CCNA #035 NAT Troubleshooting Scenario 1 - Can you find the issue? CCNA Exam 200-125 troubleshooting

Key Takeaways

[Music] this is one of multiple videos discussing net network address translation this is a troubleshooting video we've been told that some hosts in the internal network are not able to access Google com in this example the company is using Google's DNS server for name resolution the server's IP address is 8 - today - today 2.8 which is found on the Internet in this topology I'm using genus 3 to simulate to this environment rider 2 is the broader that is configured for network address translation we've got three routers acting as hosts in our internal network and one router acting as an internet server so let's verify what we've been told on rider 1 which is acting as the PC on the top left can we paying a - today - today 2.8 yes we can now what about Radha five acting as our third PC can that ping Google doesn't look like it can debug IP packet it's definitely sending the packet so it's sending it somewhere show IP rot this Radha has a default gateway to tend at 1.3 door - 5 4 it's going to send it to Radha - you to speed up trace rod I'll do that and then let's see how far it gets on all that first try again so it gets to ten dot 103.2 five four and then it seems to die so it's sending the packet but not getting a response okay so it looks like there's a problem with NAT on router to the natural rata so I'm wrote it - let's have a look the first thing we'll do on writer - is debug IP NAT be careful doing these kind of d bugs in the real world you may get a lot of traffic in a production network and overwhelm the writer but because of the lab we can do that so I'll send one ping and see if anything happens with the net translations doesn't look like Matt's doing anything if rata one sends a packet notice Radha one gets translated it's Radha one is the PC at the top when it sends a ping traffic is matted so there the ping failed but here we got a reply that's because of ARP so notice there's the source traffic being mattered and here's the reply but if we send traffic from PC five acting as our third host in other words this host it looks like NAT doesn't take place in other words it's not translating the address show IP NAT translation these translations are all relating to host 1 they are dynamic net translations so they will expire after a period of time so we've already got one that expires but there's no entries for router 5 acting as our third PC and yeah you can see all the translations have expired so let's have a look at our net configuration for this host to be translated this interface needs to be configured as an inside interface and this interface needs to be configured as an outside interface now we've already got some hosts working so that makes the job easier so we can scroll through the configuration here's gigabit zero zero so that's the host of the top here IP NAT inside that looks good gigabit zero one is the outside interface and it's configured for IP net outside that's good gigabit zero - this device is also working configured for IP net inside this is the interface where we have the problem but it's also configured for IP NAT inside so it doesn't look like that's the problem scrolling down we see the nat statement IP nat inside source list one so this is using access list 1 and we are overloading gigabit zero one I can you see the problem what's the problem in this output notice it's referencing access list one access list one has a permit statement of 10.1.1.10 t4 10120 and then a 10100 this is an inverse mosque because it's an access list as a zero means match a 1 in binary means don't match so here we have a problem because the zero is matching 10 the zero is matching 1 and this zero is matching zero traffic is coming from 10 1.3 dot 3 so it's not being matched by this access list so we could remove the entire access list and re-edit it or delete that individual line but yeah I'm simply gonna say permit 10 1 3 0 with the correct mosque so we've got an extra entry you know access list so show access-list one here are our exes list entries on router five we'll do a ping notice that now succeeded let host or wasn't mattered because of this entry notice we got one match do that again two matches and notice here we see the actual net translation taking place so be careful with your access lists this was an example of a dynamic net entry referencing access list one so we had a problem in our access list where this entry was incorrectly configured notice the sequence numbers so what we could do is say IP access list standard one no 30 show IP access list so line 30 has been removed and we've only got the correct entries in our access list so the ping works there was the net and we've got another match on the access list so we've now solved the problem these hosts can ping the internet let's verify that so write a one campaign google write a four which is this pc can ping google and write a five can also pin google so we've successfully solved the problem we verified it don't forget as always in the real world or in your lab to save your configuration and don't forget to turn off your debugs they slow riders down typically and increase CPU utilization it's not a good idea to keep them running so in this lab we solved a network address translation issue if you enjoyed this video please like it and please subscribe to my youtube channel I wish you all the very best [Music]