NAT Overload

In this post i'll configure NAT Overload (PAT) on my Cisco router.

NAT is primarily used for the following purposes.

• To efficiently utilise public IP addresses and slow the depletion of IP version 4 addresses.
• To help mask the internal IP address ranges from external sources.
  
• To aid in the merge of similiarly addressed networks.
  

NAT can either be used in a one to many configuration (PAT), or a one to one configuration (Static or Dynamic). Here I'll cover NAT Overload.


When used in a one to many configuration the router uses the port numbers to remember connections. For example:

Internal - External
192.168.1.1:4567 - 80.233.1.67:4567
192.168.1.2:3458 - 80.233.1.67:3458

The same external address is used however the external address uses the internal addresses source port number as its own source port number.


Configuration

To configure NAT Overload so all my internal hosts on the address subnet 192.168.2.0 (defined in the access list in step 3) use the address 192.168.2.200 (as defined in the NAT pool in step 2).


1. Name the interfaces.

Secure#conf t
Secure(config)#interface eth 0
Secure(config-if)#ip nat inside
Secure(config)#interface eth 1
Secure(config-if)#ip nat outside
Secure(config-if)#exit



2. Create the Pool of addresses to be used to NAT

Secure(config)#ip nat pool Secure-Pool 192.168.2.10 192.168.2.10 net 255.255.255.0



3. Create a standard ACL that identifies addresses that will be NAT'd

Secure(config)#ip access-list standard 10
Secure(config-std-nacl)#permit 192.168.2.0 0.0.0.255


4. Enable NAT
Secure(config)#ip nat inside source list 10 pool Secure-Pool overload

When I ping the external host all traffic is seen as coming from the address that I set up in the pool.



All works well but because of my lab setup I need to change the pool address to one that works on my other network which connects to the internet.

Secure(config)#no ip nat inside source list 10 pool Secure-Pool overload
Secure(config)#ip nat pool Secure-Pool 10.0.1.199 10.0.1.199 net 255.255.255.0
Secure(config)#ip nat inside source list 10 pool Secure-Pool overload

Now from my lab I can get access to the web and if I ping a host on my lab net I see the correct NAT address returned.





Troubleshooting and Debugging

A useful show command for looking at active translations is:

Secure#show ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp 10.0.1.199:768 192.168.2.4:768 10.0.1.5:768 10.0.1.5:768
--- 10.0.1.199 192.168.2.4 --- ---



For looking at translations as they happen you can use:

Secure#terminal monitor
Secure#debug ip nat detailed
IP NAT detailed debugging is on
Secure#
*Sep 27 14:09:52.903: NAT*: i: icmp (192.168.2.4, 768) -> (10.0.1.5, 768) [56303]
*Sep 27 14:09:52.903: NAT*: i: icmp (192.168.2.4, 768) -> (10.0.1.5, 768) [56303]
*Sep 27 14:09:52.903: NAT*: s=192.168.2.4->10.0.1.199, d=10.0.1.5 [56303]
*Sep 27 14:09:52.907: NAT*: o: icmp (10.0.1.5, 768) -> (10.0.1.199, 768) [32653]
*Sep 27 14:09:52.907: NAT*: s=10.0.1.5, d=10.0.1.199->192.168.2.4 [32653]
Secure#
*Sep 27 14:09:53.903: NAT*: i: icmp (192.168.2.4, 768) -> (10.0.1.5, 768) [56304]
*Sep 27 14:09:53.903: NAT*: s=192.168.2.4->10.0.1.199, d=10.0.1.5 [56304]
*Sep 27 14:09:53.907: NAT*: o: icmp (10.0.1.5, 768) -> (10.0.1.199, 768) [61886]
*Sep 27 14:09:53.907: NAT*: s=10.0.1.5, d=10.0.1.199->192.168.2.4 [61886]
Secure#
*Sep 27 14:09:54.907: NAT*: i: icmp (192.168.2.4, 768) -> (10.0.1.5, 768) [56305]
*Sep 27 14:09:54.907: NAT*: s=192.168.2.4->10.0.1.199, d=10.0.1.5 [56305]
*Sep 27 14:09:54.907: NAT*: o: icmp (10.0.1.5, 768) -> (10.0.1.199, 768) [47007]
*Sep 27 14:09:54.907: NAT*: s=10.0.1.5, d=10.0.1.199->192.168.2.4 [47007]
Secure#
*Sep 27 14:09:55.907: NAT*: i: icmp (192.168.2.4, 768) -> (10.0.1.5, 768) [56306]
*Sep 27 14:09:55.907: NAT*: s=192.168.2.4->10.0.1.199, d=10.0.1.5 [56306]
*Sep 27 14:09:55.915: NAT*: o: icmp (10.0.1.5, 768) -> (10.0.1.199, 768) [28657]
*Sep 27 14:09:55.915: NAT*: s=10.0.1.5, d=10.0.1.199->192.168.2.4 [28657]
Secure#

In the output above we can see that were looking at ICMP traffic from 192.168.2.4 to 10.0.1.5 which is NAT'd to 10.0.1.199.


