Examkin

Question

Difficulty: MediumInside Source NAT and PAT Configuration and Verification

A network engineer is configuring Port Address Translation (PAT) on a Cisco IOS router using a dynamic NAT pool named PUBLICPOOLPUBLIC_POOL (203.0.113.10203.0.113.10 to 203.0.113.12203.0.113.12). Internal endpoints reside on the 172.16.10.0/24172.16.10.0/24 network, which is matched by standard Access Control List 15. Which two configuration actions must be performed on the router to correctly enable PAT for internal hosts and designate interface directionality? (Select two.)

  1. Apply the command ip nat inside source list 15 pool PUBLIC_POOL overload in global configuration mode.Answer
  2. Configure the command ip nat inside under the LAN-facing interface (e.g., GigabitEthernet0/0).Answer
  3. C
    Apply the command ip nat inside source list 15 pool PUBLIC_POOL in global configuration mode.
  4. D
    Define access-list 15 permit 172.32.10.0 0.0.0.255 to identify the internal private host subnet.

Answer

To configure PAT using an IP pool, the global command must include the 'overload' keyword ('ip nat inside source list 15 pool PUBLIC_POOL overload') to permit port multiplexing, and the internal interface must be designated with 'ip nat inside'.
Enabling PAT with a defined pool requires the 'overload' keyword at the end of the 'ip nat inside source list <acl> pool <name> overload' command structure. Additionally, Cisco IOS routers require explicit interface domain definitions, where 'ip nat inside' is applied to LAN interfaces connected to internal devices.

Step-by-Step Solution

1
Identify the requirement for PAT overload with an IP pool.
Dynamic NAT pool mapping requires appending 'overload' to enable port address translation multiplexing.
Without 'overload', Cisco IOS performs dynamic 1-to-1 NAT, limiting active translations to the number of IPs in the pool.
2
Identify required interface NAT role assignments.
The LAN interface facing internal hosts must be marked with 'ip nat inside'.
Cisco IOS requires explicit NAT domain boundaries ('inside' and 'outside') to trigger translation on packet traversal.
3
Validate RFC 1918 IP address matching in ACL statements.
The subnet 172.16.10.0/24172.16.10.0/24 is private, whereas 172.32.10.0/24172.32.10.0/24 is public address space.
Matching public addresses in internal NAT ACLs fails to translate actual private endpoint traffic.

Key Concept

Inside Source Port Address Translation (PAT) Pool Configuration and Interface Assignment
Rate this question

Topics

Inside Source NAT and PAT Configuration and Verification

More questions from this topic