Nat ACL Question?

Question

I am so confused with fundamentals that I used to be an expert in, so I have this topology

Please answer to my questions separately,

Question 1) So if I have two DNS severs, and ofc two IP address(81.1.1.30 & 31) available from the ISP

This config would be suffice for Port forwarding?

Switch3650(config)#ip nat inside source static 192.168.1.50 80 81.1.1.30 80

Switch3650(config)#ip nat inside source static 192.168.1.51 80 81.1.1.31 80

Switch3650(config)#int vlan 1

Switch3650(config-if)#ip nat inside

Switch3650(config)#int fa1/2

Switch3650(config-if)#ip nat outside

and configuration of my outside interface only has to have one IP address configured or two?

Switch3650(config)#int fa1/2

Switch3650(config-if)#ip add 81.1.1.30 255.255.255.254

**or** defining two ip addresses on my interface

Switch3650(config)#int fa1/2

Switch3650(config-if)#ip add 81.1.1.30 255.255.255.255

Switch3650(config-if)#ip add 81.1.1.31 255.255.255.255 secondary

am I achieving the same result here? so when do we use secondary ip, when we can't cover our available valid(public) IPs with subnet mask in one line?

so what will happen if I only put one ip address on the outside interface? the nat won't translate anymore, because it can't find the outside interface, because it's not listed in the routing table, right?

Switch3650(config-if)#ip add 81.1.1.30 255.255.255.255

Question 2)

so let's say I wanna PAT overload the rest of my network which they are not those two servers and they are clients with ip ranges from 192.168.1.1 to 192.168.1.49 how should I calculate the wild card mask?

Switch3650(config)#access-list 1 permit 192.168.1????????????

Switch3650(config)#ip nat inside source list 1  81.1.1.30 80 overload

this is what I put

**0 0** 0 0 0 0 0 1 = 1

**0 0** 1 1 0 0 0 1 = 49

according to this algorithm

Network Address is 0 which is wrong it has to be 1, because it starts from 1,

what am I missing?

the Netmask has to be I guess: 192 equal to wildcard of 63

Please please answer to all my questions, I am so confused

Thanks

Answer 1

1) You don't need to use IP address on the interface for NAT outside address at all. For your example, if you have 81.1.1.30/24 on your interface, you can use any other of 81.1.1.0/24 net for the NAT, 81.1.1.100 and 81.1.1.200, fo instance.

Also, your configuration with /32 mask (ip add 81.1.1.30 255.255.255.255) does not have much sense for me, how you can connect this to upstream?

2) if you need NAT addresses from 1 to 49 you need to split all address space to right subnets, for your example (1-49) it can be:

access-list 1 permit 192.168.1.1/32  
  access-list 1 permit 192.168.1.2/31  
  access-list 1 permit 192.168.1.4/30  
  access-list 1 permit 192.168.1.8/29  
  access-list 1 permit 192.168.1.16/28  
  access-list 1 permit 192.168.1.32/28  
  access-list 1 permit 192.168.1.49/32

It will work for (1-49), but it is very strange design for me, you can just use 192.168.1.0/27 (0-31) and 192.168.1.32/28 (32-47) for such thing.

Answer 2

As per your network topology and to accomplish your requirement in optimised way you can use both public IP address 81.1.1.30 & 81.1.1.31 both ip for static natting for incoming traffic to reach dns servers 192 .168.1.50 & 192.168.1 51 .example below

#Ip nat inside souce static 81.1.1.30 192.168.1.50 53

#ip nat inside source stati. 81.1.1.31 192.168.1.51 53

For your further requirements for outbound traffic for source ip range from 192.168.1.1 to192.168.1.49 clients to access internet resource. Then this traffic will be outbound inside to outside for this traffic.please create PAT overload nat configuration with interface allocate ip address 81.1.1.30 `#aacess-list 101 ip address 192.158.1.0 0.0.0.63

Here you can use /26 subnet wildcard mask it will provide 64 host . Your requirement is 49 client to ensure scalabilty and for future requirements 14 IPs can keep in reserve for future use

Nat overload configuration for nat translation for outbound traffic

#Ip nat inside souce list 101 interfàce Fa1/2 overload