NVI NAT in IOS
Since version 12.3(14)T, Cisco introduced a new feature. Nat Virtual Interface ( NVI for short). It removes the need of specifying inside and outside interfaces. We configure the interface for use or not use NAT.
This makes easier translation configurations on the devices. Using the older version we did this kind of configurations:
Router(config)# int f0/0
Router(config-if)# ip nat outside
Router(config-if)# exit
Router(config)# int f0/1
Router(config-if)# ip nat inside
Router(config-if)# exit
Router(config)# ip nat inside source static 172.17.172.17 10.100.10.100
Now, with this feature:
Router(config)# int f0/0
Router(config-if)# ip nat enable
Router(config-if)# exit
Router(config)# int f0/1
Router(config-if)# ip nat enable
Router(config-if)# exit
Router(config)# ip nat source static 172.17.172.17 10.100.10.100
As we can see, we could use interface ranges, just in case we need more interfaces with NAT enabled so we can configure all with only one command:
Router(config)# int range fo/0 -1
Router(config-if)# ip nat enable
Now, although is very easy, will see how to configure different kinds of translations using the new command set. I will not show the old way because there’s already a post in this blog.
Static NAT
Router(config)# ip nat source static 172.17.172.17 10.100.10.100
Dynamic NAT
Router(config)# ip nat pool dynpool 10.100.10.1 10.100.10.16 prefix-length
29
Router(config)# ip access-l stan lan_nat
Router(config-std-acl)# permit 172.17.0.0 0.0.0.15
Router(config-std-acl)# exit
Router(config)# ip nat source list lan_nat pool dynpool
Static PAT
Router(config)# ip nat source static tcp 172.17.172.17 80 10.100.10.100 80
NAT Overload
Router(config)# ip access-l stan lan_nat
Router(config-std-acl)# permit ip 172.17.172.0 0.0.0.255
Router(config)# ip nat source list lan_nat int fo/0 over
In order to check that translations and stats are Ok an working properly we can use the following commands:
show ip nat nvi translations
show ip nat nvi statistics