CSCO 220 Modules 3 & 6 Lab Packet-NAT

docx

School

College of Southern Nevada *

*We aren’t endorsed by this school

Course

220

Subject

Computer Science

Date

Dec 6, 2023

Type

docx

Pages

Uploaded by DCOLEMAN2000

Module 3: Network Security Concepts Module 6-Nat for IPv4 For some of this packet you will need to have access to your account on the Netacad website . Grading Rubric Your Score Packet complete, answers correct, submitted on-time. 4 Packet complete, answers mostly correct, submitted on-time. 3 Packet mostly complete, answers mostly correct, submitted on-time. 2 Packet mostly complete, answers mostly correct, submitted late. 1  For the Packet Tracer exercises located below, go to the Netacad link, click on it and go to the module this lab packet applies to. Click on the section where the Packet Tracer activity is located, download the Packet Tracer activity and follow the instructions included with the Packet Tracer activity  Perform any Netlab assignments listed below, be sure to post your answers in RED  Post a Packet Tracer screen shot ONLY of the name of the lab and the completion score (not the network or anything else). Make the screenshot the size of the page so I can easily read it using my grading software Lab 3.5.7- Social Engineering 1. Objective In this lab, you will research examples of social engineering and identify ways to recognize and prevent it. 2. Resources  Computer with internet Access 3. Instructions Research Social Engineering Examples Social engineering, as it relates to information security, is used to describe the techniques used by a person (or persons) who manipulate people in order to access or compromise information about an organization or its computer systems. A social engineer is usually difficult to identify and may claim to be a new employee, a repair person, or researcher. The social engineer might even offer credentials to support that identity. By © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 1 of 25 CSCO 220

gaining trust and asking questions, he or she may be able to piece together enough information to infiltrate an organization's network. Question: Use any internet browser to research incidents of social engineering. Summarize three examples found in your research. Google/Facebook Spear Phishing Scam A Lithuanian cybercriminal, Evaldas Rimasauskas, perpetrated one of the biggest social media attacks ever against two of the biggest tech giants in the world, Google and Facebook. He and his team set up a fake company and pretended to be a computer manufacturer that worked with for the two tech giants. Rimasaukas and his teams sent phishing emails to Google and Facebook employees, charging them for goods and services. Consequently, the employees unknowingly deposited money into the scammers’ bank accounts they created for the fake company. In a two-year span, Google and Facebook got scammed out of over $100 million. Source: 15 Examples of Real Social Engineering Attacks Deepfake Attack on UK Energy Company The CEO of a UK energy firm received a phone call from someone who sounded exactly like his boss, the chief executive of the firms German parent company, who demanded the urgent transfer of €220k ($243k) to a Hungarian supplier. The CEO was demanded to pay within an hour. Source: Fraudsters Used AI to Mimic CEO’s Voice in Unusual Cybercrime Case Belgian Bank Whaling Attack Crelan, a Belgian bank, fell victim to one of the bank’s highest-ranking executives being whaled by a spear- phishing email. As a result, the bank has lost over €70 million ($75 million). Source: Belgian Bank Loses €70 million to Classic CEO Fraud Social Engineering Trick Recognize the Signs of Social Engineering Social engineers are nothing more than thieves and spies. Instead of hacking their way into your network via the Internet, they attempt to gain access by relying on a person’s desire to be accommodating. Although not specific to network security, the scenario below, described in Christopher Hadnagy’s book, The Art of Human Hacking , illustrates how an unsuspecting person can unwittingly give away confidential information. “The I was relatively quiet as I, dressed in a suit, sat at an empty table. I placed my briefcase on the table and waited for a suitable victim. Soon, just such a victim arrived with a friend and sat at the table next to mine. She placed her bag on the seat beside her, pulling the seat close and keeping her hand on the bag at all times. After a few minutes, her friend left to find a restroom. The mark [target] was alone, so I gave Alex and Jess the signal. Playing a couple, Alex and Jess asked the mark if she would take a picture of them both. She was happy to do so. She removed her hand from her bag to take the camera and snap a picture of the “happy couple” and, while distracted, I reached over, took her bag, and locked it inside my briefcase. My victim had yet to notice her purse was missing as Alex and Jess left the café. Alex then went to a nearby parking garage. It didn’t take long for her to realize her bag was gone. She began to panic, looking around frantically. This was exactly what we were hoping for so, I asked her if she needed help. She asked me if I had seen anything. I told her I hadn’t but convinced her to sit down and think about what was in the bag. A phone. Make-up. A little cash. And her credit cards. Bingo! © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 2 of 25

