Hi, this is your host Habib zecharia. And this is our last topology in this course and this is about provisioning internet access for an organization using Nat overload. As I mentioned before, Nat overload is the only way to provide Internet access to an organization. In this topology, we will complete task one which is configuring the LAN topology, we will create Nat overload policy we will test the PC one and see if it can access the remote or the internet PC over the internet. And we will verify if this router which is our edge router is going to do Nat translations for us. In a very simplistic way, I mean this land topology can be expanded to a lot more switches and the IP scheme can be you know, increased to multiple VLANs for each floors, so you can have as many floors as you want you can assign different VLANs to different floors.

And that is covered part of the campus design network that I will be doing in the future. But for now, this will be quite enough to understand how internet access is provided to an organization. So, let's start we will start first by configuring the core switch here and and we will move on from there and go up. So this is our bring up the core switch console. That's the core switch console right here. So the first thing we will do is Basically, we will try to do the necessary configuration.

And see we will go from here is we will assign VLANs first VLAN 99 name we'll call it management VLAN 11 name. I'll call it first floor IP address. VLAN 99 is actually considered to be the management VLAN of the course which sort of course which will have 172 dot 20 dot 99 dot one as its IP address. And if you will add more switches, you can increment that from dot One, two dot two dot three dot four dot three. The reason why VLAN 99 is because it's a best practice instead of using VLAN one as its management VLAN VLAN 99 or any other VLAN is recommended. Oh, that's good.

And let's add now. interface VLAN 11 ip Address 172 dot 20 dot 11 dot 1255255255 to zero, no shot. There's one more. One more IP I need to assign, which is the core link with the router and that is the interface gi two slash zero. As you can see, I'm going to make it a routed port. And I'll assign it dot two of this network here and that this network is our transient network.

And yes, so let's do that interface gi two slash zero IP address 172 dot 20 dot 10 dot two 255255255252 so because this is a routed port, I cannot just put an IP address so I have to say no switch ports. And I wanted you to see that actually, IP address 172 dot 20 dot 10 dot 2255 255-225-5252. And I'll say it no shut. Now let's verify. So yes we have VLAN 11, VLAN, 99 and VLAN and and the port gig two slash zero and it has its routed port IP address. That's great.

Now VLAN 99 is showing as down the reason is we need to add another switch and give it an IP address. It's down. So let's see. So here this interface need to be part of VLAN 11, which is the interface that's connected to that is facing pc one. pc one will get its network connectivity from core one. So let's do that.

And this is how you assigned a VLAN to the port Okay, so interface gi one slash one, switch. switch port, mode access, switch, port, access VLAN 11 No shut. So that's good. When it comes to campus network design as you know, you have to do few important things. Number one is you know, the VTP mode should be transparent. There are other things we could do you know, like, as Spanning Tree Protocol bridge port should be, the priority should be lower.

And as you can see, I mean, it's important to do those things. So you understand how, how you can, you know, design, how you can design the LAN topology. So, I'm just gonna add those configurations just to benefit the audience here. So, little bit of information on how to design the actual ports. So VTP mode I have added in transparent that's one thing. The other thing we could do is you could add spanning tree mode and make it rapid p vs t that's rapid spanning tree.

And the other thing we can do is we can make the VLAN which is VLAN, 9011 and 99. To have a lower priority, Java lower priority of four zero 96. This makes the course which to be a bridge router or a bridge course which it will have its priority as for zero 96 From the default, so if you add any other switch on the network, those priorities are default to three to 786. And because they have higher priority, they will all report back to this course which Okay, so that's the idea of, of lowering the priority for the spanning tree. Okay, and this is again part of the course that is supposed to be campus design network and hoping to bring a discourse down the road. So stay tuned for those courses.

So this this switch is completely configured. Now there's one more thing we need to do. And that is, it will come up but let's bring up the PC one here and assign it VLAN 11 IP address Okay, so let's do that. As you can see, there's no IP given to this PC. So let's give it Doc 10 172 dot 20 dot 11 dot one. That's the default gateway IP address for this pc one.

So let's see if I can ping 172 dot 20 dot 11 dot one. Now, I shouldn't be able to ping it but I'm able to ping it because this is a simulation. Sometimes you know, it may not ping but the reason why it is not supposed to pain is because we did not do that. IP routing here and by adding the IP routing, I should be able to see all the routes and also all the SPI should be able to ping each other by adding IP routing. So this is done I mean the PC is able to ping the default gateway. That's what we want it to know and it's pinging.

