PAT or otherwise known as NAT overload, allows you to translate IP addresses in a many-to-one method.
In my previous post on Configuring Dynamic NAT we saw that we can NAT many-to-many  but this was limited by the amount of public addresses that you have available. In cases such as home ADSL, your ISP will only issue you with a single public IP address but you might have 2 or more devices that need to access the Internet at any given time. This is where PAT takes over and makes this all possible.

As with any NAT configuration we need to first define our inside and outside interfaces. In this example I’ll use FastEthernet 0/0 as my inside, and Serial 0 as my outside.

AOIP.ORG (config) # interface FastEthernet 0/0
AOIP.ORG (config-if) # ip nat inside
AOIP.ORG (config-if) # interface Serial 0
AOIP.ORG (config-if) # ip nat outside

The next step is to define which addresses in my inside network I want to allow to be translated. Let’s assume my inside IP address range is 10.0.1.0 /24

AOIP.ORG (config) # access-list 1 permit 10.0.1.0 0.0.0.255 (Using a standard access-list is the easiest way to achieve this)

Then I need to configure the address that will be used by my internal IP addresses for accessing the outside interface. This can be done in 2 ways.

Option 1:
If I only have 1 public IP address, which is the case with home ADSL, the router will already have that IP address allocated to it by your ISP. The only thing I can do is tell the router to share that address with my internal hosts.

AOIP.ORG (config) # ip nat inside source list 1 Serial 0 overload (This defines my access-list 1 as the source addresses, and tell them to be translated into the same IP address that is configured on Serial 0. The overload command tells the router that it needs to keep track of all the source and destination ports so the IP address can be used multiple times, overloaded)

Option 2:
If I have a second public IP address that I would like to use for Internet browsing, I can configure PAT for that IP address.

AOIP.ORG (config) # ip nat inside source list 1 192.168.1.1 overload (Same as the above command, but I’ve specifically told the router which IP address to translate my internal hosts into)

This option is fantastic if you have multiple public addresses and you want to segment your Internet browsing based on departments or geographic locations. For example
Marketing – 10.1.0.0 /24
Sales – 10.2.0.0 /24
Technical – 10.3.0.0 /24

I can have each of the above departments using their own public IP address, which will make log files easier to read when tracking Internet use and for troubleshooting connection errors.

access-list 2 permit 10.1.0.0 0.0.0.255
access-list 3 permit 10.2.0.0 0.0.0.255
access-list 4 permit 10.3.0.0 0.0.0.255
ip nat inside source list 2 192.168.1.2 overload
ip nat inside source list 3 192.168.1.3 overload
ip nat inside source list 4 192.168.1.4 overload

Related posts:

1. Configuring Dynamic NAT on Cisco Routers
2. Configuring Static NAT on Cisco Routers
3. Static NAT overloaded???

Static NAT is a one-to-one mapping. It allows us to translate a single IP address into a different single IP address. This is most commonly found when you have a server inside your DMZ that you would like to allow the outside world (The Internet) to connect to, such as E-mail servers, FTP servers and Web servers (if you’re hosting your own).

The first step in configuration static NAT, is to define which interfaces on your router are involved in the NAT process and then configuring your Cisco router to know which interface is on which side of the network. Your Cisco router needs to know which interface is the inside interface and which is the outside interface to allow the translation to take place.

For example purposes let’s assume that FastEthernet 0/0 is the inside interface, and Serial 0 is my outside.

AOIP.ORG > en
AOIP.ORG # conf t
AOIP.ORG (config)# interface FastEthernet 0/0
AOIP.ORG (config-if)# ip nat inside
AOIP.ORG (config-if)# interface Serial 0
AOIP.ORG (config-if)# ip nat outside

So we have just informed our Cisco router of the inside and the outside, the next step is to tell your Router how to translate and what to translate.

Let’s assume that I have a server in my DMZ that has an IP address of 10.0.1.1 and I have a public IP address of 192.168.1.1 (yes I know this a private range part of RFC 1918, but for example purposes, let’s assume it’s not).

AOIP.ORG (config)# ip nat inside source static 10.0.1.1 192.168.1.1

That’s it, your done. When your server 10.0.1.1 connects to anything on Serial 0 and beyond, the source IP address will be translated into 192.168.1.1. Similarly, when someone from the Internet connects to the IP address 192.168.1.1 it will be translated into a destination IP address of 10.0.1.1 and hence connect to our server in the DMZ (Access-list permitting).

