There are 3 ways to configure NAT on a Cisco Router
1/ Static NAT
2/ Dynamic NAT
3/ NAT overload (PAT – Port Address translation)

Static NAT is a one-to-one mapping. This is usually only required when you have a server inside your network (ie: Webserver, FTP, E-mail) that needs to be accessed from the internet. Users on the internet will access a public IP address that you have statically and permanently linked to your servers internal IP address. Of course any time your internal server sends packet to the internet, it’s source IP address will be translated into a public IP address configured with static NAT.

Dynamic NAT is used for many-to-many mapping. This will allow all your internal computers to be translated into a pool of public IP addresses, however if you only have 10 public IP addresses available in the NAT pool, only 10 computers will be able to access the public network at a time. Each computer will consume one public address at a time which makes this very limited for public internet access. The main purpose for dynamic NAT is to fix overlap IP addresses often experienced after a merger or acquisition. Since all companies use RFC 1918 for internal addresses, it’s not uncommon for 2 companies to be using the exact same internal IP addresses. When a merger or acquisition takes place there are issues with the IP addresses conflicting. Dynamic NAT allows us to translate the internal IP addresses from company ‘A’ into something unique that company ‘B’ does not use, and similarly translate all the internal IP addresses in company ‘B’ into something unique that company ‘A’ does not use. In most cases the ‘public’ address that the two companies will be translated into, will be part of RFC 1918 and will be used purely to resolve IP address overlaps, and NOT internet access.

NAT overload, or otherwise known as PAT (Port Address Translation), allows us to create a many-to-one mapping. Every computer in your network will be translated into a single Public IP address. This allows us to save on public addresses but still allows each computer in our organisation to access the internet at the same time. PAT identifies each session based on the source port number used in the communication flow. Since each session uses a random source port number, each session in theory should have a different number which allows PAT to associate a session with the single public IP addresses been shared. In the occurrence of two computers randomly choosing the same source port number, PAT will translate the port number and keep a record of the original as well as the new translated port to maintain the session. PAT will not allow internet users to access your internal servers as there is no mapping from outside to inside. The maximum theoretical limit for sharing a single IP address is 64,513 however the practical limit is dependent on the router or firewall doing the PAT and is usually limited to no more than 4,000 sessions to a single IP address.

Related posts:

1. Configuring PAT on Cisco Routers (NAT Overload)
2. Configuring Dynamic NAT on Cisco Routers
3. Useable IP addresses in private networks

Syslog messages allow us to track system error messages, exceptions, and other information, such as device configuration changes.

It allows for historical reporting, depending on the application keeping the logs, as well as help in fault finding.

Cisco devices support 8 levels of logging information from Facility level 0 through 7

To enable Syslog 2 things are required

                1/ Configuration on the device to send Syslog messages

                2/ An application that will receive the messages and store them in a database.

In the below live demo, you will see my putty screen with my telnet session into my router, and behind it you will see my Syslog application. There are many of these products on the market, each with its own pro’s and con’s, so use whatever you prefer. In my Live demo I am using an application called  ‘Syslog Watcher Personal Edition’, it’s a very easy to use application and is freeware. You will notice after I configured logging on the router, the log messages appear in my application.

The command breakdown for the live demo is as follows

AOIP.ORG# conf t

AOIP.ORG(config)# logging 192.168.1.1

This instructs the router to send Syslog messages to my application hosted on a machine with the IP 192.168.1.1

AOIP.ORG(config)# logging trap info

I have chosen to have level 6 messages sent to my application.

Additionally you could have used the ‘service timestamps log datetime localtime’ command to force the time on the logs.

If you still do not see any log messages after using the above commands, make sure that logging has not been disabled on the device. To force logging on a Cisco device use the ‘logging on’ command.

Related posts:

1. Cisco Router Login Lockdown
2. Configuring PAT on Cisco Routers (NAT Overload)
3. Configuring the Console port on a Cisco Device

DHCP also removes the administration burden of having to manage all the IP addresses issued to computers statically, and allows for computers to join a network quickly even if the end user has limited knowledge of networking since most computers have a default configuration on the network card and wireless network card to obtain an IP address automatically via DHCP.