That's great. Now let's move to the to the router configuration are one just bringing up the console here Okay, so we have the console here and if I do show IP interface brief, as you can see I have two interface three interfaces here, gig one slash zero and gig two slashes zero. So let's start configuring they're in the interfaces here so called the interface gi, one slash zero. Let's give it an IP address 121 90 dot 2255 to 255-225-5248. No shot. And then we have another interface G, two slashes zero And the IP address of that one is going to be 172 dot 20 dot 10 dot 1-255-225-5225 52252 and OSHA.

Now, we should be able to ping the default IP address to the internet which is ping 122 190 dot one. Yes, I can ping it. That's wonderful. So this so basically the topology configuration is completed now we need to add the routing on on this router as well as on the course which so let's bring up the course which again So let's add the default route on the course with so we will say t IP Route Zero dot zero dot zero for the networks and zero dot zero dot zero dot zero for the key for the subnet mask. And the next hop IP address is the IP address of the router which is the edge router. And that's going to be 172 dot 20 dot 10 dot one.

And that's the IP address that we just configured on the router. Let's save that. Now from the core. Let me let me actually ping to the edge router from here. And yes, I can ping it. So if I do show IP route, I should have the default Static route, which is this one, as you can see.

All right, perfect. So we did that now. Let's bring up the router itself. Now, when it comes to the router, there's few things that we need to do. As you know, one thing is we need to assign a default route on this edge router that will point all the traffic that's not in the routing table to the internet, right? So that's important to do so called t IP route.

And that's an A B hundred 20 dot 119 dot one. All right, so that is done. There will be another another route that we need to add which is basically Which will identify the internal network and the path to the internal network, right. So we need to add that so IP route 172 dot 20 dot zero dot 00 dot zero dot subnet mask is 255255 dot zero dot zero. That's the summary IP scheme of the internal LAN. So it's a Class B network.

That's what we are assigning. And the next hop IP address is the core of the LAN. IP. That's all we needed to do here. Now, now this is good. Now we did that that's perfect.

The only thing we need to do Now we are moving into this data into the net overload configuration. So we finished task one. For task two to create a policy we need to do the following. Number one, we need to create an access list. And that will identify the IP range of the internal LAN. So let's do that.

So IP access list extended. Right and let's call it basically Nat. Okay. And here we will say permit. ip 172 dot 20 dot zero dot 00 dot zero dot 255255. We are using the class p Wildcat mask And let's exit from here.

Now we will add a route map route map and let's call it pm policy map permit 10. Right. And and it needs to match an IP address so it's a match IP address. Not perfect. So we did that now. Let's exit that.

Now we will have to add a statement for the overload and we will say IP Nat inside source Inside source route map, pm interface, one, zero and I'll say overload. So now we completed the configuration of the NAT overload. The only thing we need to do is to identify the inside Nat and outside Nat interfaces. So we know from our topology for our topology here, gig one slash zero is our outside Nat and get to slicer is our inside that so let's start with interface g two slash zero. And I'll say IP Nat inside. And let's go to interface one slash zero.

And I'll say IP net outside Let's save our configuration. Perfect. Now the only thing we need to do now is we will test the internet PC here and see the connectivity from r1 to the internet PC. Using an internal interface, we will source that internal interface which is going to be two gig two slash zero. So let's do that. So let's ping, ping 10 dot 10 dot 10 dot 10.

That's the IP address of the internal PC. I should have mentioned that before. But I think we have been using the same IP address all along so and I'll say source get to slash zero. And let's see. And yes, it's pinging which is perfect. Now, the other test we need to do is go into pc one and see if we can ping it.

So So show IP let's verify we have the IP and let's ping that outside PC. And yes you can see we have successful results. One more thing we need to do is go into the edge router itself and to show IP Nat translations and as you can see, I mean we are able to get out to the internet as you can see, we are pinging it. But the inside global IP address will always show that the which is the basically the public IPs So far our router, right, it's going out as in, it's going out showing the public IP address. And that's what the translation is for. Right?

And it's going, it's going through doing its translation, these are the port numbers. And that's how it works actually, any other PC on the land, if it's gonna go to the internet, it's gonna have the same IP address, but different port and it's going to translate it the router is going to translate it and basically provide access to the internet in this manner. And with this, we have concluded the last chapter of this course I hope you have enjoyed this course as much as I did, and I hope I have provided a very important practical experience here. My recommendation is as a homework is to really build up your own network topology and play with the different types of Nat, which is the NAT overload. And if you look into my previous lessons we have covered Nat static static Nat and and we also did the port address translation or the dynamic Nat.

I hope I'll see you again soon in a different course. Thank you very much. Take care. Bye bye