CCNA NAT SIM Question 1

After establishing the access list dont u think we should write “Access-list 1 deny any” command and one more thing if i configure the interfaces Fa0/0 with nat inside and S0/0 with nat outsde command before configuring Access list and nat pool in that case will my configuration work????
Plz help if possible…..

Please remember that there is an implicit “deny any” at the end of each access list- this means that your access list will deny all traffic that fails to match any of your access list lines. So you don’t need to write “access-list 1 deny any”

You can configure the interfaces Fa0/0 and S0/0 before configuring access list and nat pool. It will work well!

In fact, you don’t need to configure interfaces Fa0/0 and S0/0 because our question said: “the appropriate interfaces have been configured for NAT inside and NAT outside”

i am confused plz help mee
If i changed the command

Weaver(config)#ip nat pool mypool 198.18.184.105 198.18.184.110 netmask 255.255.255.248
Changed below
Weaver(config)#ip nat pool mypool 198.18.184.105 198.18.184.105 netmask 255.255.255.248

Tell me it works or not and why

It still works well because we used “overload” keyword (PAT). All your outgoing packages will have a source ip address of 198.18.184.105 but with different port numbers. But you should do what the question requested

is it ok to use the prefix-length 29 option with the “ip nat pool ” command instead of the netmask option

thanks

Yes, you can use “prefix-length 29″ instead of “netmask 255.255.255.248″

i’m going to test on 29 & i can’t understand why we write

Weaver(config)#access-list 1 permit 192.168.100.16 0.0.0.15
NOT

Weaver(config)#access-list 1 permit 192.168.100.17 0.0.0.15
bec. the question is telling me that the inside local addresses 192.168.100.17 ????

you cant write Weaver(config)#access-list 1 permit 192.168.100.17 0.0.0.15

you have to write the network number in the access-list configuration

192.168.100.17′s network address is 192.168.100.16

i think we shoud add :” access-list 1 deny 192.168.100.31 0.0.0.0″ because “access-list 1 permit 192.168.100.16 0.0.0.0″ includes the address 192.168.100.31 but the question requests only the address from 192.168.100.17 to 192.168.100.30
is it right???

No, we don’t need to add an access list of 192.168.100.31 because it is the broadcast address of this subnetwork

Shouldn’t you add a copy running-config startup-config after the:
Weaver(config)#ip nat inside source list 1 pool mypool overload

as, no further configuration is needed?

We just need to use only one “copy running-config startup-config” command at the end of the process

Hi 9tut,

on p4s Q397 as Hamid mention above it was on exam but there is no answer,

the question is:

which subnet mask it will be appropriate for a network address range to be subneted on up to 8 lans, with each lans contaning 5 to 26 hosts

a: 0.0.0.244
b:255.255.255.252
c: 255.255.255.224

what i have worked out is answer C can you please give me a scond advice? many thanks for all you great support on this side.

thanks
toni

@toni: This question is not clear. But if we have to choose an answer, C is the best one!

can you apply access-list and then apply nat ,,, or both wat are ok ,,,
or apply nat pool then acl…..thanks

You can do either first!

hi 9tut,

” Overload ” command should not be used here as it is reserved for PAT only that use to assign multiple ip addresses into single ip.

as here is being asked to use the ” pool “, so we can just place the range of the pool as being told in the question.

like: ” ip nat inside source list 1 pool mypool ”

i guess it is enough to cover the whole question.

what you say? please answer as soon as possible as i have exams in coming days.

thanks

and for your question ,,, as far as i know ,,, just in case the pool got busier ,or can’t handle the traffic ,as the pool have 5 addresses ,, overload option will be efficient to set ,,
just trying to help ,,

Yes, we surely have to use “Overload” keyword because we have only 6 IP addresses for 30 hosts

hey 9tut,

I think madhav is correct.
access-list 1 permit 192.168.100.17 0.0.0.15

No, 192.168.100.16 is the network address, not 192.168.100.17

Please I have my exam tomorrow and i’m very confuse by this problem.
Are we obliged in the real exam to type : Weaver#, weaver(config), Weaver(config-if) as in the example that follow?