Configuring DHCP on a Cisco router is a simple task and although the live demo at the end of this article shows some of the more detailed commands, the minimum commands to configure DHCP are:

AOIP.ORG(config)# ip dhcp pool aoip

{A pool is a collection of IP addresses you wish to issue dynamically, and ‘aoip’ is any name you wish to assign to your DHCP pool}

AOIP.ORG(dhcp-config)# network 192.168.2.0 255.255.255.0

{These are the IP addresses you wish to add to the pool. Instead of using the full SubnetMask value I could have used /24 instead}

AOIP.ORG(dhcp-config)# default-router 192.168.2.1

{This is the IP address that will be issued to the client computers to use as their default gateway, which will be this router}

In the live demo below, I have added a few extra commands to the configuration;

AOIP.ORG(dhcp-config)# option 150 ip 192.168.2.10

{option 150 issues a TFTP address to the clients for use in IP telephony. This would be the IP address of the TFTP server running on a Cisco Unified Communications Manager (CUCM)}

AOIP.ORG(dhcp-config)# dns-server 192.168.2.2 192.168.2.3

{In order to resolve Host names to IP addresses, client computers require the IP addresses of your DNS (Domain Name Service) servers. I have defined two for fault tolerant purposes}

AOIP.ORG(dhcp-config)# domain-name AOIP.ORG

{Issues the domain name to the clients}

AOIP.ORG(dhcp-config)# netbios-name-server 192.168.2.4 192.168.2.5

{If you are using a WINS (Windows Internet Naming Service) server on your network, you can use DHCP to issue the address to the client computers. As with DNS, I have issued 2 addresses for fault tolerant purposes}

AOIP.ORG(dhcp-config)# lease 8

{The default duration that a client computer will be allowed to use the IP address before they have to request another one, is one day. You can use the lease command to change this and in my example I have changed it to 8 days. You can define days, hours and minutes – lease 8 0 0 is 8 days, 0 hours, 0 minutes)

AOIP.ORG(dhcp-config)# exit

AOIP.ORG(config)# ip dhcp excluded-address 192.168.2.1 192.168.2.10

{To prevent DHCP issuing an IP address that is already in use by one of my servers, I have created an exclusion range from 192.168.2.1 – 192.168.2.10. This would result in the first client receiving the IP address 192.168.2.11}

Related posts:

1. Configuring RIP on a Cisco Router
2. Configuring EIGRP on a Cisco Router
3. Configuring OSPF on a Cisco Router

Once defined you can now connect to each device on your network via telnet by just using the host name you have defined and linked to an IP address.

Below is a live demo showing the configuration of three routers with the ‘ip host’ command.

Related posts:

1. IP Domain-Lookup
2. Configuring DHCP on a Cisco router
3. Configuring PPP Encapsulation

This feature can be disabled quickly and it’s one of the first commands I will put onto a router when first configuring it.

Below is a live demo demonstrating the problem, and the fix with the command ‘no ip domain-lookup’

Related posts:

1. The “do” command
2. Configuring DHCP on a Cisco router
3. IP Host

By NO means, is this a “Welcome” message, this should state your companies access rights policy and who should and should not be allowed to access the device. There are a few option available for configuring a message on a Cisco device all of which fall under the command ‘banner’. In the live demo below I have shown an example of configuring a MOTD (message of the day), that will be displayed when you connect to the router or switch.

From global configuration mode, you can enter the command ‘banner’ if you were to put a ‘?’ afterwards, you will see all the banner types supported, including ‘motd’. When configuring any banner, you need to select a delimiting character to mark the start and end of the banner. In most cases I recommend using the ‘#’ symbol. This allows us to enter the command ‘banner motd # <enter>’ which puts us into a banner menu. You can then type or paste any message that you would like to appear, pressing <enter> again will move you to a new line, and the device will only stop gathering you text once you submit another ‘#’ to mark the ending of the message.

Related posts:

1. Configuring VTY Access
2. Setting the enable password and secret on a Cisco device
3. Navigating a Cisco device

When I started working on larger scale enterprise networks, I became very frustrated that I could not find what I was looking for quickly. It was only then that I re-looked at this command and it made me far more efficient at my job. I often work on Cisco devices that over 3000 lines of configuration, so doing a standard ‘sh run’ just isn’t an option.