I asked who she banked with and then told her that I worked for that bank. What a stroke of luck! I reassured her that everything would be fine, but she would need to cancel her credit card right away. I called the “help-desk” number, which was actually Alex, and handed my phone to her. Alex was in a van in the parking garage. On the dashboard, a CD player was playing office noises. He assured the mark that her card could easily be canceled but, to verify her identity, she needed to enter her PIN on the keypad of the phone she was using. My phone and my keypad. When we had her PIN, I left. If we were real thieves, we would have had access to her account via ATM withdrawals and PIN purchases. Fortunately for her, it was just a TV show.” Remember: “Those who build walls think differently than those who seek to go over, under, around, or through them.” Paul Wilson – The Real Hustle Question: Research ways to recognize social engineering. Describe three examples found in your research. Unusual requests – The attacker asks for something unusual. Sense of urgency – The attacker includes a sense of urgency. Unusual file or URL – The attacker attaches an unusual file or URL. Research Ways to Prevent Social Engineering Questions: Does your company or school have procedures in place to help to prevent social engineering? If so, what are some of those procedures? Multi-Factor Authentication Blocking certain websites Use the internet to research procedures that other organizations use to prevent social engineers from gaining access to confidential information. List your findings. Security Awareness Training Employees would have to understand how cybercriminals operate. They would have to carry on many responsibilities such as updating patches, turning on firewalls, monitoring systems, etc. Cybersecurity awareness improves responses to cyber-attacks. Source: 8 Ways Organisations Prevent Social Engineering Attacks Simulating Social Engineering Attempts Simulations can help improve the organization training and awareness procedures and policies. They can help members of the organization focus on the areas to need improvement so they successfully detect and avoid social engineering attempts. Source: 8 Ways Organisations Prevent Social Engineering Attacks Utilizing SSL Certification Encryption can minimize the consequences of hackers gaining access to communication systems. Encryption can be achieved by attaining SSL certification from authorities. Source: 8 Ways Organisations Prevent Social Engineering Attacks © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 3 of 25

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

Lab 3.8.8 Social Engineering 4. Objectives Part 1: Capture DNS Traffic Part 2: Explore DNS Query Traffic Part 3: Explore DNS Response Traffic 5. Background / Scenario Wireshark is an open source packet capture and analysis tool. Wireshark gives a detailed breakdown of the network protocol stack. Wireshark allows you to filter traffic for network troubleshooting, investigate security issues, and analyze network protocols. Because Wireshark allows you to view the packet details, it can be used as a reconnaissance tool for an attacker. In this lab, you will install Wireshark on a Windows system and use Wireshark to filter for DNS packets and view the details of both DNS query and response packets. 6. Required Resources  1 Windows PC with internet access and Wireshark installed © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 4 of 25

7. Instructions Capture DNS traffic. Open Wireshark and start a Wireshark capture by double clicking a network interface with traffic. At the Command Prompt, enter ipconfig /flushdns clear the DNS cache. C:\Users\Student> ipconfig /flushdns Windows IP Configuration Successfully flushed the DNS Resolver Cache. Enter nslookup at the prompt to enter the nslookup interactive mode. Enter the domain name of a website. The domain name www.cisco.com is used in this example. Enter www.cisco.com at the > prompt. C:\Users\Student> nslookup Default Server: UnKnown Address: 68.105.28.16 > www.cisco.com Server: UnKnown Address: 68.105.28.16 Non-authoritative answer: Name: e2867.dsca.akamaiedge.net Addresses: 2001:578:28:68d::b33 2001:578:28:685::b33 96.7.79.147 Aliases: www.cisco.com www.cisco.com.akadns.net wwwds.cisco.com.edgekey.net wwwds.cisco.com.edgekey.net.globalredir.akadns.net © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 5 of 25

Enter exit when finished to exit the nslookup interactive mode. Close the command prompt. Click Stop capturing packets to stop the Wireshark capture. Explore DNS Query Traffic Observe the traffic captured in the Wireshark Packet List pane. Enter udp.port == 53 in the filter box and click the arrow (or press enter) to display only DNS packets. Select the DNS packet labeled Standard query 0x0002 A www.cisco.com . In the Packet Details pane, notice this packet has Ethernet II, Internet Protocol Version 4, User Datagram Protocol and Domain Name System (query). Expand Ethernet II to view the details. Observe the source and destination fields. © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 6 of 25