************************************************
e.g:
Weaver(config)#interface fa0/0
Weaver(config-if)#ip nat inside
Weaver(config-if)#exit
Weaver(config)#interface s0/0
Weaver(config-if)#ip nat outside
Weaver(config-if)#end

************************************************

or we can only type the command like this:

e-g:
interface fa0/0
ip nat inside
exit
interface s0/0
ip nat outside
end

***************************************************

Let me know if it can work in the real labs

Just type as your second part

Weaver(config)#ip nat inside source list 1 pool mypool overload

we have a nat pool ,we are doing dynamic nat so we don’t need ‘overload’,do we?

ı think we need ‘overload’ in nat overload/pat
ıf we use nat overload/pat the command line will be like this:

Weaver(config)#ip nat inside source list 1 interface s 0/0

plese help me someone

to yeliz: First if you don’t use overload can not be more than 6 users contacted to internet in the same time. The 7th one should wait until one connection is off. Overload means that you can use port number combined with ip address wich allows more connections to internet in the same time. Without overload is a one to one connection ( one inside connection to one global address)
About using s0/0 means that your inside global address will be only one ip which is the interface ip. The interface ip can be a diff. address than the addresses from pool. To get more connections to internet you should use overload too : #ip nat inside source list 1 interface s0/0 overload

thanks to cris. I see, but I want to ask some more
Can I use
Weaver(config)##ip nat inside source list 1 interface s0/0 overload
is ıt true for this question?
Or should I create nat pool and use this:
Weaver(config)#ip nat inside source list 1 pool mypool overload

You have to use “Weaver(config)#ip nat inside source list 1 pool mypool overload”, in which “mypool” is the pool you created in previous step (“ip nat pool mypool 198.18.184.105 198.18.184.110 netmask 255.255.255.248″)

can we use the “?” in the CLI in the real exam?

i sometimes forget the exact structure of the codes for NAT.

is okay to use it? are there any deductions when you use the “?” ?

thanks in advance

@PaoL0: Yes, you can. But may be you will lose some points for it, so try to remember the commands. Good luck in your exam!

i have a question here.

when you created the acess-list 1 why did you use this code?

“Weaver(config)#access-list 1 permit 192.168.100.16 0.0.0.15″

i noticed that you used “192.168.100.16″ where as in the example the starting ip address of the host is 192.168.100.17?

and why is the wildcard bits used here is 0.0.0.15?
my understanding on that is 16+15 (16 taken from the .16 of the first host) which will tell the router to permit ip’s starting from .16 upto .31?

am i getting it right??

We have to use network address in the “access-list” command, although the first host is 192.168.100.17 but its network address is 192.168.100.16.

You can quickly figure out what the wildcard is by reversing the bits from the subnet mask. In this case the subnet mask is /28, its last octet is 1111 0000 so we reverse it into 0000 1111 = 15

the easy way to find the reason for 0.0.0.15:
You can use:
255.255.255.255 – subnetmask
example:
255.255.255.255
-
255.255.255.240
——————————–
0 . 0. 0. 15
Am I right? :D

hi, in nat sim, will tab work? it very hard to remember . ..

@ ryan

hi, in nat sim, will tab work? it very hard to remember . ..

————————————————————————

Two of my batchmates took the exam 2 weeks ago. They say in some questions IOS help, the “?” thing and the “tab” work and in some places they are unavailable. So you would need to remember these commands. They are not very hard to learn.

Try this way:

To define a pool of inside global ip addresses try to say again and again:
Router(config)#ip nat pool prefix-length
OR
Router(config)#ip nat pool netmask

It will ALWAYS be a SIMPLE STANDARD access-list to allow inside local addresses for NAT and you know Standard ACL statement is simple enough:
Router(config)#access-list permit

The final statement for enabling the PAT using above pool and ACL:
Router(config)#ip nat inside source list pool overload
In English it becomes:
ip nat: I would like to nat
inside: from the inside of my network
source list 1: for the address permitted in source list 1
pool mypool: to the addresses defined in the pool named mypool
overload: and also overload

Router(config)# I would like to nat, from the INSIDE of my network, for the address permitted in SOURCE LIST 1, to the adress defined in POOL named mypool, and OVERLOAD as well

I myself had problems in remmebering this final nat command until I saw Jeremy Cioara describing the commmand “in English” like I mentioned above. I really like the way and used to apply command that way. Now I don’t even need the English translation.

Hope that helps.