For NAT statistics:

Secure#sh ip nat statistics
Total active translations: 2 (0 static, 2 dynamic; 1 extended)
Outside interfaces:
Ethernet1
Inside interfaces:
Ethernet0
Hits: 4295 Misses: 212
CEF Translated packets: 3413, CEF Punted packets: 1847
Expired translations: 637
Dynamic mappings:
-- Inside Source
[Id: 7] access-list 2 pool Secure-Pool refcount 2
pool Secure-Pool: netmask 255.255.255.0
start 10.0.1.199 end 10.0.1.199
type generic, total addresses 1, allocated 1 (100%), misses 0
Queued Packets: 0
Secure#

CDP - What Switch Am I Connected To?

I'm sitting here on my day off, I've mowed the lawn and I had a few minutes to spare so I thought I would have a closer look at a CDP packet.

CPD stands for Cisco Discovery Protocol and it's a packet that is sent out of every interface of my switch by default. Now I'll be covering CDP in more detail in another post but I wanted to just quickly get this down because it's so cool.

How many times have you had a PC that you need to figure out which switch and which port its plugged into? Probably loads right. Me too. Well a simple packet capture for a minute or so will give you all the information to go to the right switch and the right port.

As can be seen in the screenshot below, I have Wireshark set to filter on CDP and in the first packet that comes through I can see that my PC is connect to switch S1 (Device ID: S1) and is on port FastEthernet 0/3 (Port ID: FastEthernet 0/3). How cool is that! My days of tracing cables are now over (maybe!).

Now there's some other useful information in there too like the IP Address of the switch, the Switch model and IOS version.

Just thought I would share that useful tip (well I thought it was pretty useful anyway).

IP Routing - OSPF

In this post I'm going to describe a few benefits of OSPF and how to configure it.

OSPF stands for Open Shortest Path First and and is a link state, non-proprietary, classless routing protocol. OSPF uses the dijkstra algorithm to calculate routes and has an administrative distance of 110.

The main advantages of OSPF are the fast convergence time and the low bandwidth use. Unlike RIP which is a flat network OSPF networks can be structured. Areas are used to structure the network and each router needs to have an interface in area 0 which is the backbone network. For the CCNA exam only area 0 is used. OSPF can also be configured to use authentication on it's routing updates.

Configuring OSPF

Below is a diagram of the routers I'll be referring to in this post.

Router 1 (R1)

FastEthernet 0/0 - 192.168.1.1/24

loopback 0 - 172.16.10.0/24

loopback 1 - 10.1.1.0/24

Router 2 (R2)

FastEthernet 0/0 - 192.168.1.2/24

FastEthernet 1/0 - 192.168.2.1/24

Router 3 (R3)

FastEthernet 0/0 - 192.168.2.2/24

Okay, lets get started.

I'll remove RIP so router 3 doesn't know about the 172.16.10.0 subnet on router 1.

R3#conf t

R3(config)#no router rip

R3(config)#exit

R3#sh ip route

Gateway of last resort is not set

C 192.168.2.0/24 is directly connected, FastEthernet0/0

R3#

Below I'll remove RIP from Routers 1, 2 and 3, configure them with OSPF and verify routes propagated.

R1#conf t

R1(config)#no router rip

R1(config)#router ospf 10

R1(config-router)#network 192.168.1.0 0.0.0.255 area 0

R1(config-router)#network 172.16.10.0 0.0.0.255 area 0

R1(config-router)#end

I also have an network 10.1.1.0 that I dont want published so I leave this out.

R2#conf t

R2(config)#no router rip

R2(config)#router ospf 10

R2(config-router)#network 192.168.1.0 0.0.0.255 area 0

R2(config-router)#network 192.168.2.0 0.0.0.255 area 0

R2(config-router)#end

R3#conf t

R3(config)#router ospf 10

R3(config-router)#network 192.168.2.0 0.0.0.255 area 0

Notice, I just create the routes that I want advertised and place them into Area 0. All routers must have at least one interface in Area 0. I have used 10 as the OSPF process ID. this could be different on each router but its easier to remember if it is all the same.

Great. Now I verify that the routes have been propagated.