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

Question: What are the source and destination MAC addresses? Which network interfaces are these MAC addresses associated with? Source MAC address: 00:50:56:8b:ce:0c Destination MAC address: 00:50:56:8b:2e:4e Both addresses are associated with Ethernet0. a. Expand Internet Protocol Version 4 . Observe the source and destination IPv4 addresses. © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 7 of 25

Question: What are the source and destination IP addresses? Which network interfaces are these IP addresses associated with? Source IP address: 192.168.1.156 Destination IP Address: 192.168.1.1 Both addresses are associated with Ethernet0. b. Expand the User Datagram Protocol . Observe the source and destination ports. Question: What are the source and destination ports? What is the default DNS port number? Source Port: 50900 Destination Port: 53 Default DNS port number: 53 c. Open a Command Prompt and enter arp –a and ipconfig /all to record the MAC and IP addresses of the PC. C:\Users\Student> arp -a Interface: 192.168.1.10 --- 0x4 Internet Address Physical Address Type 192.168.1.1 cc-40-d0-18-a6-81 dynamic 192.168.1.122 b0-a7-37-46-70-bb dynamic 192.168.1.255 ff-ff-ff-ff-ff-ff static 224.0.0.22 01-00-5e-00-00-16 static 224.0.0.252 01-00-5e-00-00-fc static 239.255.255.250 01-00-5e-7f-ff-fa static 255.255.255.255 ff-ff-ff-ff-ff-ff static © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 8 of 25

C:\Users\Studuent> ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : DESKTOP Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No Ethernet adapter Ethernet: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Desktop Adapter Physical Address. . . . . . . . . : 08-00-27-80-91-DB DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::d829:6d18:e229:a705%4(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.1.10(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Tuesday, August 20, 2019 5:39:51 PM Lease Expires . . . . . . . . . . : Wednesday, August 21, 2019 5:39:50 PM Default Gateway . . . . . . . . . : 192.168.1.1 DHCP Server . . . . . . . . . . . : 192.168.1.1 DHCPv6 IAID . . . . . . . . . . . : 50855975 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-24-21-BA-64-08-00-27-80-91-DB DNS Servers . . . . . . . . . . . : 68.105.28.16 68.105.29.16 NetBIOS over Tcpip. . . . . . . . : Enabled Question: Compare the MAC and IP addresses in the Wireshark results to the results from the ipconfig /all results. What is your observation? The MAC and IP addresses in the Wireshark results are the same as the ones in the ipconfig /all results. Type your answers here. d. Expand Domain Name System (query ) in the Packet Details pane. Then expand the Flags and Queries . © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 9 of 25

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

Observe the results. The flag is set to do the query recursively to query for the IP address to www.cisco.com. © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 10 of 25

Explore DNS Response Traffic Select the corresponding response DNS packet labeled Standard query response 0x0002 A www.cisco.com . Questions: What are the source and destination MAC and IP addresses and port numbers? How do they compare to the addresses in the DNS query packets? Source MAC address: 00:50:56:8b:2e:4e Destination MAC address: 00:50:56:8b:ce:0c Source IP address: 192.168.1.1 Destination IP address: 192.168.1.156 Source port: 53 Destination port: 50900 The source and destination MAC addresses are switched. The source and destination IP addresses are switched. The source and destination ports are also switched. Type your answers here. © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 11 of 25

Expand Domain Name System (response) . Then expand the Flags , Queries , and Answers . Observe the results. Question: Can the DNS server do recursive queries? Yes. Observe the CNAME and A records in the answers details. Question: How do the results compare to nslookup results? The Wireshark results are same as the ones in the nslookup results. Type your answers here. © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 12 of 25