Related posts:

1. Configuring PAT on Cisco Routers (NAT Overload)
2. Configuring Dynamic NAT on Cisco Routers
3. Static NAT overloaded???

There are 3 ways to configure NAT on a Cisco Router
1/ Static NAT
2/ Dynamic NAT
3/ NAT overload (PAT – Port Address translation)

Static NAT is a one-to-one mapping. This is usually only required when you have a server inside your network (ie: Webserver, FTP, E-mail) that needs to be accessed from the internet. Users on the internet will access a public IP address that you have statically and permanently linked to your servers internal IP address. Of course any time your internal server sends packet to the internet, it’s source IP address will be translated into a public IP address configured with static NAT.

Dynamic NAT is used for many-to-many mapping. This will allow all your internal computers to be translated into a pool of public IP addresses, however if you only have 10 public IP addresses available in the NAT pool, only 10 computers will be able to access the public network at a time. Each computer will consume one public address at a time which makes this very limited for public internet access. The main purpose for dynamic NAT is to fix overlap IP addresses often experienced after a merger or acquisition. Since all companies use RFC 1918 for internal addresses, it’s not uncommon for 2 companies to be using the exact same internal IP addresses. When a merger or acquisition takes place there are issues with the IP addresses conflicting. Dynamic NAT allows us to translate the internal IP addresses from company ‘A’ into something unique that company ‘B’ does not use, and similarly translate all the internal IP addresses in company ‘B’ into something unique that company ‘A’ does not use. In most cases the ‘public’ address that the two companies will be translated into, will be part of RFC 1918 and will be used purely to resolve IP address overlaps, and NOT internet access.

NAT overload, or otherwise known as PAT (Port Address Translation), allows us to create a many-to-one mapping. Every computer in your network will be translated into a single Public IP address. This allows us to save on public addresses but still allows each computer in our organisation to access the internet at the same time. PAT identifies each session based on the source port number used in the communication flow. Since each session uses a random source port number, each session in theory should have a different number which allows PAT to associate a session with the single public IP addresses been shared. In the occurrence of two computers randomly choosing the same source port number, PAT will translate the port number and keep a record of the original as well as the new translated port to maintain the session. PAT will not allow internet users to access your internal servers as there is no mapping from outside to inside. The maximum theoretical limit for sharing a single IP address is 64,513 however the practical limit is dependent on the router or firewall doing the PAT and is usually limited to no more than 4,000 sessions to a single IP address.

Related posts:

1. Configuring PAT on Cisco Routers (NAT Overload)
2. Configuring Dynamic NAT on Cisco Routers
3. Useable IP addresses in private networks

ISDN BRI (Basic Rate Interface) interfaces have 2 B-channels. By default when you create a connection using ISDN only one of these channels will dial. In order for us to use the additional B-channel we need to insert an additional command under our BRI interface (PPP Multilink)

Similarly ISDN PRI (Primary Rate Interface) interfaces have (23 B-Channels on T1, 30 B-Channels on E1) each of the channels on a PRI line run at 64kb/s and often we would like to use more than just one channel for our backup.

Although we can have all channels connect immediately when the ISDN becomes active; this results in all lines been billed by the PSTN. Instead we would rather have additional lines been brought up one at a time when the traffic demands it. We can achieve this by defining a load threshold that the line must be under before bringing up additional channels.

The load-threshold command is on a scale from 1 to 255 where 255 is equal to 100% utilisation.

AOIP.ORG(config)# interface bri 2/0
AOIP.ORG(config-if)# ppp multilink
AOIP.ORG(config-if)# dialer load-threshold 128 either

In the above example, I have set a threshold of 128 (50%) and this is based on traffic either inbound or outbound. In order to only monitor traffic inbound, replace ‘either’ with inbound. The same applied to outbound traffic.

NOTE: In order to use PPP multilink, both sides of the link need to be configured for its use.

Related posts:

1. ISDN Switch-type
2. Configuring Basic ISDN with Interesting Traffic
3. Creating Layer 2 and Layer 3 Ether Channels

Using floating static routing as a backup solution works on the following principle.

-          A dynamic routing protocol is running over your primary line

-          When the link fails, the routing updates will fail and the routing table will flush

-          A static route that uses the dial-up interface will become the best route

-          The backup interface will dial and traffic will continue to flow

-          When the primary line comes back up the dynamic routing protocol will fill the routing table, overwriting the floating static.

NOTE: Any type of dial-up interface may be used (modem / ISDN / 3G etc)

Based on the above it’s important to understand a few things about routing.

-          A router will look for a route with the longest match (most specific route wins).

