PAT for a branch LAN, and static NAT that publishes its web server

Steps

1. Place the devices and cable them as the Topology lists. Use the automatic connection type (the lightning-bolt cable) for every link, so Packet Tracer picks straight-through or cross-over for you. Give PC1, PC2, SRV1 and SRV2 their addresses and gateways in Desktop > IP Configuration. On SRV1, open Services > HTTP, edit index.html so that its text reads SRV1 branch web server, and save it: both servers serve the same default page otherwise, and you need to tell them apart.
2. Configure ISP1. It knows its two connected networks and one static route for the public block 203.0.113.16/28 that it has assigned to the branch. It has no route to 192.168.19.0/24, and it never will: an ISP does not route private space.

Router> enable
Router# configure terminal
Router(config)# hostname ISP1
ISP1(config)# interface GigabitEthernet0/0/0
ISP1(config-if)# ip address 203.0.113.6 255.255.255.248
ISP1(config-if)# no shutdown
ISP1(config-if)# interface GigabitEthernet0/0/1
ISP1(config-if)# ip address 198.51.100.1 255.255.255.0
ISP1(config-if)# no shutdown
ISP1(config-if)# exit
ISP1(config)# ip route 203.0.113.16 255.255.255.240 203.0.113.5

3. Configure R1's addresses and a default route towards the ISP:

Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# interface GigabitEthernet0/0/0
R1(config-if)# ip address 192.168.19.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# interface GigabitEthernet0/0/1
R1(config-if)# ip address 203.0.113.5 255.255.255.248
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.6

From PC1 run C:\> ping 198.51.100.80. Expect Request timed out. four times: the request reaches SRV2, but the reply is addressed to 192.168.19.10, and ISP1 has no route to it. This is the problem NAT solves. 4. Configure PAT, but deliberately mark only the outside interface. The ACL names the inside hosts to translate (a wildcard, not a mask), and overload makes R1 share G0/0/1's own address between them:

R1(config)# access-list 1 permit 192.168.19.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/0/1 overload
R1(config)# interface GigabitEthernet0/0/1
R1(config-if)# ip nat outside
R1(config-if)# end

Ping 198.51.100.80 from PC1 again. It still times out. 5. Find the fault with the lesson's first troubleshooting check. R1# show ip nat translations lists no entries at all, and R1# show ip nat statistics lists GigabitEthernet0/0/1 as an outside interface and nothing as an inside interface. NAT only translates packets that arrive on an inside interface, so fix it:

R1# configure terminal
R1(config)# interface GigabitEthernet0/0/0
R1(config-if)# ip nat inside
R1(config-if)# end

Ping 198.51.100.80 from PC1 once more: the replies now arrive. The first may time out while ARP resolves. 6. Generate some sessions to read. On PC1 and on PC2, open Desktop > Web Browser and browse to http://198.51.100.80. Then, within a minute:

R1# show ip nat translations

Both inside local addresses, 192.168.19.10 and 192.168.19.11, map to the same inside global address, 203.0.113.5, told apart only by port: that is PAT. The outside local and outside global columns are identical, 198.51.100.80:80, because nobody rewrites the server's address. 7. Publish SRV1 with a static entry: inside local first, inside global second. 203.0.113.20 is in the /28 that ISP1 routes to R1:

R1# configure terminal
R1(config)# ip nat inside source static 192.168.19.50 203.0.113.20
R1(config)# end

On SRV2, open Desktop > Web Browser and browse to http://203.0.113.20: the page reads SRV1 branch web server. An outside host opened that session, which only works because a static entry exists all the time. 8. Clear the dynamic entries and look again:

R1# clear ip nat translation *
R1# show ip nat translations

The PAT rows are gone, and the static row stays, with dashes in the outside columns when no session is using it. Static entries never time out and are never cleared this way.