nerdexam
Cisco

400-007 · Question #84

Two enterprise networks must be connected together. Both networks are using the same private IP addresses. The client requests from both sides should be translated using hide NAT (dynamic NAT) with…

The correct answer is D. Two different NAT pools must be used for the ip nat inside source and the ip nat outside source. When two networks share overlapping address space and a single router must perform bidirectional hide NAT, two separate NAT pools are required - one for ip nat inside source and one for ip nat outside source - to uniquely translate traffic in each direction.

Designing Network Infrastructure

Question

Two enterprise networks must be connected together. Both networks are using the same private IP addresses. The client requests from both sides should be translated using hide NAT (dynamic NAT) with the overload feature to save IF addresses from the NAT pools. Which design addresses this requirement using only one Cisco I OS NAT router for both directions?

Options

  • AThis is not possible, because two Cisco IOS NAT routers are required to do dynamic NAT, with
  • BThe ip nat inside and ip nat outside commands must be configured at the interfaces with the
  • CThe overload feature is the default and does not have to be configured.
  • DTwo different NAT pools must be used for the ip nat inside source and the ip nat outside source
  • EThe Nat Virtual interface must be used to achieve this requirement.

How the community answered

(46 responses)
  • A
    2% (1)
  • B
    20% (9)
  • C
    11% (5)
  • D
    63% (29)
  • E
    4% (2)

Why each option

When two networks share overlapping address space and a single router must perform bidirectional hide NAT, two separate NAT pools are required - one for ip nat inside source and one for ip nat outside source - to uniquely translate traffic in each direction.

AThis is not possible, because two Cisco IOS NAT routers are required to do dynamic NAT, with

A single Cisco IOS router is fully capable of performing bidirectional dynamic NAT using the ip nat inside source and ip nat outside source commands together, making two routers unnecessary.

BThe ip nat inside and ip nat outside commands must be configured at the interfaces with the

Configuring ip nat inside and ip nat outside on the interfaces is required but is only the interface-level prerequisite; without two separate pools and source statements, overlapping addresses cannot be correctly translated in both directions.

CThe overload feature is the default and does not have to be configured.

The overload keyword must be explicitly appended to the ip nat inside source or ip nat outside source statement; PAT overload is not enabled by default in Cisco IOS NAT configuration.

DTwo different NAT pools must be used for the ip nat inside source and the ip nat outside sourceCorrect

Cisco IOS supports simultaneous ip nat inside source and ip nat outside source statements on a single router, enabling translation in both directions. Two distinct NAT pools must be used so that each translation domain maps to a unique non-overlapping address range, allowing the router to correctly identify and reverse-translate return traffic for both sides.

EThe Nat Virtual interface must be used to achieve this requirement.

NAT Virtual Interface (NVI) uses a single interface model that removes the inside/outside distinction, but it does not by itself resolve the requirement for two separate pools to handle bidirectional translation of overlapping address spaces.

Concept tested: Bidirectional NAT with overlapping address spaces on single router

Source: https://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/13774-nat-overlap.html

Topics

#NAT#overlapping IP addresses#dynamic NAT overload#NAT Virtual Interface

Community Discussion

No community discussion yet for this question.

Full 400-007 Practice