# Nat ACL Question?

I am so confused with fundamentals that I used to be an expert in, so I have this topology

Question 1) So if I have two DNS severs, and ofc two IP address(81.1.1.30 & 31) available from the ISP

This config would be suffice for Port forwarding?

Switch3650(config)#ip nat inside source static 192.168.1.50 80 81.1.1.30 80

Switch3650(config)#ip nat inside source static 192.168.1.51 80 81.1.1.31 80

Switch3650(config)#int vlan 1

Switch3650(config-if)#ip nat inside

Switch3650(config)#int fa1/2

Switch3650(config-if)#ip nat outside


and configuration of my outside interface only has to have one IP address configured or two?

Switch3650(config)#int fa1/2

**or** defining two ip addresses on my interface

Switch3650(config)#int fa1/2



am I achieving the same result here? so when do we use secondary ip, when we can't cover our available valid(public) IPs with subnet mask in one line?

so what will happen if I only put one ip address on the outside interface? the nat won't translate anymore, because it can't find the outside interface, because it's not listed in the routing table, right?

Switch3650(config-if)#ip add 81.1.1.30 255.255.255.255


Question 2)

so let's say I wanna PAT overload the rest of my network which they are not those two servers and they are clients with ip ranges from 192.168.1.1 to 192.168.1.49 how should I calculate the wild card mask?

Switch3650(config)#access-list 1 permit 192.168.1????????????

Switch3650(config)#ip nat inside source list 1  81.1.1.30 80 overload


this is what I put

**0 0** 0 0 0 0 0 1 = 1

**0 0** 1 1 0 0 0 1 = 49


according to this algorithm

Network Address is 0 which is wrong it has to be 1, because it starts from 1,

what am I missing?

the Netmask has to be I guess: 192 equal to wildcard of 63

Thanks

• I know this is a packet-tracer picture, but I can't get passed the fact that Cisco Switches don't do NAT. Also, to specify ports in NAT, you also have to specify tcp or udp. Commented Aug 13, 2019 at 5:59
• 6500 series does Commented Aug 13, 2019 at 6:10
• Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer. Commented Nov 19, 2022 at 21:45

1) You don't need to use IP address on the interface for NAT outside address at all. For your example, if you have 81.1.1.30/24 on your interface, you can use any other of 81.1.1.0/24 net for the NAT, 81.1.1.100 and 81.1.1.200, fo instance.

Also, your configuration with /32 mask (ip add 81.1.1.30 255.255.255.255) does not have much sense for me, how you can connect this to upstream?

2) if you need NAT addresses from 1 to 49 you need to split all address space to right subnets, for your example (1-49) it can be:

access-list 1 permit 192.168.1.1/32
access-list 1 permit 192.168.1.2/31
access-list 1 permit 192.168.1.4/30
access-list 1 permit 192.168.1.8/29
access-list 1 permit 192.168.1.16/28
access-list 1 permit 192.168.1.32/28
access-list 1 permit 192.168.1.49/32


It will work for (1-49), but it is very strange design for me, you can just use 192.168.1.0/27 (0-31) and 192.168.1.32/28 (32-47) for such thing.

• yes that was just an example but thx for bringing it, because you need 1 IP with all host 0bits for NET and 1 IP with all 1 bits host for BCast, so 2 ip from the range is already allocated which makes 32 bits mask too short for usage, can you elaborate then when does secondary IP addresses on an interface come handy? Commented Aug 13, 2019 at 6:05

As per your network topology and to accomplish your requirement in optimised way you can use both public IP address 81.1.1.30 & 81.1.1.31 both ip for static natting for incoming traffic to reach dns servers 192 .168.1.50 & 192.168.1 51 .example below

#Ip nat inside souce static 81.1.1.30 192.168.1.50 53

#ip nat inside source stati. 81.1.1.31 192.168.1.51 53

For your further requirements for outbound traffic for source ip range from 192.168.1.1 to192.168.1.49 clients to access internet resource. Then this traffic will be outbound inside to outside for this traffic.please create PAT overload nat configuration with interface allocate ip address 81.1.1.30 #aacess-list 101 ip address 192.158.1.0 0.0.0.63

Here you can use /26 subnet wildcard mask it will provide 64 host . Your requirement is 49 client to ensure scalabilty and for future requirements 14 IPs can keep in reserve for future use

Nat overload configuration for nat translation for outbound traffic

#Ip nat inside souce list 101 interfàce Fa1/2 overload`