A network administrator configures dynamic NAT on a Cisco IOS router using an IP pool name… — Cisco CCNA

A network administrator configures dynamic NAT on a Cisco IOS router using an IP pool named `INTERNET_POOL` ( $198.51.100.1$ to $198.51.100.2$ ) for hosts in the $10.20.30.0/23$ internal network. During testing, users observe that after two internal hosts establish outbound connections, no other internal hosts can access external sites. The output of `show ip nat statistics` shows total translations equal to $2$ ( $0$ static, $2$ dynamic, $0$ extended).

Configuration snippet:
text
ip nat pool INTERNET_POOL 198.51.100.1 198.51.100.2 netmask 255.255.255.252
access-list 15 permit 10.20.30.0 0.0.1.255
ip nat inside source list 15 pool INTERNET_POOL

Which TWO statements correctly identify the root cause of this issue and the solution required to allow all internal hosts to translate concurrently? (Select two.)

The current `ip nat inside source` command configures dynamic 1-to-1 NAT, which exhausts the pool after assigning both available public IP addresses.Answer
Appending the `overload` keyword to the `ip nat inside source` command enables Port Address Translation (PAT), allowing multiple internal hosts to share pool IP addresses using unique Layer 4 port numbers.Answer
C
The access list wildcard mask `0.0.1.255` matches public IPv4 ranges outside RFC 1918, preventing internal traffic on $10.20.30.0/23$ from matching access-list 15.
D
The NAT pool subnet mask `255.255.255.252` restricts translation memory capacity to two total host entries regardless of port utilization.

Answer

The current `ip nat inside source` command configures dynamic 1-to-1 NAT, which exhausts the pool after assigning both available public IP addresses. Appending the `overload` keyword to the `ip nat inside source` command enables Port Address Translation (PAT), allowing multiple internal hosts to share pool IP addresses using unique Layer 4 port numbers.

Dynamic NAT without the `overload` keyword maps inside local IP addresses to inside global IP addresses on a strict 1-to-1 basis. Because `INTERNET_POOL` contains only two public IP addresses (

198.51.100.1

and

198.51.100.2

), only two hosts can translate simultaneously. To permit all hosts on the subnet to share these addresses concurrently, the `overload` keyword must be added to the end of the `ip nat inside source list 15 pool INTERNET_POOL` command to enable Port Address Translation (PAT).

Step-by-Step Solution

Analyze the existing router configuration and command output.

The command `ip nat inside source list 15 pool INTERNET_POOL` binds ACL 15 to the pool `INTERNET_POOL` without the `overload` keyword at the end.

Omitting `overload` specifies standard dynamic NAT (1-to-1 mapping) rather than PAT (many-to-1 or many-to-few mapping).

Evaluate the capacity of the NAT pool.

The pool `INTERNET_POOL` contains 2 IP addresses (

198.51.100.1

and

198.51.100.2

In 1-to-1 dynamic NAT, once 2 hosts initiate traffic, both pool addresses are checked out. The 3rd host cannot translate and its packets are dropped.

Determine the required CLI modification to support concurrent access for the entire

10.20.30.0/23

network.

Modify the command to `ip nat inside source list 15 pool INTERNET_POOL overload`.

The `overload` keyword instructs Cisco IOS to track Layer 4 source port numbers (creating extended translations shown in `show ip nat translations`), allowing thousands of concurrent sessions across the public pool IP addresses.

Key Concept

Port Address Translation (PAT) Overload Keyword Requirement

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic