NAT

[Sagar4]

What are the differences between static PAT and destination NAT?

[MHM Cisco World]

check

[Sagar4]

If I have to allow NAT translation only via a particular destination port for any local host to access outside network, can it be performed via PAT provided I have also configured NAT IP pool to make sure both destination ip address and port number doesn't match for multiple hosts?

[MHM Cisco World]

can I see the config ?

[Sagar4]

I don't have configuration. My doubt was if PAT can allow single public IP address to be used by multiple devices for NAT translation, can router also perform NAT translation only via a specific destination port number for all local host to access outside network?

[MHM Cisco World]

Check 

[Sagar4]

Can I get

mapping 

command for both static pat and destination NAT so as to differentiate between the two?

[MHM Cisco World]

check 

[paul driver · Accepted solution]

Hello

---

@Sagar4 wrote:

If I have to allow NAT translation only via a particular destination port for any local host to access outside network, can it be performed via PAT

Yes it possible by defining a extended access-list for you internal lan hosts to a specific public ip address & destination port using dynamic PAT

example1:

ip access-list extended LAN-HOSTS
 permit tcp 10.1.123.0 0.0.0.255 host 1.1.1.1 eq www

ip nat pool Public-IP 100.100.100.10 100.100.100.10 prefix-length 30 
ip nat inside source list TST pool Public-IP

---

@Sagar4 wrote:

also configured NAT IP pool to make sure both destination ip address and port number doesn't match for multiple hosts?

---

Similar to example 1 however you specify a nat pool with a range of public-ip addressing so you lan hosts to match upon.

example2:

ip access-list extended LAN-HOST
permit  tcp host 10.1.123.10 host 1.1.1.1 eq 80
permit  tcp host 10.1.123.11 host 1.1.1.1 eq 80
permit  tcp host 10.1.123.12 host 1.1.1.1 eq 80
permit  tcp host 10.1.123.13 host 1.1.1.1 eq 80
permit  tcp host 10.1.123.14 host 1.1.1.1 eq 80
etc....

ip nat pool Public-IP 100.100.100.10 100.100.100.20 prefix-length 30 type match-host
ip nat inside source list TST pool Public-IP

Using destination nat:
Could be used as when you wish for a specific public ip address to be reachable for your lan hosts via a internal ip address

Example 3:

ip nat outside source static 1.1.1.1 10.1.123.100  <  host 1.1.1.1 will be reachable at 10.1.123.100 internally

Or for a quick load balancing of an internal server:

Example 4:

10.1.123.10/24 (svr1)
10.1.123.11/24 (svr2)
10.1.123.12/24 (svr3)

access-list 1 permit 100,100.100.10

ip nat pool  inside-server 10.1.123.10 10.1.123.12 prefix-length 24 type rotary
ip nat inside destination 1 pool inside-server

[Sagar4]

Thanks Paul. And one more thing, destination NAT just means mapping is done for outside hosts and source NAT means mapping is done for local hosts. Correct me I'm wrong.

[paul driver]

Hello

---

@Sagar4 wrote:

Thanks Paul. And one more thing, destination NAT just means mapping is done for outside hosts and source NAT means mapping is done for local hosts. Correct me I'm wrong.

Its based on the destination traffic 

Dnat -  Destination address translation
Snat - Source address translation

The nat order of operation is different in domain nat (inside/outside)
Outside to Inside ( nat occurs first  then routing is performed)
Inside to Outside (routing occurs first then nat)

In the first Dnat example, when the traffic for sourced from 1.1.1.1 it enters on the outside interface, So the rtr will first translate it to an internal address in this case 10.1.123.100  then a route lookup is performed and traffic is forwarded, as such when any return traffic for that NAT'D address will be forwarded to the outside interface then translated back to its original address