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

Reflection Question 1. From the Wireshark results, what else can you learn about the network when you remove the filter? I can see all the other packets if I remove the filter. I can learn about other devices and functions within the LAN. Type your answers here. 2. How can an attacker use Wireshark to compromise your network security? The attacker can use Wireshark to observe the network traffic and get sensitive information in the packet details if the traffic is not encrypted. Type your answers here. End of Document Packet Tracer 6.2.7-Investigate NAT Operations. Post a screenshot of the completion screen below, make it the width of the page and answer the questions: Generate an HTTP request from any PC in the Central domain. Switch to Simulation mode and edit the filters to show only HTTP requests. Open the Web Browser of any PC in the Central domain and type the URL http://branchserver.pka and click Go . Minimize the browser window. Click Capture / Forward until the PDU is over D1 or D2 . Click on the most recent PDU in the Event List. Record the source and destination IP addresses. Question: To what devices do those addresses belong? Source IP address: 10.2.0.4 – PC1 Destination IP address: 64.100.200. – R4 © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 13 of 25

Type your answers here. Click Capture / Forward until the PDU is over R2 . Record the source and destination IP addresses in the outbound packet. Question: To what devices do those addresses belong? Source IP address: 64.100.100.3 – Not assigned to an interface. Destination IP address: 64.100.200.1 – R4 Type your answers here. Login to R2 from the CLI using the password class to enter privileged EXEC and issue the following command: Open configuration window R2# show run | include pool ip nat pool R2Pool 64.100.100.3 64.100.100.31 netmask 255.255.255.224 ip nat inside source list 1 pool R2Pool The address came from the NAT pool R2Pool . Click Capture / Forward until the PDU is over R4 . Record the source and destination IP addresses in the outbound packet. Question: To what devices do those addresses belong? Source IP address: 64.100.100.3 – R2Pool Destination IP address: 172.16.0.3 – BranchServer.pka Type your answers here. Click Capture / Forward until the PDU is over BranchServer.pka . Record the source and destination TCP port addresses in the outbound segment. Type your answers here. On both R2 and R4 , run the following command and match the IP addresses and ports recorded above to the correct line of output: R2# show ip nat translations R4# show ip nat translations Questions: What do the inside local IP addresses have in common? They are private IP addresses that are reserved for private use. Type your answers here. Did any private addresses cross the intranet? No private addresses crossed the intranet. Type your answers here. Close configuration window Click the Reset Simulation button and remain in Simulation Model. Investigate NAT Operation Across the Internet Generate an HTTP request from any computer in the home office. Open the Web Browser of any PC in the Home Office domain and type the URL http://centralserver.pka and click Go . © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 14 of 25

Click Capture / Forward until the PDU is over WRS. Record the inbound source and destination IP addresses and the outbound source and destination addresses. Question: To what devices do those addresses belong? Inbound source IP address: 192.168.0.101 - HomeDesktop Inbound destination IP address: 64.100.100.2 – R2 Outbound source IP address: 64.104.223.2 – WRS Outbound destination IP address: 64.100.100.2 – R2 Type your answers here. Click Capture / Forward until the PDU is over R2 . Record the source and destination IP addresses in the outbound packet. Question: To what devices do those addresses belong? Source IP address: 64.104.223.2 – WRS Destination IP address: 10.10.10.2 – CentralServer.pka Type your answers here. On R2 , run the following command and match the IP addresses and ports recorded above to the correct line of output: Open configuration window R2# show ip nat translations Close configuration window Return to Realtime mode. Question: Did all of the web pages appear in the browsers? Yes. Type your answers here. Conduct Further Investigations Experiment with more packets, both HTTP and HTTPS and answer the following questions. Questions: Do the NAT translation tables grow? Yes. There are additional entries as new conversations are started. Type your answers here. Does WRS have a NAT pool of addresses? No, it uses the same IP address for all devices. Type your answers here. Is this how the computers in the classroom connect to the internet? It depends on the organization. Type your answers here. Why does NAT use four columns of addresses and ports? Because those columns contain the inside global, outside global, inside global, and outside global addresses. Type your answers here. © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 15 of 25

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

Where are the networks are inside global and inside local? The inside local addresses are on the LANs within each domain. The outside global addresses are from the WAN links to the internet and intranet. Type your answers here. On which devices are NAT services operating? What do they have in common? NAT services are operating on WRS, R2, and R4. They all connect internal LANs to outside networks that require routable IP addresses. Packet Tracer 6.4.5-Configure Static NAT. Post a screenshot of the completion screen below, make it the width of the page. Packet Tracer 6.5.6-Confgure Dynamic NAT. Post a screenshot of the completion screen below, make it the width of the page. © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 16 of 25

