Examkin

Question

Difficulty: HardInside Source NAT and PAT Configuration and Verification

A network engineer is troubleshooting internet connectivity issues on a Cisco IOS router configured for Network Address Translation. Internal hosts on the 10.10.10.0/2410.10.10.0/24 network report that only one host can access external resources at any given time. Subsequent host traffic is dropped. The engineer inspects the router configuration and operational state using verification commands:

text
Router# show ip nat statistics
Total active translations: 1 (0 static, 1 dynamic, 1 extended)
Outside interfaces:
GigabitEthernet0/1
Inside interfaces:
GigabitEthernet0/0
Hits: 48 Misses: 12
CEF Translated packets: 48, Fast Switched packets: 0
Expired translations: 15
Dynamic mappings:
-- Inside Source
[id 1] access-list 101 pool INTERNET-POOL refcount 1
pool INTERNET-POOL: netmask 255.255.255.252
start 203.0.113.1 end 203.0.113.1
type generic, total addresses 1, allocated 1 (100%), misses 12

Router# show running-config | include ip nat
ip nat pool INTERNET-POOL 203.0.113.1 203.0.113.1 netmask 255.255.255.252
ip nat inside source list 101 pool INTERNET-POOL
access-list 101 permit ip 10.10.10.0 0.0.0.255 any

Which configuration change is required to allow all internal hosts on the 10.10.10.0/2410.10.10.0/24 network to share the single public IPv4 address simultaneously?

  1. Append the overload keyword to the command ip nat inside source list 101 pool INTERNET-POOL.Answer
  2. B
    Expand the pool range using the command ip nat pool INTERNET-POOL 203.0.113.1 203.0.113.254 netmask 255.255.255.0 without adding overload.
  3. C
    Modify access-list 101 to specify permit ip 172.16.0.0 0.15.255.255 any because 10.10.10.0/24 is not a valid RFC 1918 private IPv4 subnet.
  4. D
    Add an explicit deny ip any any entry at the end of access-list 101 to clear blocked active translation entries.

Answer

Appending the overload keyword to the statement ip nat inside source list 101 pool INTERNET-POOL converts dynamic 1-to-1 NAT into Port Address Translation (PAT), enabling multiple internal hosts to share a single public IP address using unique source port numbers.
The command output indicates that the NAT pool contains only one IP address (203.0.113.1) and is 100% allocated without overload enabled. Because the overload keyword was omitted from the inside source translation statement, Cisco IOS performs dynamic 1-to-1 translation. Appending the overload keyword enables Port Address Translation (PAT), allowing multiple inside hosts to share the single IP address by using unique Layer 4 port numbers.

Step-by-Step Solution

1
Analyze the output of show ip nat statistics and show running-config.
The pool INTERNET-POOL contains 1 total public IPv4 address (203.0.113.1). Allocation shows 1 allocated (100%) with 12 misses, indicating address pool exhaustion.
Without port multiplexing, dynamic NAT performs strict 1-to-1 mapping. Once all pool addresses are allocated, subsequent translation requests fail.
2
Identify the missing keyword in the NAT translation command.
The configuration entry ip nat inside source list 101 pool INTERNET-POOL lacks the overload keyword.
The overload keyword instructs Cisco IOS to track Layer 4 source port numbers (PAT), enabling thousands of concurrent internal connections over a single IP address.
3
Formulate the correct configuration fix.
Reconfigure the router statement to ip nat inside source list 101 pool INTERNET-POOL overload.
This modification resolves translation misses and allows all hosts on the 10.10.10.0/24 network to share 203.0.113.1 simultaneously.

Key Concept

Port Address Translation (PAT) Overload Configuration
Rate this question

Topics

Inside Source NAT and PAT Configuration and Verification

More questions from this topic