-          If more than one identical route exists, the route with the LOWEST administration distance will be inserted into the routing table

So in order for us to configure floating static routes, we need 2 things configured.

-          A dynamic routing protocol MUST be configured for this solution

-          An identical static route must be created with an administrative distance higher than our routing protocol.

Example:

If I am running EIGRP as my routing protocol and it has learnt a route to network 192.168.1.0 /24 with an admin distance of 90 ( EIGRP has an administrative distance of 90 by default). I must create a static route for the network 192.168.1.0 /24 with a next hop of my remote routers dial-up interface. A static route however has a default administrative distance of 1, which at this point would mean it would overwrite my dynamically learnt route and all my traffic would be sent over my dial-up interface leaving me with a rather large phone bill. So when I create my static route it’s imperative that I change the default administrative distance to something higher than that of my routing protocol – I suggest a value of 250.

My static route would look like this:

AOIP.ORG(config)# ip route 192.168.1.0 255.255.255.0 10.0.1.1 200

Destination network : 192.168.1.0

Subnetmask for destination : 255.255.255.0

Next hop address of the remote routers dial-up interface: 10.0.1.1

Administrative Distance : 200

Related posts:

1. Static Routing
2. Cisco Administrative Distance
3. ISDN and Multilink with load-threshold

For example: If I define an access-list that allows telnet and denies everything else, then telnet is the only traffic that will cause my ISDN interface to dial the remote router. Once the line has connected, ANY traffic may flow over the ISDN line. The router is looking purely for ‘interesting traffic’ so if no telnet traffic is sent over the line for the idle-timeout value, the line will drop.

This type of installation of ISDN is fantastic for very small branch offices that do not need to be connected to HQ permanently and you only need the link to be established for short periods of time. This however is not a good link backup solution.

In the below configuration we have created an access-list that will allow telnet traffic to cause the link to be established.

AOIP.ORG(config)# access-list 102 permit tcp any any eq telnet

Create the Access-list to be used to specify interesting traffic

AOIP.ORG(config)# dialer-list 2 protocol ip list 102    

The dialer-list defines what traffic is interesting, in this case – Access list 102

AOIP.ORG(config)# isdn switch-type basic-net3

Define the switch-type needed for ISDN, This is the settings for BRI interfaces in Europe and Africa

AOIP.ORG(config)# int bri 2/0

Enter the BRI interface you wish to configure

AOIP.ORG(config-if)# ip address 10.0.1.1

Set an IP address on the ISDN interface

AOIP.ORG(config-if)# encapsulation ppp

Define PPP as the encapsulation method

AOIP.ORG(config-if)# ppp authentication chap

Authentication for PPP has been set to CHAP

AOIP.ORG(config-if)# dialer-group 2

This tells our ISDN interface to use Dialer-list 2, you will notice the numbers for ‘dialer-group’ and ‘dialer-list’ match

AOIP.ORG(config-if)# dialer idle-timeout 180

If no interesting traffic is sent for 180 seconds, the line will drop

AOIP.ORG(config-if)# dialer map ip 10.0.1.2 name Router2 5551234  

If you need to connect to the IP address 10.0.1.2 (The remote routers ISDN interface), The remote router is name “Router2” and the telephone number to dial is “5551234”

AOIP.ORG(config-if)# no shut

AOIP.ORG(config)# ip route 192.168.2.0 255.255.255.0 10.0.1.2

Create a static route for the remote subnet with a next hop of Router2’s ISDN interface.

AOIP.ORG(config)# username Router2 password aoip

The remote routers hostname and a password that will be used for PPP authentication

Related posts:

1. ISDN and Multilink with load-threshold
2. ISDN Switch-type
3. Floating Static Routes

The switch-type is very much country dependant so it’s also important to memorize the switch-type that applies to where you do most of your installations.

If Layer-1 is showing ‘Deactivated’ when using the show isdn status command, only 3 things can be the source of the problem.

1/ isdn switch-type has not been set, or has not been set correctly (The most common problem)

2/ There is a problem with the PSTN (call your telephony service provider)

3/ Cable problems

4/ Physical port failure on the Router.

In order to configure the switch-type you can enter the command

Isdn switch-type {switch-type}

This can be done either in global configuration mode, or on the interface depending on the router and IOS version.

Below are all the switch-type options available 

Related posts:

1. Configuring Basic ISDN with Interesting Traffic
2. ISDN and Multilink with load-threshold
3. Floating Static Routes

Had I been running PPP as my authentication instead of HDLC, I could have used commands such as ‘debug ppp negotiation’ and ‘debug ppp authentication’ These would have showed me if any traffic was been passed between the two devices and would have proven if it was a configuration problem or a line issue.