Packet Tracer 6.6.7-Configure PAT. Post a screenshot of the completion screen below, make it the width of the page. Netlab 6.8.2-Configure NAT for IPv4. Be sure to post your answers in red. 8. Topology © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 17 of 25

Addressing Table Device Interface IP Address Subnet Mask R1 G0/0/0 209.165.200.230 255.255.255.248 R1 G0/0/1 192.168.1.1 255.255.255.0 R2 G0/0/0 209.165.200.225 255.255.255.248 R2 Lo1 209.165.200.1 255.255.255.224 S1 VLAN 1 192.168.1.11 255.255.255.0 S2 VLAN 1 192.168.1.12 255.255.255.0 PC-A NIC 192.168.1.2 255.255.255.0 PC-B NIC 192.168.1.3 255.255.255.0 Objectives Part 1: Build the Network and Configure Basic Device Settings (already completed for you) Part 2: Configure and verify NAT for IPv4 Part 3: Configure and verify PAT for IPv4 Part 4: Configure and verify Static NAT for IPv4 9. Background / Scenario Network Address Translation (NAT) is the process where a network device, such as a Cisco router, assigns a public address to host devices inside a private network. The main reason to use NAT is to reduce the number of public IP addresses that an organization uses because the number of available IPv4 public addresses is limited. An ISP has allocated the public IP address space of 209.165.200.224/29 to a company. This network is used to address the link between the ISP router (R2) and the company gateway (R1). The first address (209.165.200.225) is assigned to the g0/0/0 interface on R2 and the last address (209.165.200.230) is assigned to the g0/0/0 interface on R1. The remaining addresses (209.165.200.226-209.165.200.229) will be used to provide internet access to the company hosts. A default route is used from R1 to R2. The internet is simulated by a loopback address on R2. In this lab, you will configure various types of NAT. You will test, view, and verify that the translations are taking place, and you will interpret the NAT/PAT statistics to monitor the process. Note : The routers used with CCNA hands-on labs are Cisco 4221 with Cisco IOS XE Release 16.9.3 (universalk9 image). The switches used in the labs are Cisco Catalyst 2960s with Cisco IOS Release 15.2(2) (lanbasek9 image). Other routers, switches, and Cisco IOS versions can be used. Depending on the model and Cisco IOS version, the commands available and the output produced might vary from what is shown in the labs. Refer to the Router Interface Summary Table at the end of the lab for the correct interface identifiers. Note : Ensure that the routers and switches have been erased and have no startup configurations. If you are unsure contact your instructor. 10. Required Resources  2 Routers (Cisco 4221 with Cisco IOS XE Release 16.9.4 universal image or comparable) © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 18 of 25

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

 2 Switches (Cisco 2960 with Cisco IOS Release 15.2(2) lanbasek9 image or comparable)  2 PCs (Windows with a terminal emulation program, such as Tera Term)  Console cables to configure the Cisco IOS devices via the console ports  Ethernet cables as shown in the topology 11. Instructions Build the Network and Configure Basic Device Settings In Part 1, you will set up the network topology and configure basic settings on the PC hosts and switches. Cable the network as shown in the topology (this is already completed for you) Attach the devices as shown in the topology diagram and cable as necessary. Configure basic settings for each router. Open configuration window Assign a device name to the router. Disable DNS lookup to prevent the router from attempting to translate incorrectly entered commands as though they were host names. Assign class as the privileged EXEC encrypted password. Assign cisco as the console password and enable login. Assign cisco as the VTY password and enable login. Encrypt the plaintext passwords. Create a banner that warns anyone accessing the device that unauthorized access is prohibited. Configure interface IP addressing as specified in the table above. Configure a default route to R2 from R1. Save the running configuration to the startup configuration file. Close configuration window Configure basic settings for each switch. Open configuration window Assign a device name to the switch. Disable DNS lookup to prevent the router from attempting to translate incorrectly entered commands as though they were host names. Assign class as the privileged EXEC encrypted password. Assign cisco as the console password and enable login. Assign cisco as the VTY password and enable login. Encrypt the plaintext passwords. Create a banner that warns anyone accessing the device that unauthorized access is prohibited. Shutdown all interfaces that will not be used. Configure interface IP addressing as specified in the table above. Save the running configuration to the startup configuration file. Close configuration window Configure and verify NAT for IPv4 In Part 2, you will configure and verify NAT for IPv4. © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 19 of 25

