400-007 · Question #84
Two enterprise networks must be connected together. Both networks are using the same private IP addresses. The client requests from both sides should be translated using hide NAT (dynamic NAT) with…
The correct answer is D. Two different NAT pools must be used for the ip nat inside source and the ip nat outside source. When two networks share overlapping address space and a single router must perform bidirectional hide NAT, two separate NAT pools are required - one for ip nat inside source and one for ip nat outside source - to uniquely translate traffic in each direction.
Question
Two enterprise networks must be connected together. Both networks are using the same private IP addresses. The client requests from both sides should be translated using hide NAT (dynamic NAT) with the overload feature to save IF addresses from the NAT pools. Which design addresses this requirement using only one Cisco I OS NAT router for both directions?
Options
- AThis is not possible, because two Cisco IOS NAT routers are required to do dynamic NAT, with
- BThe ip nat inside and ip nat outside commands must be configured at the interfaces with the
- CThe overload feature is the default and does not have to be configured.
- DTwo different NAT pools must be used for the ip nat inside source and the ip nat outside source
- EThe Nat Virtual interface must be used to achieve this requirement.
How the community answered
(46 responses)- A2% (1)
- B20% (9)
- C11% (5)
- D63% (29)
- E4% (2)
Why each option
When two networks share overlapping address space and a single router must perform bidirectional hide NAT, two separate NAT pools are required - one for ip nat inside source and one for ip nat outside source - to uniquely translate traffic in each direction.
A single Cisco IOS router is fully capable of performing bidirectional dynamic NAT using the ip nat inside source and ip nat outside source commands together, making two routers unnecessary.
Configuring ip nat inside and ip nat outside on the interfaces is required but is only the interface-level prerequisite; without two separate pools and source statements, overlapping addresses cannot be correctly translated in both directions.
The overload keyword must be explicitly appended to the ip nat inside source or ip nat outside source statement; PAT overload is not enabled by default in Cisco IOS NAT configuration.
Cisco IOS supports simultaneous ip nat inside source and ip nat outside source statements on a single router, enabling translation in both directions. Two distinct NAT pools must be used so that each translation domain maps to a unique non-overlapping address range, allowing the router to correctly identify and reverse-translate return traffic for both sides.
NAT Virtual Interface (NVI) uses a single interface model that removes the inside/outside distinction, but it does not by itself resolve the requirement for two separate pools to handle bidirectional translation of overlapping address spaces.
Concept tested: Bidirectional NAT with overlapping address spaces on single router
Source: https://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/13774-nat-overlap.html
Topics
Community Discussion
No community discussion yet for this question.