Examkin

Question

Difficulty: MediumInside Source NAT and PAT Configuration and Verification

A network administrator is configuring Port Address Translation (PAT) on a Cisco IOS router to allow internal hosts in the 172.16.50.0/24172.16.50.0/24 subnet to access the Internet using the public IP address on interface GigabitEthernet0/0/0. Internal users report that they cannot establish any outbound internet connections. The running configuration reveals the following details:

interface GigabitEthernet0/0/0
ip address 203.0.113.1 255.255.255.248
ip nat outside
!
interface GigabitEthernet0/0/1
ip address 172.16.50.1 255.255.255.0
!
ip access-list standard NAT_ACL
permit 172.16.50.0 0.0.0.255
!
ip nat inside source list NAT_ACL interface GigabitEthernet0/0/0 overload

Which configuration change must be made on the router to resolve this issue?

  1. Configure the ip nat inside command under interface GigabitEthernet0/0/1.Answer
  2. B
    Remove the overload keyword from the ip nat inside source command.
  3. C
    Change the ACL source network to 172.32.50.0 0.0.0.255 because 172.16.50.0 is not a valid private IP range.
  4. D
    Append an explicit permit any statement to the end of access-list NAT_ACL.

Answer

Configure the ip nat inside command under interface GigabitEthernet0/0/1.
For Cisco IOS NAT to operate, at least one interface must be designated as 'ip nat inside' and at least one interface as 'ip nat outside'. In the provided configuration, interface GigabitEthernet0/0/1 lacks the 'ip nat inside' command, so packets arriving from internal hosts are not identified for translation.

Step-by-Step Solution

1
Analyze the existing router configuration for NAT/PAT components.
Interface GigabitEthernet0/0/0 is properly marked with 'ip nat outside', NAT_ACL permits 172.16.50.0/24172.16.50.0/24, and the global translation statement maps NAT_ACL to GigabitEthernet0/0/0 with 'overload'.
For Cisco IOS NAT/PAT to process packets, interfaces must be designated as inside or outside, and traffic must cross between them.
2
Inspect the internal interface configuration.
Interface GigabitEthernet0/0/1 is missing the 'ip nat inside' command.
Without 'ip nat inside' on the internal gateway interface, incoming packets from 172.16.50.0/24172.16.50.0/24 are routed normally without undergoing Network Address Translation.
3
Identify the required fix.
Add 'ip nat inside' under interface GigabitEthernet0/0/1 configuration.
This establishes the boundary between internal private addresses and the external public interface, enabling PAT processing.

Key Concept

Inside and Outside NAT Interface Designation
Estimated Time:1m 30s
Rate this question

Topics

Inside Source NAT and PAT Configuration and Verification

More questions from this topic