NAT pool and outside interface

Routing & Switching Network Services
1

When working with NAT, does the IP Address on my outside interface have to be part of the same subnet for my range of NAT pool IP Addresses? Or, can I have a configuration such as the following:

int s0/0/0
 ip address 209.165.201.1 255.255.255.252
 ip nat outside

int fa0/0
 ip address 10.1.1.1 255.255.255.0
 ip nat inside

ip access-list TEST2
 permit 10.0.0.0 0.255.255.255

ip nat pool TEST 209.165.200.241 209.165.200.245 prefix-length 29
 ip nat inside source TEST2 pool TEST overload

And if the subnet of my pool of IP Addresses can vary from the IP Address configured on s0/0/0, what about that configuration needs to be changed to allow a successful ping (and translation) from a device on my private LAN (10.1.1.0/24) to the 209.165.201.0/30 network?

Thanks.

2

Hello Jelanimanzili

The quick answer to your question is no. The detailed answer is below:

The IP address of the outside interfaces does not have to be on the same subnet as the range of NAT pool IP addresses. Your configuration is correct. However, in order for it to work, the ISP that has given you the outside pool of addresses must have configured routing on its end to be able to route translated packets to the internet.

Concerning your second question, if you want to ping the outside interface of the router from an inside device, what happens depends on the order of NAT operations. According to Cisco, routing occurs before NAT translation. (see http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/6209-5.html).

This means that router checks its routing table for a route to the outside address before it continues to translate the packet. Therefore, it is important that the NAT router has a valid route for the outside network and the route to the destination network must be known through an interface that is defined as NAT outside in the router configuration. Since the 209.165.201.0/30 network is directly connected and is therefore in the routing table, NAT translation will occur when pinging to 209.165.201.0/30. So no additional configuration is necessary to reach such addresses.

I hope this has been helpful!

Laz