Dynamic NAT Configuration in Cisco

Generally, the border router is configured for NAT i.e., the router which has one interface in the local (inside) network and one interface in the global (outside) network. When a packet traverse outside the local (inside) network, then NAT converts that local (private) IP address to a global (public) IP address. When a packet enters the local network, the global (public) IP address is converted to a local (private) IP address. As you must be aware that NAT translates the Private IP addresses used inside an Enterprise network into Public IP addresses.

Here are the 4 main terms related to NAT: 

• Inside Local: It is a region inside the Enterprise’s network where the hosts have Private IP addresses.
• Inside Global: It is also a region inside the Enterprise network, but Public IP addresses are used in this region (this region is usually connected to the outside network or Internet).
• Outside Local: It is a region that is generally part of the Enterprise network but in a public Internet (or outside the Enterprise Network). The hosts Outside the Local region have private IP addresses.
• Outside Global: It is a part of the Enterprise network in a public Internet where Public IP addresses is used. 

Range of Private IP addresses	Class of IP addresses	No. of Networks
10.0.0.0 to 10.255.255.255	A	1
172.16.0.0 to 172.31.255.255	B	16
192.168.0.0 to 192.168.255.255	C	256

These Private IP addresses cannot be advertised on the Internet using any routing protocol.

Dynamic NAT: 

In Dynamic NAT, IP addresses are dynamically mapped to each other on a one-to-one basis as per the needs. It establishes a mapping between an Inside Local IP address and a pool of Global IP addresses. This type of translation is very useful when there are multiple users in a private network that access the Internet. These Dynamic NAT Translations stay in the translation table until there is traffic flowing from the Local IP address to Global IP address or until the timeout time (24 hours by default) has expired.

Configuration:

Step 1: Configure the interface in the Inside Global as 

ip nat outside

Step 2: Configure the interface in the Inside Local as

 ip nat inside

Step 3: Create a pool of Global IP addresses: 

Router(config)#ip nat pool <pool-name> 
<starting-IP> <ending-IP> prefix-length <prefix-length>

Step 4: Create an access list to permit a certain network of IP addresses: 

Router(config)#access-list <acl-number> 
permit <source-ip-network> <wildcard-mask>

Step 5: Lastly, enable Dynamic NAT by using the command:

Router(config)#ip nat inside source 
list <acl-number> pool <pool-name>

R1(config)#int f0/0
R1(config-if)#ip nat outside
R1(config-if)#exit
R1(config)#int f1/0
R1(config-if)#ip nat inside
R1(config-if)#exit
R1(config)#ip nat pool pool1 20.1.1.5 20.1.1.20 netmask 255.255.255.0
R1(config)#access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)#ip nat inside source list 1 pool pool1  

Now, to verify the NAT translations (to show the translations done by NAT):

R1#show ip nat translations