Configure NAT on R1 using a pool of three addresses, 209.165.200.226-209.165.200.228. Open configuration window Configure a simple access list that defines what hosts are going to be allowed for translation. In this case, all devices on the R1 LAN are eligible for translation. R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255 Create the NAT pool, and give it a name and a range of addresses to use. R1(config)# ip nat pool PUBLIC_ACCESS 209.165.200.226 209.165.200.228 netmask 255.255.255.248 Note : The netmask parameter is not an IP address delimiter. It should be the correct subnet mask for the addresses being assigned, even if you are not using all the subnet addresses in the pool. Configure the translation, associating the ACL and Pool to the translation process. R1(config)# ip nat inside source list 1 pool PUBLIC_ACCESS Note : Three very important points. First, the word ‘inside’ is critical to the operation of this kind of NAT. If you omit it, NAT will not work. Second, the list number is the ACL number configured in a previous step. Third, the pool name is case-sensitive. Define the inside interface. R1(config)# interface g0/0/1 R1(config-if)# ip nat inside Define the outside interface. R1(config)# interface g0/0/0 R1(config-if)# ip nat outside Test and Verify the configuration. From PC-B, ping the Lo1 interface (209.165.200.1) on R2. If the ping was unsuccessful, troubleshoot and correct the issues. On R1, display the NAT table on R1 with the command show ip nat translations . R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 209.165.200.226 192.168.1.3 --- --- icmp 209.165.200.226:1 192.168.1.3:1 209.165.200.1:1 209.165.200.1:1 Total number of translations: 2 Questions: What was the inside local address of PC-B translated to? Type your answers here. What type of NAT address is the translated address? Type your answers here. From PC-A, ping the Lo1 interface ( 209.165.200.1 ) on R2. If the ping was unsuccessful, troubleshoot and correct the issues. On R1, display the NAT table on R1 with the command show ip nat translations. R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 209.165.200.227 192.168.1.2 --- --- --- 209.165.200.226 192.168.1.3 --- --- icmp 209.165.200.227:1 192.168.1.2:1 209.165.200.1:1 209.165.200.1:1 icmp 209.165.200.226:1 192.168.1.3:1 209.165.200.1:1 209.165.200.1:1 Total number of translations: 4 Notice that the previous translation for PC-B is still in the table. From S1, ping the Lo1 interface ( 209.165.200.1 ) on R2. If the ping was unsuccessful, troubleshoot and correct the issues. On R1, display the NAT table on R1 with the command show ip nat translations . © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 20 of 25

R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 209.165.200.227 192.168.1.2 --- --- --- 209.165.200.226 192.168.1.3 --- --- --- 209.165.200.228 192.168.1.11 --- --- icmp 209.165.200.226:1 192.168.1.3:1 209.165.200.1:1 209.165.200.1:1 icmp 209.165.200.228:0 192.168.1.11:0 209.165.200.1:0 209.165.200.1:0 Total number of translations: 5 Now try and ping R2 Lo1 from S2. This time, the translations fail, and you get these messages (or similar) on the R1 console: Sep 23 15:43:55.562: %IOSXE-6-PLATFORM: R0/0: cpp_cp: QFP:0.0 Thread:000 TS:00000001473688385900 %NAT-6-ADDR_ALLOC_FAILURE: Address allocation failed; pool 1 may be exhausted [2] This is an expected result, because only 3 addresses are allocated, and we tried to ping Lo1 from four devices. Recall that NAT is a one-to-one translation. So how long are the translations allocated? Issue the command show ip nat translations verbose and you will see that the answer is for 24 hours. R1# show ip nat translations verbose Pro Inside global Inside local Outside local Outside global --- 209.165.200.226 192.168.1.3 --- --- create: 09/23/19 15:35:27, use: 09/23/19 15:35:27, timeout: 23:56:42 Map-Id(In): 1 <output omitted> Given that the pool is limited to three addresses, NAT to a pool of addresses is not adequate for our application. Clear the NAT translations and statistics and we will move on to PAT. R1# clear ip nat translations * R1# clear ip nat statistics Close configuration window Configure and verify PAT for IPv4 In Part 3, you will configure replace NAT with PAT to a pool of addresses, and then with PAT using an interface. Remove the translation command on R1. Open configuration window The components of an Address Translation configuration are basically the same; something (an access-list) to identify addresses eligible to be translated, an optionally configured pool of addresses to translate them to, and the commands necessary to identify the inside and outside interfaces. From Part 1, our access-list (access-list 1) is still correct for the network scenario, so there is no need to recreate it. We are going to use the same pool of addresses, so there is no need to recreate that configuration either. Also, the inside and outside interfaces are not changing. To get started in Part 3, remove the command that ties the ACL and pool together. R1(config)# no ip nat inside source list 1 pool PUBLIC_ACCESS Add the PAT command on R1. Now, configure for PAT translation to a pool of addresses (remember, the ACL and Pool are already configured, so this is the only command we need to change from NAT to PAT). R1(config)# ip nat inside source list 1 pool PUBLIC_ACCESS overload © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 21 of 25