HEY HEY HEY… READ MY POST NOW. The text editor removed all my greater than and less than symbols and the stuff between them. Replacing them with parentheses now…

————————————————————-

Two of my batch mates took the exam 2 weeks ago. They say in some questions IOS help the “?” thing and the “tab” works and in some places they are unavailable. So you would need to remember these commands. They are not very hard to learn.

Try this way:

To define a pool of inside global ip addresses try to say again and again:
Router(config)#ip nat pool (pool_name) (pool address range) prefix-length (number)
OR
Router(config)#ip nat pool (pool_name) (pool address range) netmask (subnet mask)

It will always be a SIMPLE access-list to allow inside local address and you know Standard ACL statement is simple enought:
Router(config)#access-list (1-99) permit (network address) (wildcard mask)

The final statement for enabling the PAT using above pool and ACL:
Router(config)#ip nat inside source list (ACL list number) pool (pool_name) overload
In English it becomes:
ip nat: I would like to nat
inside: from the inside of my network
source list 1: for the address permitted in access-list 1
pool mypool: to the address defined in in the pool named mypool
overload: and also overload

Router(config)# I would like to nat, from the inside of my network, for the address permitted in ACL 1, to the adress defined in pool named mypool, and overload as well

I myself had problems in remmebering this final nat command until I saw Jeremy Cioara describing the commmand “in English” like I mentioned above. I really like the way and used to apply command that way. Now I don’t even need the English translation.

Hope that helps.

and if you don’t have a pool of public address (a pool of inside global address) but instead have only 1 public IP, it would be configured on the edge serial interface say s0/0. In that case you don’t even need to define a pool.

After issuing “ip nat outside” command under s0/0 interface, go to global config prompt and type:
Router(config)# I would like to NAT, from the INSIDE of my network, for the address permitted in SOURCE LIST , to the address specified on INTERFACE , and OVERLOAD
Router(config)#ip nat inside source list private_pool_1 interface serial 0/0 overload

O MY GOD… Sorry sorry. Admins would be frowning over my multiple posts for same thing but it again removed my less than greater than symbols!

After issuing “ip nat outside” command under s0/0 interface, go to global config prompt and type:
Router(config)# I would like to NAT, from the INSIDE of my network, for the address permitted in SOURCE LIST (1-99 or name of ACL), to the address specified on INTERFACE (interface type) (interface number), and OVERLOAD
Router(config)#ip nat inside source list private_pool_1 interface serial 0/0 overload

Sorry 9tut. Will now remember that angled-brackets don’t work :-)

hi nayeem, posted mail..

rayan young.

Hey 9Tut…Just wanted to say thanks for the great website…..

hi all, got my exam tomorow… every one says that in the exam it will be only sims vtp, eigrp and ACL 2. so is there a chance this could be in the exam instead of one of the other sims???
Kind regards

i have exam in coming wed…plss suggest me some last moment tips and topics to prepare before the exam…..

i have exam in coming wed…plss suggest me some last moment tips and topics to prepare before the exam…..plss help me out

did any one try this sim on packet tracer?
i tried it and i can’t ping , i don’t know why.

i found my mistake, i didn’t add the static routes
sorry

@Samehesk
I am trying this with Packet tracer, added static routes as follows:
Weaver: ip route 0.0.0.0 0.0.0.0 Serial0/0/0
ISP: ip route 198.18.184.0 255.255.255.248 Serial0/0/0

My pings don’t work, no route back from ISP to Weaver :-(
Any pointers? — thanks

@darkhorse
just make a static default route on isp to serial s0/1
e.g
ip route 0.0.0.0 0.0.0.0 s0/1

Weaver(config)#access-list 1 permit 192.168.100.16 0.0.0.15

WHAT WILL HAPPEN IF I WRITE:
Weaver(config)#access-list 1 permit any

ANY PROBLEM?
IF I FORGOT TO CHANGE THE HOST NAME, WILL I LOOSE ALL THE MARK?

hi y’all. what if we were given only one IP Add by the isp……do we still use pool?

I don’t understand how could be different the IP of Weaver Router’s S0/0 (192.0.2.113) and the global adresses’ pool (198.18.184.105-109). How will be routed the data from the inside LAN to the ISP after the NAT-translation?
I think the outside interface of the router should be the part of the global adresses’ pool.

I am still trying the ping with no success. I look at the answer PT file, and it looks exactly the same, but I am still not able to ping. Any suggestions?