[Day 11] 4. Dynamic NAT

In Dynamic NAT, there is a many-to-many mapping between private IP addresses and a pool of public IP addresses. Unlike static NAT, where a specific private IP is permanently mapped to a public IP, Dynamic NAT automatically assigns a public IP from a predefined pool to internal devices when they need to communicate outside the network. Once the internal device no longer needs the public IP, that IP can be returned to the pool for other internal devices to use.

This method is ideal when you have more internal devices than available public IP addresses but don't need them all to be online simultaneously.

How Dynamic NAT works?

Access Control List (ACL) to Define Inside Addresses: First, you define which internal (private) IP addresses will be translated to the external (public) IP addresses. This is done using an Access Control List (ACL).
```
A(config)#access-list 15 permit 172.16.10.0 0.0.0.255
```
- ACL 15 permits all devices in the range
```
172.16.10.0 - 172.16.10.255
```
  (a /24 network) to be translated.
- The wildcard mask
```
0.0.0.255
```
  means the last octet can vary (i.e., all addresses from
```
172.16.10.0
```
  to
```
172.16.10.255
```
  are included).
Define the NAT Pool: You create a pool of public IP addresses from which NAT will dynamically assign public IPs to the private devices. Each device will be dynamically assigned one of these public IPs when it initiates a connection to the outside world.
```
A(config)#ip nat pool sunbeam 202.208.220.1 202.208.220.6 netmask 255.255.255.248
```
- This command defines a pool called
```
sunbeam
```
  that includes the public IPs
```
202.208.220.1
```
  to
```
202.208.220.6
```
  .
- The netmask
  255.255.255.248
  indicates a subnet that supports 6 usable IP addresses.
- Alternatively, you can use the
```
prefixlength 29
```
  instead of
```
netmask 255.255.255.248
```
  :
```
A(config)#ip nat pool sunbeam 202.208.220.1 202.208.220.6 prefix-length 29
```
- Both options result in the same pool size.
Link the ACL to the NAT Pool: You then link the access list (which defines the inside local addresses) to the NAT pool (which defines the inside global addresses). This tells the router which internal addresses to translate and from which pool to assign public IPs.
```
A(config)#ip nat inside source list 15 pool sunbeam
```
- This command tells the router to dynamically translate the addresses permitted by ACL 15 (the private network
```
172.16.10.0/24
```
  ) to one of the public IPs from the sunbeam pool (
```
202.208.220.1 - 202.208.220.6
```
  ).

Steps to Complete Dynamic NAT Setup:

Define Interfaces: As with Static NAT, you must specify the inside and outside interfaces:
```
A(config)#int g0/0
```
```
A(config-if)#ip nat inside
```
- ```
g0/0
```
  is the inside interface (facing the private network).
```
A(config)#int g0/1
```
```
A(config-if)#ip nat outside
```
- ```
g0/1
```
  is the outside interface (facing the public network, i.e., the internet).

NAT Table Behavior:

With Dynamic NAT, the NAT table is dynamically populated as internal devices initiate connections. Here’s how the table would look in real-time usage:

|Inside Local|Inside Global| |---|---| |172.16.10.2|202.208.220.1| |172.16.10.3|202.208.220.2| |172.16.10.4|202.208.220.3|

When an internal device (e.g.,
```
172.16.10.2
```
) initiates a connection, it's dynamically assigned an available public IP (e.g.,
```
202.208.220.1
```
).
If all public IPs are assigned and more devices request external communication, those devices will have to wait until an IP is freed up from the pool.

Advantages of Dynamic NAT:

Efficient IP Usage: It allows efficient use of a limited pool of public IPs. As not all devices need to communicate at the same time, the same public IP can be reused when available.
Simple Configuration: Easier to configure when compared to Static NAT, as mappings are dynamically assigned instead of fixed.
Flexible: Internal devices can be dynamically assigned any available public IP from the pool, providing more flexibility in managing connections.
Tough to get hacked: As the IPs are changed frequently, hacker has to guess the currently allocated IP.

[Day 11] 4. Dynamic NAT

How Dynamic NAT works?

Steps to Complete Dynamic NAT Setup:

NAT Table Behavior:

Advantages of Dynamic NAT:

Read Next

[Day 11] 5. Dynamic NAT with Overload

[Day 11] 6. IPv6