Examkin

Question

Difficulty: Very hardInside Source NAT and PAT Configuration and Verification

A network engineer is troubleshooting outbound connectivity failures on a Cisco IOS router. Internal devices on subnet 10.0.10.0/2410.0.10.0/24 can establish a maximum of two concurrent Internet connections. Additional hosts experience connection timeouts. The output of `show ip nat statistics` displays:

Total active translations: 2 (0 static, 2 dynamic, 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces: GigabitEthernet0/0
Hits: 842 Misses: 412
Dynamic mappings:
-- Inside Source
[id 1] access-list 10 pool PUBLIC_POOL refcount 2
pool PUBLIC_POOL: netmask 255.255.255.252
start 198.51.100.1 end 198.51.100.2
type generic, total addresses 2, allocated 2 (100%), misses 412

The current running configuration contains `ip nat inside source list 10 pool PUBLIC_POOL`.

Which configuration change on the router will allow all internal hosts on subnet 10.0.10.0/2410.0.10.0/24 to share the existing pool addresses concurrently without adding new public IP addresses?

  1. Append the overload keyword to the ip nat inside source list 10 pool PUBLIC_POOL command.Answer
  2. B
    Modify access list 10 to permit public IP addresses in the range 172.32.0.0/12 instead of private subnets.
  3. C
    Change the subnet mask of PUBLIC_POOL to 255.255.255.0 while keeping the start and end IP addresses set to 198.51.100.1 and 198.51.100.2.
  4. D
    Configure ip nat outside on interface GigabitEthernet0/0 and ip nat inside on interface GigabitEthernet0/1.

Answer

Append the overload keyword to the ip nat inside source list 10 pool PUBLIC_POOL command.
Appending the overload keyword to the inside source pool configuration enables Port Address Translation (PAT). Under PAT, Cisco IOS tracks Layer 4 source port numbers in extended translation entries, allowing multiple internal hosts to simultaneously share a small pool of public IP addresses.

Step-by-Step Solution

1
Analyze the show ip nat statistics output
The pool PUBLIC_POOL has a total of 2 addresses, both are allocated (100%), and 412 misses have occurred.
Without PAT, dynamic NAT allocates public IP addresses from the pool on a 1-to-1 basis. Once all addresses in the pool are exhausted, subsequent translation requests fail.
2
Identify the missing Port Address Translation (PAT) parameter
The running configuration shows `ip nat inside source list 10 pool PUBLIC_POOL` without the `overload` keyword.
Without `overload`, Cisco IOS performs standard dynamic 1-to-1 NAT rather than PAT (many-to-1 or many-to-few multiplexing using L4 port numbers).
3
Determine the corrective configuration command
Update the command to `ip nat inside source list 10 pool PUBLIC_POOL overload`.
The `overload` keyword enables PAT, allowing thousands of internal sockets to share the 2 public IP addresses in the pool simultaneously.

Key Concept

Port Address Translation (PAT) with NAT Pools
Rate this question

Topics

Inside Source NAT and PAT Configuration and Verification

More questions from this topic