1. Cisco Confidential 1 © 2010 Cisco and/or its affiliates. All rights reserved. Understanding and troubleshooting of Nat address Translation( NAT) and IP Routing Protocols Manas R Moothedath Sumit Kothiyal

2. © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2 NAT – A Practical approach Basic working of NAT Different types of NAT Typical NAT deployment scenarios Best practices for NAT deployment Troubleshooting IP Routing Protocols – I Why - Routing Protocols? Types of Routing Protocols Basic configuration and working of EIGRP Basic configuration and working of OSPF

3. NAT - A PRACTICAL APPROACH

4. Cisco Confidential 4 © 2013-2014 Cisco and/or its affiliates. All rights reserved. AGENDA Why do we need NAT? Different types of NAT Case Studies Best Practices for NAT deployment

5. Cisco Confidential 5 © 2013-2014 Cisco and/or its affiliates. All rights reserved. WHY NAT? Security Hide user identity IPv4 Address exhaustion Reference 1:Many

6. Cisco Confidential 6 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Different Flavors of NAT: 1. Static NAT I. 1:1 Static NAT II. Port address translation (Port Forwarding) 2. Dynamic NAT I. 1:1 Dynamic NAT II. Dynamic NAT with overload

7. Cisco Confidential 7 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Common Scenarios

8. Cisco Confidential 8 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Scenario 1: 10 users to access internet 10 Public IPs

9. Cisco Confidential 9 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Scenario 1: 10 users to access internet 10 Public IPs

10. Cisco Confidential 10 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Scenario 2: 10 users grown to 500 users! 10 Public IPs

11. Cisco Confidential 11 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Scenario 2: 10 users grown to 500 users! 10 Public IPs

12. Cisco Confidential 12 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Scenario 3: Single Public IP Single Server

13. Cisco Confidential 13 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Scenario 3: Single Servers Single Public IP

14. Cisco Confidential 14 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Scenario 4: Multiple Servers Single Public IP

15. Cisco Confidential 15 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Scenario 4: Multiple Servers Single Public IP

16. Cisco Confidential 16 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Different types of NAT addresses: SRC: IL DST: OL SRC: OL DST: OG IL = Inside Local = 192.168.1.1 OL = Outside Local = 100.100.100.100 IG = Inside Global = 1.1.1.1 OG = Outside Global = 100.100.100.100

17. Cisco Confidential 17 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Special Scenarios

18. Cisco Confidential 18 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Scenario 1: Multiple ISPs in place High number of inside users Dual-Homed Setup

19. Cisco Confidential 19 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Scenario 1: Multiple ISPs in place High number of inside users Dual-Homed Setup

20. Cisco Confidential 20 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Scenario 2: Partner Server access Protected Server Partner in Outside domain

21. Cisco Confidential 21 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Scenario 2: Partner Server access Protected Server Partner in Outside domain

22. Cisco Confidential 22 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Commonly Fallacies

23. Cisco Confidential 23 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Scenario 1: Missing the ‘match interface’ in dual-homed High number of inside users Dual-Homed Setup Route lookup ? ? ? ?

24. Cisco Confidential 24 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Scenario 2: Trying to access 1 Server with 2+ ISPs High number of inside users Dual-Homed Setup

25. Cisco Confidential 25 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Scenario 2: Trying to access 1 Server with 2+ ISPs

26. Cisco Confidential 26 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Some more Pitfalls: 1.wrong network mask in pool. 1.permit ip any any in a NAT ACL 1.log in the ACL. 1.NAT Exemption for VPN traffic.

27. IP Routing Protocols – Part 1

28. Cisco Confidential 28 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Agenda EIGRP – Salient Features EIGRP Dual Algorithm The EIGRP Hello OSPF – Salient Features OSPF – Working OSPF – Things to remember

29. Cisco Confidential 29 © 2013-2014 Cisco and/or its affiliates. All rights reserved. EIGRP – Salient Features Shares an update only when there is a change. Has ‘triggered’ updates to neighbors Supports VLSM by design Holds more information about neighbors Summarize routes. And do it anywhere!!! :D Reliable packets – uses RTP Complex metric calculation (DUAL) and loop prevention.

30. Cisco Confidential 30 © 2013-2014 Cisco and/or its affiliates. All rights reserved. The DUAL algorithm e0/0 e1/0 e0/0 e1/1 R1 R2 R3 R4 R5 EIGRP Tables: a) Neighbor Table – Shows neighbors b) Topology Table – EIGRP topology c) Routing Table – The RIB/FIB on the router Successor – The best route to a certain network. Feasible Successor – a second best failback route to a destination. Feasibility Criteria: RD < FD Feasible Distance (FD) – Metric of the successor Reported Distance(RD) – Metric reported from the neighbor

31. Cisco Confidential 31 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Hello! Lets bring up EIGRP between R1 and R2. Basic configuration snippet: router eigrp network 192.168.x.0 0.0.0.255 Things that need to match. a) AS Number b) Authentication (If configured) c) K-Values

32. Cisco Confidential 32 © 2013-2014 Cisco and/or its affiliates. All rights reserved. Merits of EIGRP Highly scalable if properly designed Simple to Implement (potential pitfall) Very Fast convergence due to Feasible successor Best protocol for a DMVPN scaled network Supports Stubs Summarize anywhere Silent Protocol - Only triggered updates

33. Cisco Confidential 33 © 2013-2014 Cisco and/or its affiliates. All rights reserved. OSPF - Salient Features Open standard. Entire view of the area. Classless Summarize only on ABRs and ASBRs Periodically refreshes the LSAs (30 minutes) Can be scaled by splitting into areas and summarizing.

34. Cisco Confidential 34 © 2013-2014 Cisco and/or its affiliates. All rights reserved. OSPF – Working Brings up neighbor after exchanging hellos Neighbor table build Exchanges the LSAs OSPF Database populated SPF is run Routing table is populated Periodically floods LSAs

35. Cisco Confidential 35 © 2013-2014 Cisco and/or its affiliates. All rights reserved. OSPF – Things to remember Support different area types depending on design Has different types of LSAs Summary LSA is not summarization Inter-area traffic passes through the ABR All areas must connect to backbone (Area 0)

36. Thank you.