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

Test and Verify the configuration. Let’s verify PAT is working. From PC-B, ping the Lo1 interface (209.165.200.1) on R2. If the ping was unsuccessful, troubleshoot and correct the issues. On R1, display the NAT table on R1 with the command show ip nat translations. R1# show ip nat translations Pro Inside global Inside local Outside local Outside global icmp 209.165.200.226:1 192.168.1.3:1 209.165.200.1:1 209.165.200.1:1 Total number of translations: 1# Questions: What was the inside local address of PC-B translated to? The inside local address was translated to 209.165.200.226 Type your answers here. What type of NAT address is the translated address? Inside Global Type your answers here. What is different about the output of the show ip nat translations command from the NAT exercise? There is no dedicated translation between an inside and outside address listed. Type your answers here. From PC-A, ping the Lo1 interface (209.165.200.1) on R2. If the ping was unsuccessful, troubleshoot and correct the issues. On R1, display the NAT table on R1 with the command show ip nat translations. R1# show ip nat translations Pro Inside global Inside local Outside local Outside global icmp 209.165.200.226:1 192.168.1.2:1 209.165.200.1:1 209.165.200.1:1 Total number of translations: 1 Notice that there is only one translation again. Send the ping once more, and quickly go back to the router and issue the command show ip nat translations verbose and you will see what happened. As you can see, the translation timeout has been dropped from 24 hours to 1 minute. Generate traffic from multiple devices to observe PAT. On PC-A and PC-B, use the -t parameter with the ping command to send a non-stop ping to R2’s Lo1 interface ( ping -t 209.165.200.1 ), then go back to R1 and issue the show ip nat translations command: Notice that the inside global address is the same for both sessions. Question: How does the router keep track of what replies go where? Unique Port Numbers are assigned. Type your answers here. PAT to a pool is a very effective solution for small-to-midsize organizations. However, there are unused IPv4 addresses involved in this scenario. We will move to PAT with interface overload to eliminate this waste of IPv4 addresses. Stop the pings on PC-A and PC-B with the Control-C key combination, then clear translations and translation statistics: R1# clear ip nat translations * R1# clear ip nat statistics © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 22 of 25

