Examkin

Question

Difficulty: Very hardInside Source NAT and PAT Configuration and Verification

A network administrator configures Port Address Translation (PAT) on a Cisco IOS router to allow hosts on the 192.168.10.0/24192.168.10.0/24 internal subnet to access external servers using a dynamic NAT pool. After applying the configuration, only the first host to send traffic successfully establishes an outbound connection. All subsequent internal hosts fail to reach external destinations.

The router configuration is as follows:
text
ip nat pool EDGE_POOL 198.51.100.10 198.51.100.10 netmask 255.255.255.252
access-list 105 permit ip 192.168.10.0 0.0.0.255 any
ip nat inside source list 105 pool EDGE_POOL
!
interface GigabitEthernet0/0
ip address 192.168.10.1 255.255.255.0
ip nat inside
!
interface GigabitEthernet0/1
ip address 198.51.100.9 255.255.255.252
ip nat outside

Which modification to the router configuration will resolve the connectivity failure for all remaining internal hosts?

  1. Append the overload keyword to the ip nat inside source list 105 pool EDGE_POOL command.Answer
  2. B
    Modify access-list 105 to use the subnet mask 255.255.255.0 instead of the wildcard mask 0.0.0.255.
  3. C
    Change the IP addresses in ip nat pool EDGE_POOL to use an RFC 1918 private address block such as 172.16.10.10 172.16.10.10.
  4. D
    Swap the interface designations by configuring ip nat outside on GigabitEthernet0/0 and ip nat inside on GigabitEthernet0/1.

Answer

Appending the overload keyword to the ip nat inside source statement enables Port Address Translation (PAT), allowing multiple inside local addresses to share the single IP address configured in the pool.
The correct response identifies that the 'overload' keyword is missing from the NAT translation statement. When configuring dynamic NAT with a pool containing a single IP address, omitting 'overload' causes the router to perform standard dynamic 1-to-1 NAT rather than PAT. The first internal host consumes the single IP address in the pool (198.51.100.10198.51.100.10). All subsequent hosts fail to obtain a translation entry because the pool is exhausted. Appending 'overload' enables port multiplexing, allowing up to ~65,000 simultaneous connections to share the single pool address.

Step-by-Step Solution

1
Analyze the existing dynamic NAT pool configuration.
The command 'ip nat pool EDGE_POOL 198.51.100.10 198.51.100.10 netmask 255.255.255.252' defines a pool containing exactly one usable public IP address (198.51.100.10198.51.100.10).
Understanding pool size identifies how many simultaneous dynamic 1-to-1 translations can occur.
2
Evaluate the translation command 'ip nat inside source list 105 pool EDGE_POOL'.
Without the 'overload' keyword, Cisco IOS performs dynamic 1-to-1 NAT instead of Port Address Translation (PAT).
Dynamic 1-to-1 NAT allocates one public IP per active internal host. Once the single IP address in EDGE_POOL is allocated to the first host, the pool is exhausted and subsequent host requests are dropped.
3
Determine the required command modification to allow port multiplexing.
Appending 'overload' to the command ('ip nat inside source list 105 pool EDGE_POOL overload') enables PAT, multiplexing multiple internal hosts across different source port numbers on the single public IP 198.51.100.10198.51.100.10.
PAT allows thousands of concurrent translations on a single IP address by leveraging transport-layer port tracking.

Key Concept

Port Address Translation (PAT / NAT Overload) using dynamic IP pools
Estimated Time:2m 0s
Rate this question

Topics

Inside Source NAT and PAT Configuration and Verification

More questions from this topic