zNetLaB › Guided labs › Enterprise
NAT — a pool out, and a server published in
Enterprise Intermediate 6 devices 5 checked tasks 100 points Plan lab
The office shares a block of public addresses on the way out, and the web server has to be reachable from outside by a public address of its own. Two different kinds of NAT, and the static one is the one that works in both directions. You build it in a browser, type real commands at each device, and every task below is
checked against the running configuration — so you find out it is wrong before anybody else does.
Open this lab in the simulator
The simulator runs in your browser with nothing to install. This lab is part of the full simulator: open it free for 7 days with a new account, then with a plan. It needs an account, which keeps your progress.
The scenario
The office shares a block of public addresses on the way out, and the web server has to be reachable from outside by a public address of its own. Two different kinds of NAT, and the static one is the one that works in both directions.
Your role: a network engineer on the enterprise team. Level: Intermediate Done when: all 5 goals show as passed (100 points).
Network status
Devices: 1 router, 1 switch, 2 PCs, 2 servers, cabled as drawn. No Layer 1 or Layer 2 faults: every link is connected and up. Edge starts with addresses (G0/0 192.168.1.1/24, G0/1 203.0.113.1/24) and an ACL already configured. PC1 is a host with 192.168.1.10/24, gateway 192.168.1.1. PC2 is a host with 192.168.1.11/24, gateway 192.168.1.1. WEB is a host with 192.168.1.80/24, gateway 192.168.1.1. Internet-Host is a host with 203.0.113.50/24, gateway 203.0.113.1. SW1 starts with an empty configuration. Known problems
None: nothing is misconfigured. The network is simply not finished: what the goals list is what you have to build or secure. Goals
The inside and outside interfaces are marked (10 pts) Outbound traffic is translated from a POOL, not the interface (25 pts) Two inside hosts get two different public addresses (20 pts) The web server is published at 203.0.113.80 (25 pts) …and the outside host reaches it by that address (20 pts) The activity, in order
The inside and outside interfaces are marked Why: NAT needs to know which side is inside; get it backwards and nothing translates. Verify with: show ip nat statistics Outbound traffic is translated from a POOL, not the interface Why: A pool gives each inside host a public address of its own, for as long as the pool lasts. Verify with: show ip nat translations Two inside hosts get two different public addresses Why: A ping needs a route in BOTH directions. This is the end-to-end proof that everything before it worked. Verify with: ping 203.0.113.50 The web server is published at 203.0.113.80 Why: Static NAT gives an inside server one fixed public address so outsiders can reach it. Verify with: show ip nat translations …and the outside host reaches it by that address Why: A ping needs a route in BOTH directions. This is the end-to-end proof that everything before it worked. Verify with: ping 203.0.113.80 Tips
Work in the order given: later goals depend on the earlier ones. After every change, run the verify command before moving on; do not guess. Stuck? Read the verify output first. It names the interface, neighbour or route that is wrong. Why this matters
The office shares a block of public addresses on the way out, and the web server has to be reachable from outside by a public address of its own. Two different kinds of NAT, and the static one is the one that works in both directions.
What you will be able to do
The inside and outside interfaces are marked
Outbound traffic is translated from a POOL, not the interface
Two inside hosts get two different public addresses
The web server is published at 203.0.113.80
The network
ISR 2921, Catalyst 2960-24TT, PC, Server — 6 devices in all, already cabled.
Gi0/0 192.168.1.1/24 Fa0/1 Fa0/10 Fa0 Fa0/11 Fa0 Fa0/12 Fa0 Gi0/1 203.0.113.1/24 Fa0 Edge SW1 PC1 192.168.1.10/24 · gw 192.168.1.1 PC2 192.168.1.11/24 · gw 192.168.1.1 WEB 192.168.1.80/24 · gw 192.168.1.1 Internet-Host 203.0.113.50/24 · gw 203.0.113.1 Drawn from this lab: devices, cables, ports and the addresses already set. Device Model Address already set
Edge ISR 2921 configure it SW1 Catalyst 2960-24TT configure it PC1 PC 192.168.1.10 / 255.255.255.0 gw 192.168.1.1 PC2 PC 192.168.1.11 / 255.255.255.0 gw 192.168.1.1 WEB Server 192.168.1.80 / 255.255.255.0 gw 192.168.1.1 Internet-Host Server 203.0.113.50 / 255.255.255.0 gw 203.0.113.1
Cabling
Edge Gi0/0 ↔ SW1 Fa0/1 SW1 Fa0/10 ↔ PC1 Fa0 SW1 Fa0/11 ↔ PC2 Fa0 SW1 Fa0/12 ↔ WEB Fa0 Edge Gi0/1 ↔ Internet-Host Fa0
What is configured at the start
These are already configured when the lab opens — including, where this is a troubleshooting lab, the fault itself:
Edge interface GigabitEthernet0/0
ip address 192.168.1.1 255.255.255.0
no shutdown
exit
interface GigabitEthernet0/1
ip address 203.0.113.1 255.255.255.0
no shutdown
exit
access-list 1 permit 192.168.1.0 0.0.0.255 Tasks, and how each one is checked
Every task is decided by reading the live network — a neighbour in FULL, a ping that succeeds, a line in the running configuration — not by looking for a keyword you typed. The same command shows you what the lab sees.
# Task Pts How to verify it yourself
1 The inside and outside interfaces are marked 10 On Edge: show ip nat statistics — Gi0/0 is inside. and On Edge: show ip nat statistics — Gi0/1 is outside. 2 Outbound traffic is translated from a POOL, not the interface 25 Checked automatically against the device’s live state (natPool). 3 Two inside hosts get two different public addresses 20 On PC1: ping 203.0.113.50 must succeed. and On PC2: ping 203.0.113.50 must succeed. 4 The web server is published at 203.0.113.80 25 Checked automatically against the device’s live state (natStatic). 5 …and the outside host reaches it by that address 20 On Internet-Host: ping 203.0.113.80 must succeed.
Stuck? Ask the coach
Tell the coach what you see or what you tried. It gives you a hint, not the answer, the way a senior engineer would. Included with a free trial or any plan.
Ask the coach
Reference solution
Try it yourself first — the lab checks your work either way. This is one configuration that makes every task pass, device by device:
Edge interface GigabitEthernet0/0
ip nat inside
exit
interface GigabitEthernet0/1
ip nat outside
exit
ip nat pool OFFICE 203.0.113.10 203.0.113.20 netmask 255.255.255.0
ip nat inside source list 1 pool OFFICE
ip nat inside source static 192.168.1.80 203.0.113.80 Where this is examined
This lab practises these topics in the zNetLaB certification courses:
Related labs
Where to start
The lessons all guided labs plans
CCNA®, CCNP® and Cisco® are trademarks of Cisco Systems, Inc. zNetLaB is not affiliated with or endorsed by Cisco.