In order to configure PPP, both router have to have ‘encapsulation ppp’ configured under the interface, and additionally you can then configure ‘ppp authentication type’ type is often set to chap (Challenge Handshake Authentication Protocol) which allows for hashing of the passwords rather than sending the password in clear text.

In the below live demo, I have demonstrated how to configure R1 and R2 Cisco routers to use PPP encapsulation. (below is the network diagram used for the Configuration and the Live demo)

The full configuration and explanation for the configuration is as follows:

AOIP.ORG# R2

(telnet into router R2 – I have already configured ip host for R2 so there was no need to type telnet 2.2.2.2)

R2> en

R2# conf t

R2(config)# username R1 password aoip

(for PPP to authenticate with the remote router, they need to exchange usernames and passwords. The username is the hostname of the remote router, and the passwords need to be configured the same on both sides)

R2(config)# interface s1/0

(enter the interface that we wish to configure PPP on)

R2(config-if)# encapsulation ppp

(enable PPP encapsulation, my session drops at this point since my telnet into R2 is via this interface, and since R1 has not been configured for PPP yet, the line has dropped. To break out of this telnet session I can press ‘<Ctrl>+<Shift>+6 then x’ This will take me back to AOIP.ORG#)

AOIP.ORG# R1

(telnet into R1 – I have already configured ip host for R1 so there was no need to type telnet 1.1.1.1)

R1> en

R1# ping 2.2.2.2

(this confirms my line has dropped and I cannot ping R2)

R1# conf t

R1(config#) username R2 password aoip

(As before with R2, the username is the hostname of the remote router, and the passwords have been configured the same on both sides)

R1(config)# interface s1/0

R1(config-if)# encapsulation ppp

R1(config-if)# exit

R1(config)# exit

R1# ping 2.2.2.2

(ping is now successful since our line is now configured on both sides for PPP)

R1# exit

(takes me back to AOIP.ORG)

AOIP.ORG# <enter>

(resumes my session with R2 that I had to break out of earlier)

R2(config-if)#

(connection to R2 resumes, proving the line is operational again)

Related posts:

1. Configuring Basic ISDN with Interesting Traffic
2. Configuring VTY Access
3. ‘Login local’ on a Cisco Router

In order to understand clock rate we first need to understand how the cabling works on routers. When connecting two routers together with a serial cable, one of the routers needs to host the DCE (Data Communications Equipment) side of the cable, and the other will host the DTE (Date Terminal Equipment) side. Most serial cables are marked on the connector if it’s the DTE or DCE.

So what’s the difference between the 2 sides? The DCE side of the cable is the side that sets the speed of the link (also known as clocking). Based on this, it’s safe to assume that the cable coming out of your router and going to your service provider is the DTE side, since you service provider sets the speed of the line based on the subscription you have purchased. The DTE side of the cable is where the communications terminate ie: your router terminates the connection from the service provider.

From a configuration point of view the DCE side of the cable is able to use the clock rate command to set the speed of the line. If the command is not used the interface will run at the maximum speed supported by the interface. If you have only subscribed for a 64k line, then the clock rate would have been set on the DCE side of the cable using the command ‘clock rate 64000’ under the interface.

AOIP.ORG# conf t

AOIP.ORG(config)# interface serial 1/0

AOIP.ORG(config-if)# clock rate 64000 (represented in BITS per second)

If you try use the clock rate command on the DTE interface you will receive the following error message “This command applies only to DCE interfaces”

To identify which end of the cable has been plugged into a Cisco router, you can also use the command “show controller” – see below diagram.

Cisco Show Controller Command

The bandwidth command however does not adjust the speed of the line at all, however it should be configured on ALL DTE and DCE interfaces because it is used by;

1/ Routing protocols – to calculate the cost of a path

2/ QOS (Quality of Service) – to identify how much bandwidth is availble to prioritize,

If no bandwidth command has been configured on the interface, Routing protocols and QOS will assume the line is running at the maximum speed supported by the interface which can result in incorrect routing and incorrect prioritization of packets.

The bandwidth command is issued under the interface, as is represented in Kilobits per second

AOIP.ORG# conf t

AOIP.ORG(config)# interface serial 1/0

AOIP.ORG(config-if)# bandwidth 64 (represented in kilobits per second)

Related posts:

1. Interface Status
2. Configuring EIGRP on a Cisco Router
3. Cisco Administrative Distance