with 50 spins on the cheeky and tropical Wild Hog Luau slot title. $/€1 deposit also provides players an excellent opportunity to see if the site is really to their tastes and preferences. You can head in, make a minimal deposit, and take your time exploring the slots and desk games on provide. Rather than spending large sums and discovering that there's nothing to properly with|swimsuit} you, you can start small and spend longer trying out different games and choices till would possibly be} actually happy.
ReplyDelete