Static NAT question

[leowls]

I have been following a NAT tutorial and I have a simple to ask.

Assume there is only 1 IP 209.165.100.30 configured on g0/0and  we want to NAT the IP 209.165.100.29 to the HoneyPot server, where and how are we going to set the IP 209.165.100.29 at? Do I install a 2nd NIC on HoneyPot server and give it the 209.165.100.29 IP? 

company#conf t
company(config)#int g0/0
company(config-if)#ip nat out
company(config-if)#int g0/1
company(config-if)#ip nat inside
company(config-if)#
company(config)#ip nat inside source static 10.0.0.240 209.165.100.29

[luis_cordova]

Hi @leowls ,

No, since, after the translation of the IP, the border router announces that address as the origin of the messages sent by the server, even though it does not exist physically in any interface.

When the messages return to the frontier router, it translates the IP and sends the message to the corresponding private IP.

Remember to mark the correct answers as solved, because that helps other users with similar doubts.

Regards

[leowls]

Hi luis,

So  209.165.100.29 is not necessary to configured at any router interface since it is already included in /30 mask in g0/0 interface?

[luis_cordova · Accepted solution]

Hi @leowls ,

The network linking the routers YourRouter and Company has a /28 mask.

This mask is necessary for the types of NAT that ask for it.

As I understand by the image that you attach:

In the router Company you need 2 public IP addresses, one for the physical interface (209.165.100.30) and another to be able to do the static NAT (209.165.100.29).

In the router YourRouter you were assigned 8 public IP addresses(209.165.100.17-24), of which, you must use one for the physical interface and the others to be able to do the dynamic NAT.

As you can see, the public IP you will use for static NAT, and the public IPs that you will use for dynamic NAT, are not assigned to any physical interface, but are only used to translate private IPs.

Anyway, all those public IPs are part of the same network, so you need a mask that can include them, like the mask /28 in your case.

Remember to mark the correct answers as solved, because that helps other users with similar doubts.

Regards

[Jaderson Pessoa]

Hello,

You can create a second nic on your honey pot with this ip or create a port forward(nat) on Company router redirecting to your server

if i understood your doubt.

[paul driver]

Hello

Honeypot to me means to blackhole traffic however if my understanding is correct here you wish just to have a 1-to-1 static nat entry and if that’s the case than your config looks okay assuming  your inside global addressing range is indeed /28 and not /30 then 209.65.100 .29 will be available to use in that subnet.