## **Objective** Implementation of **Source NAT (PAT)** on **IR1 and IR2** to ensure: - clients from **VLAN 101–102** in HQ1, HQ2, BR1, and BR2 have simultaneous Internet access - outbound traffic is translated correctly depending on the Internet edge router used - server **HQ1-SRV1 (10.10.100.101)** is reachable externally via **static NAT** - all task requirements are met exactly --- ## **1. NAT Design** ### **1.1 Core Principle** - NAT only on **IR1 and IR2** - Inside: - VLAN 101–102 (clients) - HQ1-SRV1 (10.10.100.101) - Outside: - ISP1 WAN interfaces - Split by Internet exit: - IR1 → dedicated public pool - IR2 → dedicated public pool --- ## **2. Dynamic NAT (PAT) for Clients** ### **2.1 Requirements** - VLANs: 101–102 - Concurrent Internet access (~400 clients) - Translation depends on the exit router Public pools: - IR1: **192.0.2.104 – 192.0.2.110** - IR2: **192.0.2.193 – 192.0.2.199** --- ### **2.2 Prefix-List / ACL for Client Networks (Example, summarized)** ``` ip access-list standard NAT_CLIENTS permit 10.10.101.0 0.0.0.255 permit 10.10.102.0 0.0.0.255 ``` --- ### **2.3 Define NAT Pool** IR1: ``` ip nat pool IR1_POOL 192.0.2.104 192.0.2.110 netmask 255.255.255.248 ``` IR2: ``` ip nat pool IR2_POOL 192.0.2.193 192.0.2.199 netmask 255.255.255.248 ``` --- ### **2.4 Dynamic NAT with Overload (PAT)** IR1: ``` ip nat inside source list NAT_CLIENTS pool IR1_POOL overload ``` IR2: ``` ip nat inside source list NAT_CLIENTS pool IR2_POOL overload ``` --- ### **2.5 Mark Interfaces** Principle: ``` interface ip nat inside interface ip nat outside ``` --- ## **3. Static NAT for HQ1-SRV1** ### **3.1 Requirements** - Inside IP: **10.10.100.101** - Public IPs: - via IR1 → **192.0.2.99** - via IR2 → **192.0.2.205** --- ### **3.2 Configure Static NAT** IR1: ``` ip nat inside source static 10.10.100.101 192.0.2.99 ``` IR2: ``` ip nat inside source static 10.10.100.101 192.0.2.205 ``` --- ## **4. Verification** ### **4.1 Check NAT Status** ``` show ip nat translations show ip nat statistics ``` --- ### **4.2 Functional Test** - Clients (VLAN 101/102): - ping / traceroute to **8.8.8.8** - translated source IP visible within the correct pool - Server: - external connections show: - via IR1 → 192.0.2.99 - via IR2 → 192.0.2.205 --- ## **Status** - Dynamic NAT (PAT) active for client VLANs - Separate public pools per Internet router implemented - Static NAT for HQ1-SRV1 configured correctly - Internet access and failover operational - Task requirements fully met