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

On R1, remove the nat pool translation commands. Once again, our access-list (access-list 1) is still correct for the network scenario, so there is no need to recreate it. Also, the inside and outside interfaces are not changing. To get started with PAT to an interface, clean up the configuration by removing the NAT Pool and the command that ties the ACL and pool together. R1(config)# no ip nat inside source list 1 pool PUBLIC_ACCESS overload R1(config)# no ip nat inside source list 1 pool PUBLIC_ACCESS overload Add the PAT overload command by specifying the outside interface. Add the PAT command that will cause overload to the outside interface. R1(config)# ip nat inside source list 1 interface g0/0/0 overload Test and Verify the configuration. Let’s verify PAT to the interface is working. From PC-B, ping the Lo1 interface (209.165.200.1) on R2. If the ping was unsuccessful, troubleshoot and correct the issues. On R1, display the NAT table on R1 with the command show ip nat translations . R1# show ip nat translations Pro Inside global Inside local Outside local Outside global icmp 209.165.200.230:1 192.168.1.3:1 209.165.200.1:1 209.165.200.1:1 Total number of translations: 1 Generate traffic from multiple devices to observe PAT. On PC-A and PC-B, use the -t parameter with the ping command to send a non-stop ping to R2’s Lo1 interface (ping -t 209.165.200.1 ). On S1 and S2, issue the privileged exec command ping 209.165.200.1 repeat 2000. Then go back to R1 and issue the show ip nat translations command. R1# show ip nat translations Pro Inside global Inside local Outside local Outside global icmp 209.165.200.230:3 192.168.1.11:1 209.165.200.1:1 209.165.200.1:3 icmp 209.165.200.230:2 192.168.1.2:1 209.165.200.1:1 209.165.200.1:2 icmp 209.165.200.230:4 192.168.1.3:1 209.165.200.1:1 209.165.200.1:4 icmp 209.165.200.230:1 192.168.1.12:1 209.165.200.1:1 209.165.200.1:1 Total number of translations: 4 Now all the Inside Global addresses are mapped to the g0/0/0 interface IP address. Stop all the pings. On PC-A and PC-B, using the CTRL-C key combination. Close configuration window Configure and verify Static NAT for IPv4 In Part 4, you will configure static NAT so that PC-A is directly reachable from the internet. PC-A will be reachable from R2 via the address 209.165.200.229. Note : The configuration you are about to complete does not follow recommended practices for internet- connected gateways. This lab completely omits what would be standard security practices to focus on successful configuration of static NAT. In a production environment, careful coordination between the network infrastructure and security teams would be fundamental to supporting this requirement. On R1, clear current translations and statistics. Open configuration window R1# clear ip nat translations * R1# clear ip nat statistics © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 23 of 25

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

On R1, configure the NAT command required to statically map an inside address to an outside address. For this step, configure a static mapping between 192.168.1.11 and 209.165.200.1 using the following command: R1(config)# ip nat inside source static 192.168.1.2 209.165.200.229 Test and Verify the configuration. Let’s verify the Static NAT is working. On R1, display the NAT table on R1 with the command show ip nat translations , and you should see the static mapping. R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 209.165.200.229 192.168.1.2 --- --- Total number of translations: 1 The translation table shows the static translation is in effect. Verify this by pinging from R2 to 209.165.200.229. The pings should work. Note: you may have to disable the PC firewall for the pings to work. On R1, display the NAT table on R1 with the command show ip nat translations , and you should see the static mapping and the port-level translation for the inbound pings. R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 209.165.200.229 192.168.1.2 --- --- icmp 209.165.200.229:3 192.168.1.2:3 209.165.200.225:3 209.165.200.225:3 Total number of translations: 2 This validates that the Static NAT is working. Close con Deliverables: Post show run output for both routers below. DO NOT use screenshot, make it one long copy/paste for each router. © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 24 of 25

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

12. Router Interface Summary Table Router Model Ethernet Interface #1 Ethernet Interface #2 Serial Interface #1 Serial Interface #2 1800 Fast Ethernet 0/0 (F0/0) Fast Ethernet 0/1 (F0/1) Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1) 1900 Gigabit Ethernet 0/0 (G0/0) Gigabit Ethernet 0/1 (G0/1) Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1) 2801 Fast Ethernet 0/0 (F0/0) Fast Ethernet 0/1 (F0/1) Serial 0/1/0 (S0/1/0) Serial 0/1/1 (S0/1/1) 2811 Fast Ethernet 0/0 (F0/0) Fast Ethernet 0/1 (F0/1) Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1) 2900 Gigabit Ethernet 0/0 (G0/0) Gigabit Ethernet 0/1 (G0/1) Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1) 4221 Gigabit Ethernet 0/0/0 (G0/0/0) Gigabit Ethernet 0/0/1 (G0/0/1) Serial 0/1/0 (S0/1/0) Serial 0/1/1 (S0/1/1) 4300 Gigabit Ethernet 0/0/0 (G0/0/0) Gigabit Ethernet 0/0/1 (G0/0/1) Serial 0/1/0 (S0/1/0) Serial 0/1/1 (S0/1/1) Note : To find out how the router is configured, look at the interfaces to identify the type of router and how many interfaces the router has. There is no way to effectively list all the combinations of configurations for each router class. This table includes identifiers for the possible combinations of Ethernet and Serial interfaces in the device. The table does not include any other type of interface, even though a specific router may contain one. An example of this might be an ISDN BRI interface. The string in parenthesis is the legal abbreviation that can be used in Cisco IOS commands to represent the interface. © 2023 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 25 of 25

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

CSCO 220 Modules 3 & 6 Lab Packet-NAT

Related Documents