The pipe command can be used with any ‘show’ command. In the live demo below, I have demonstrated how it can be used with the ‘show run’ command. In order to use the pipe we need to first look at the syntax required for it and options it supports. The most common values for the pipe are ‘include’ ‘begin’ ‘exclude’. These enable us to use the ‘show’ command and have the device only display lines in the output that include a value, exclude a value, or display everything from the beginning of a value.

In the below demo I started by using the ‘sh run | in interface’ I have used the shortened version of the commands so the full command would have been “show running-config | include interface’ This has instructed the device to display only lines in the running-config that have the word ‘interface’

My second command is ‘sh run | in serial’ which will show me all lines in the configuration that have the word ‘serial’ in them. You will notice that I have used the same command again, but used ‘sh run | in Serial’ with a uppercase ‘S’ to illustrate that the command is case SeNsItIvE and you will notice the results are very different.

Lastly, I have demonstrated the ‘exclude’ command by issuing ‘sh run | ex interface’ to the device, and you will notice the entire running-config was displayed but every line that had the word ‘interface’ has been removed.

Related posts:

1. The “do” command
2. Interface Status
3. Configuring an IP address on a Cisco Device

By default, Cisco only allows you to do a ‘show’ command when you are in privileged mode (AOIP.ORG#). This can be frustrating when you are multiple levels deep and just want to see something quickly and don’t want to exit all the way back to the first level to use the ‘show’ command and then get back to the level you were in. Luckily, Cisco introduced the ‘do’ command which can be run from any level of the command line.

For example, if I have just configured an IP address on an interface and no shut the interface, the router would not allow me to type “show ip interface brief” from the interface level, however from the interface level I would be able to type “do show ip interface brief”. This would allow me to remain in interface level, have a quick look to see if my interface has gone “up up” and continue with my configuration.

Below is a live demo of trying to do the “show run” command from global configuration mode. You will see I receive an error when trying to use the ‘show’ command from this level, but with ‘do show run’ the command works.

Related posts:

1. Using the Pipe ‘|’ command
2. Configuring an IP address on a Cisco Device
3. Navigating a Cisco device

The router by default does not care which physical interface your telnet session is coming from, and hence the Telnet lines are Virtual.

A Router by default has 5 VTY lines, numbered from 0-4. We are able to configure a different password on each line, however the router randomly selects one of the VTY lines for use when a telnet session is initiated, because of this random selection, it makes no sense to have different password on each VTY, so when configuring the lines, we will choose the same password for all 5 lines.

To configure the VTY lines, we need to be in Global Configuration mode, then type the command ‘line vty 0 4′ – this tells the router we wish to connect to the VTY lines, from 0 – 4 (all 5 at the same time). We then can issue the ‘password password’ to set the password on the lines.  We then need to issue the ‘login’ command which informs the router to do password checking when someone tries to telnet into the router. Lastly, don’t forget to save your config.

Below is the live demonstration video on how to configure the VTY passwords.

Related posts:

1. Restricting access to VTY (Virtual Terminal Lines)
2. Configuring the Console port on a Cisco Device
3. Setting the enable password and secret on a Cisco device

Class A

10.0.0.1 – 10.255.255.254

Class B

172.16.0.1 – 172.31.255.254

Class C

192.168.0.1 – 192.168.255.254

The IP addresses above are allowed to be used inside your private networks, whether this for home use or company use, may NOT appear on the internet. Since everyone on the planet uses the above guidelines, you can imagine that more than one person has the IP address 10.0.0.1, and if this was to ‘appear’ on the internet, there would be multiple conflicts.

For example, at my house I am using the IP address range of 10.0.0.1 – 10.0.0.254 for all my computers and networking devices. However in order for me to surf the web from my house, something has to translate my internal IP addresses, to a single Public IP address (that my Internet Service Provider gives me). This process is known as NAT (Network Address Translation) and is usually performed by a Router, in my case it’s my ADSL router that connects to my phone line. The other major advantage of running this system, is that my house only uses one public IP address, even though I may have hundreds or thousands of devices that use internal IP addresses. If you think about this from a company perspective, which might have tens of thousands of devices with internal IP addresses, they only need one IP address for internet access, and hence the ISP’s only have to issue and administer a single IP address for a large organisation.

Related posts:

1. NAT (Network Address Translation)
2. Class-full IP Addresses
3. What is an IP address