R3#sh ip route

Gateway of last resort is not set

172.16.0.0/32 is subnetted, 1 subnets

O 172.16.10.1 [110/3] via 192.168.2.1, 00:06:53, FastEthernet0/0

O 192.168.1.0/24 [110/2] via 192.168.2.1, 00:06:53, FastEthernet0/0

C 192.168.2.0/24 is directly connected, FastEthernet0/0

And can I ping the 172.16.10.1 interface?

R3#ping 172.16.10.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.10.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 52/72/96 ms

Ok this is all good but I can see on the routing table of R3 (shown above) that I have no gateway of last resort set. I want to set this to go to loopback 0 on R1.

To fix this I'll go back to R1, tell OSPF to advertise the gateway route and then create a static route to set the gateway of last resort. Here's how:

R1(config)#router ospf 10

R1(config-router)#default-information originate

R1(config-router)#exit

R1(config)#ip route 0.0.0.0 0.0.0.0 loopback 0

R1(config)#exit

R1#sh ip route

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

172.16.0.0/24 is subnetted, 1 subnets

C 172.16.10.0 is directly connected, Loopback0

10.0.0.0/24 is subnetted, 1 subnets

C 10.1.1.0 is directly connected, Loopback1

C 192.168.1.0/24 is directly connected, FastEthernet0/0

O 192.168.2.0/24 [110/2] via 192.168.1.2, 00:20:59, FastEthernet0/0

S* 0.0.0.0/0 is directly connected, Loopback0

And I have another look on R3 to make sure it has got to that network.

R3#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route

Gateway of last resort is 192.168.2.1 to network 0.0.0.0

172.16.0.0/32 is subnetted, 1 subnets

O 172.16.10.1 [110/3] via 192.168.2.1, 00:23:59, FastEthernet0/0

O 192.168.1.0/24 [110/2] via 192.168.2.1, 00:23:59, FastEthernet0/0

C 192.168.2.0/24 is directly connected, FastEthernet0/0

O*E2 0.0.0.0/0 [110/1] via 192.168.2.1, 00:04:23, FastEthernet0/0

R3#

Bingo! All done.

Links

Here is a link to a great article on OSPF

Here is a link to some great OSPF videos

Switch Port Security

I've been having loads of fun playing with port security today and in this post I'll share that fun with you.

Port Security is a feature thats on all Cisco switches and it allows you to control what devices access which ports on a switch. The way Port Security works is it ties MAC Addresses (this is layer 2 remember) to switch ports. These MAC addresses can either be assigned statically or dynamically by the switch taking the first device connected and remembering it's address (this is called making the port sticky). Also the port can be configured to remember more than one address.

Depending on your appetite for security you can set ports to either do nothing, log an event or shutdown when an unauthorised device is connected to a port. As I'll describe below, using the "Protect" feature you can also restrict which ports can talk to each other. This feature could be useful in malware containment.

I'll be selecting a range of ports on my switch (9 - 16) and setting them up to be access ports and to be protected, this means they will not be able to talk to each other. Protected ports can only talk to unprotected ports (which would be my server and router). I'll also configure the ports to shutdown if they are accessed by any other devices other than the first device connected to them.

S1(config)#interface range fastEthernet 0/9 - 16

S1(config-if-range)#switchport mode access

S1(config-if-range)#switchport protected

S1(config-if-range)#switchport port-security violation shutdown

S1(config-if-range)#switchport port-security mac-address sticky

S1(config-if-range)#switchport port-security

Note, although setting ports as protected can be useful in helping stop the spread of malware, it can also be a pain in the arse for remote administration if not planned properly. Another thing that is a pain in the arse is waiting for interfaces to come back up after plugging devices in and out which is due to spanning tree protocol. To save me about 50 seconds of waiting round i'll enable portfast so the interfaces come up straight away.

S1(config-if-range)#spanning-tree portfast

S1(config-if-range)#exit

As I've set up port security to shutdown ports if unauthorised access occures I'll configure the switch to automatically re-enable the ports after 10 minutes. This will save me having to manually issue the no shutdown command on the ports.

S1(config)#errdisable recovery cause psecure-violation

S1(config)#errdisable recovery interval 600

After configuring the switch I look at the running-config and I see the MAC address of the host connected to port 9 is shown.

!

interface FastEthernet0/9

switchport mode access

switchport protected

switchport port-security

switchport port-security mac-address sticky

switchport port-security mac-address sticky 0018.8bce.5855

no ip address

spanning-tree portfast

!

Okay set lets put it into pactice. I check that I cant communicate between hosts that have protected ports. My pings between the hosts on protected ports fail, and my pings to my router are fine. So far so good!

