Examkin

Question

Difficulty: HardInside Source NAT and PAT Configuration and Verification

A network administrator configures Port Address Translation (PAT) on a Cisco IOS router so that internal hosts on the 10.10.50.0/2410.10.50.0/24 network can access external services through WAN interface GigabitEthernet0/0/1. The access list and global translation rules are configured as follows:

text
access-list 105 permit ip 10.10.50.0 0.0.0.255 any
ip nat inside source list 105 interface GigabitEthernet0/0/1 overload

During testing, internal clients cannot access external websites, and running `show ip nat translations` produces no output. An inspection of the interface configuration reveals:

text
interface GigabitEthernet0/0/0
description LAN Gateway
ip address 10.10.50.1 255.255.255.0
!
interface GigabitEthernet0/0/1
description WAN Interface
ip address 203.0.113.2 255.255.255.252
ip nat outside

Which configuration step on the router is required to enable successful address translation for the internal clients?

  1. Apply the command `ip nat inside` under interface GigabitEthernet0/0/0.Answer
  2. B
    Apply the command `ip nat overload` under interface GigabitEthernet0/0/1.
  3. C
    Reconfigure access list 105 to use a wildcard mask of `0.0.0.0` for the 10.10.50.0/2410.10.50.0/24 network.
  4. D
    Apply the command `ip nat inside` under interface GigabitEthernet0/0/1.

Answer

Apply the command `ip nat inside` under interface GigabitEthernet0/0/0.
For Cisco IOS NAT/PAT to process packets, interfaces connecting to internal networks must be explicitly configured with the `ip nat inside` command, and external-facing interfaces must be configured with `ip nat outside`. Because GigabitEthernet0/0/0 lacked `ip nat inside`, traffic entering from the LAN was routed normally without undergoing NAT evaluation.

Step-by-Step Solution

1
Identify NAT domain boundaries on the router interfaces.
GigabitEthernet0/0/1 is configured with `ip nat outside`, but GigabitEthernet0/0/0 lacks the `ip nat inside` designation.
Cisco IOS Network Address Translation requires at least one inside interface and one outside interface to trigger packet translation upon traversing the NAT boundary.
2
Evaluate the global NAT statement and access list configuration.
The global command `ip nat inside source list 105 interface GigabitEthernet0/0/1 overload` correctly references ACL 105 and specifies interface overload (PAT).
The syntax of the global NAT translation rule and referenced ACL is accurate.
3
Determine the necessary interface configuration fix.
Enter interface configuration mode for GigabitEthernet0/0/0 and execute `ip nat inside`.
Designating GigabitEthernet0/0/0 as the inside NAT interface allows the router to recognize incoming LAN traffic subject to NAT.

Key Concept

Inside and Outside NAT Interface Boundaries
Rate this question

Topics

Inside Source NAT and PAT Configuration and Verification

More questions from this topic