My PAT(NAT overload) is not working

[Zaks]

Current configuration : 1587 bytes

!

! Last configuration change at 14:42:17 UTC Wed Feb 2 2022 by admin

!

version 15.0

service timestamps debug datetime msec

service timestamps log datetime msec

service password-encryption

!

hostname Router-01

!

boot-start-marker

boot-end-marker

!

enable password 7 0822455D0A16

!

no aaa new-model

!

!

!

!

no ipv6 cef

ip source-route

ip cef

!

!

!

!

ip domain name HotelSpoorzicht.local

!

multilink bundle-name authenticated

!

!

username admin password 7 030752180500

!

redundancy

!

!

ip ssh version 2

!

interface GigabitEthernet0/0

no ip address

ip nat inside

ip virtual-reassembly

duplex auto

speed auto

!

!

interface GigabitEthernet0/0.20

encapsulation dot1Q 20

ip address 10.10.20.1 255.255.255.0

!

interface GigabitEthernet0/0.30

encapsulation dot1Q 30

ip address 10.10.30.1 255.255.255.0

!

interface GigabitEthernet0/0.40

encapsulation dot1Q 40

ip address 10.10.40.1 255.255.255.0

!

interface GigabitEthernet0/0.50

encapsulation dot1Q 50

ip address 10.10.50.1 255.255.255.240

!

interface GigabitEthernet0/1

ip address dhcp

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

!

!

ip forward-protocol nd

!

no ip http server

no ip http secure-server

!

ip nat inside source list 10 interface GigabitEthernet0/1 overload

!

access-list 10 permit 10.0.0.0 0.255.255.255

!

control-plane

!

!

!

line con 0

exec-timeout 0 0

password 7 00071A150754

logging synchronous

login

line aux 0

line vty 0 4

exec-timeout 0 0

login local

transport input ssh

!

scheduler allocate 20000 1000

end

[Flavio Miranda]

Hi

NAT with DHCP.  Can´t you put an IP address there?  Dont think is going to work.

interface GigabitEthernet0/1

ip address dhcp

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

[Zaks]

Hi Flavio!

The GigabitEthernet0/1 is my link to the WAN(Internet) so if I do not use a
DHCP I won't be able to get an IP address from the WAN side.

[Flavio Miranda]

Got it.

  You should have a route on the router like this:

0.0.0.0 0.0.0.0  >> ISP

Considering  you dont know your gateway IP address, then, try to put interface GigabitEthernet0/1

[Zaks]

I tried to do that at first, but for some reason I when i did

 show IP route

, I show that a static default route was configured with the next hop as the WAN IP address but I tried configuring one manually but that did not help as well.

[Zaks]

The GigabitEthernet0/1 is my link to the WAN(Internet) so if I do not use a DHCP I won't be able to get an IP address from the WAN side.

[Georg Pauwen · Accepted solution]

Hello,

add the lines marked in bold to your configuration:

Current configuration : 1587 bytes
!
! Last configuration change at 14:42:17 UTC Wed Feb 2 2022 by admin
!
version 15.0
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Router-01
!
boot-start-marker
boot-end-marker
!
enable password 7 0822455D0A16
!
no aaa new-model
!
no ipv6 cef
ip source-route
ip cef
!
ip domain name HotelSpoorzicht.local
!
multilink bundle-name authenticated
!
username admin password 7 030752180500
!
redundancy
!
ip ssh version 2
!
interface GigabitEthernet0/0
no ip address
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 10.10.20.1 255.255.255.0
--> ip nat inside
!
interface GigabitEthernet0/0.30
encapsulation dot1Q 30
ip address 10.10.30.1 255.255.255.0
--> ip nat inside
!
interface GigabitEthernet0/0.40
encapsulation dot1Q 40
ip address 10.10.40.1 255.255.255.0
--> ip nat inside
!
interface GigabitEthernet0/0.50
encapsulation dot1Q 50
ip address 10.10.50.1 255.255.255.240
--> ip nat inside
!
interface GigabitEthernet0/1
ip address dhcp
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip nat inside source list 10 interface GigabitEthernet0/1 overload
!
--> ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 dhcp
!
access-list 10 permit 10.0.0.0 0.255.255.255
!
control-plane
!
line con 0
exec-timeout 0 0
password 7 00071A150754
logging synchronous
login
line aux 0
line vty 0 4
exec-timeout 0 0
login local
transport input ssh
!
scheduler allocate 20000 1000
end

[Zaks]

Hi,

Thank you for your message but I would like to know why I have to add those lines.

Thanks anyways

[Georg Pauwen]

Hello,

the title of your post is:

--> My PAT(NAT overload) is not working

These lines are basic NAT configuration. The router needs to know what the inside NAT enabled interface are.

[paul driver]

Hello

---

@Zaks wrote:

Thank you for your message but I would like to know why I have to add those lines.

ip nat inside =  this specifys the inside nat domains (interfaces -real ip subnets) that you wish to be translated
ip nat outside =  this specifys the outside nat domains (public facing interfaces) which outside hosts will connect to
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 dhcp= is required to route any non local destination traffic via the public wan interface.

When translation occurs inside > outside then local inside real ip address will be translated to the public routable outside interface ip address,

The rtr will perform a route lookup and see the destination address of the traffic is via the wan (outside) interface, as traffic is routed towards the outside interface (via the default static route) a network translation will be performed real ip address <> translated ip address

Any outside hosts receiving traffic from your router will see the source ip originating from your rtrs outside interface so any return traffic will have a destination address of your public wan ip address

For the return traffic as it arrives at your router, the router will see it has a translation entry for that destination port/address, it will perform the translation from public ip address into the real ip address of your inside host and then perform a route lookup to forward that traffic onwards to real ip address/port of the inside host.