Now I swap over network cables of 2 hosts to make sure that the ports go into shutdown.

S1#show port-security interface fastethernet 0/9

Port Security : Enabled

Port status : Err-Disabled

Violation mode : Shutdown

Maximum MAC Addresses : 1

Total MAC Addresses : 1

Configured MAC Addresses : 0

Sticky MAC Addresses : 1

Aging time : 0 mins

Aging type : Absolute

SecureStatic address aging : Disabled

Security Violation count : 1

After 10 mins the port gets re-enabled. However, unless the device that was origionally connected and has it's MAC address associated with the port is re-connected the port goes stright back into shutdown and clocks up another violation. Whats more, that device cannot be used on any other switch port because it's address is tied to the port it bacame sticky with.

Once the device is connected to it's origional port and the errdisable recovery interval has expired (or we issue a shut - no shut on the port) were happily pinging the router again and I can see the violation is logged.

S1#show port-security int fa 0/9

Port Security : Enabled

Port status : SecureUp

Violation mode : Shutdown

Maximum MAC Addresses : 1

Total MAC Addresses : 1

Configured MAC Addresses : 0

Sticky MAC Addresses : 1

Aging time : 0 mins

Aging type : Absolute

SecureStatic address aging : Disabled

Security Violation count : 1

Or to see all interfaces that have had exceptions I could use:

S1#show port-security

Supposing I want to be able to connect another device to a port that I have configured for port-security or change the port of a device that has became sticky with a port? Well I would issue the following:

S1#clear port-security sticky interface fastEthernet 0/9

And then I could use that device on another port or use port 9 for a different device.

To see a list of ports that have devices tied to them either by statically assigning them by making the port sticky you can either issue:

S1#show port-security address

Or simply:

S1#show running-config

And that brings me to the end of another successful cisco adventure!

Initial Switch Configuration

In this post I'm just going to detail how to get a 2950 switch up with a very basic configuration. I'll build upon this config in later posts.

I start off by giving my switch a name (S1) and enabling a secret password (okay, I know its crap but this is a lab). I'll turn off domain lookups as they are very annoying every time I mistype something and give it a default gateway.

Switch>enable

Switch#configure terminal

Switch(config)#hostname S1

S1(config)#enable secret cisco

S1(config)#no ip domain-lookup

S1(config)#ip default-gateway 10.0.1.1

Now I'll set up the console port with a 30 minute time-out and a password of cisco.

S1(config)#line console 0

S1(config-line)#logging synchronous

S1(config-line)#exec-timeout 30 0

S1(config-line)#password cisco

S1(config-line)#login

I do the same for the VTY ports.

S1(config-line)#line vty 0 4

S1(config-line)#logging synchronous

S1(config-line)#exec-timeout 30 0

S1(config-line)#password cisco

S1(config-line)#login

S1(config-line)#exit

Theres no aux port on the switch so we can move on to VLAN 1. VLAN 1 is the default VLAN and in a later post I'll move everything out of this VLAN and just use it for administration but for now I'll set it up with an IP address so it's accessible by telnet. I also turn on password encryption and show the running-config so the password encryption service can works it's magic.

S1(config)#interface vlan 1

S1(config-if)#ip address 10.0.1.210 255.255.255.0

S1(config-if)#no shutdown

S1(config-if)#exit

S1(config)#service password-encryption

S1(config)#do show running-config

Building configuration...

Current configuration : 1658 bytes

!

version 12.1

no service single-slot-reload-enable

no service pad

service timestamps debug uptime

service timestamps log uptime

service password-encryption

!

hostname S1

!

enable secret 5 $1$AqOD$ifdJ30Bwn.bJuBXRFov4O/

!

ip subnet-zero

no ip domain-lookup

!

spanning-tree extend system-id

!

!

interface FastEthernet0/1

no ip address

!

<-------------Cut------------------>

!

interface FastEthernet0/24

no ip address

!

interface Vlan1

ip address 10.0.1.210 255.255.255.0

no ip route-cache

!

ip default-gateway 10.0.1.1

ip http server

!

!

line con 0

exec-timeout 30 0

password 7 0822455D0A16

logging synchronous

login

line vty 0 4

exec-timeout 30 0

password 7 0822455D0A16

logging synchronous

login

line vty 5 15

login

!

end

Finally I set up a host entry for my router (R1), turn off the web server that I saw was on in the running-config, save the config to startup-config and reload.

S1(config)#ip host R1 10.0.1.220

S1(config)#no ip http server

S1(config)#exit

S1#copy running-config startup-config

Destination filename [startup-config]?

Building configuration...

[OK]

S1#reload

enjoy it