How to configure NAT/PAT on Cisco Router?

Question

As the above question, how do I configure NAT/PAT on a Cisco Router? I am currently using Packet Tracer for my topology and I have followed the Cisco instructions in its lab sheet provided but it just doesnt seem to work. In my topology I have:

- 2 Routers, 1 for my private network and 1 for my ISP (Private Router & ISP)
- Public Address as 200.0.0.0 /28
- fa0/0 of Private Router, I have my private network with a switch that is providing VLANs -
VLAN 10 192.168.2.0 /25
VLAN 20 192.168.2.128 /25
VLAN 30 192.168.3.0 /29
- VLAN 10 and VLAN 20 are DHCP configured from the Private Router
- VLAN 30 is statically IP configured with a server attached to it.

So what I need is my web server is to access the ISP and vice versa so a private and public address. My addressing schema is:

ISP se0/0/0 200.0.0.10 /30
Private Router se0/0/1 200.0.0.9 /30 & fa0/1 VLANs Default Gateway
Server - Public Address 200.0.0.13 - Private Address 192.168.3.13


I am able to ping from all VLANs to the Private router but anything on the other side of the router to the ISP it fails.


So according to the Cisco commands I followed I did the following:

ISP(config)#ip route 200.0.0.0 255.255.255.248 serial 0/0/0

Private Router(config)#ip route 0.0.0.0 0.0.0.0 200.0.0.10
Private Router(config)#router ospf 1
Private Router(config-router)#default-information originate

Private Router(config)#ip nat inside source static 192.168.3.13 200.0.0.13

Private Router(config)#interface serial 0/0/1
Private Router(config-if)#ip nat outside
Private Router(config-if)#interface fa0/1
Private Router(config-if)#ip nat inside



According to Cisco I should be able to ping my ISP router to my server inside my Private Network and vice versa but for me it fails everytime. I tried adding access list too but this also lead to unsuccessful ping. Can someone please help? I just cannot seem to get past final phase of the lab sheet. Any reply would be greatly appreciated. Thank you

Answer 1

You don't allow or deny in your command. It should come before the IP address. Access lists have a deny all rule at the end by default, so if you don't specify to allow the connection the deny all will be accepted as the rule

Answer 2

Cisco Router Pat

Answer 3

You need to specify the Private Router NAT address as the External IP of the router. It looks like you have specified the web server address?



Remove:

Private Router(config)#ip nat inside source static 192.168.3.13 200.0.0.13



Add:

Private Router(config)#ip nat inside source static 192.168.3.13 200.0.0.9



If you put the 'overload' command on the end, it should let you have all internal IP's NAT (officially PAT) to the outside (external address). Without overload/PAT you will use up your one NAT address allocation with just one session





Also, ping test by pinging the external addresses using the source command from the Private Router. This will eliminate your LAN... so:



Private Router#ping 200.0.0.13 source fa0/1