Defining Dynamic Translations

Dynamic translations use access list rules, to determine whether or not to apply NAT to incoming traffic, and NAT address pools, from which a NAT translation can allocate IP addresses. You use dynamic translation when you want the NAT router to initiate and manage address translation and session flows between address realms on demand.

To configure dynamic translations:

Creating Access List Rules

Before you create a dynamic translation, create the access list rules that you plan to apply to the translation. For information about configuring access lists, see Configuring Routing Policy.

The router evaluates multiple commands for the same access list in the order they were created. An undefined access list implicitly contains a rule to permit any. A defined access list implicitly ends with a rule to deny any.

Note: The access lists do not filter any packets; they determine whether the packet requires translation.

You use the access-list command to create an access list.

access-list

Defining Address Pools

Before you can configure dynamic translation, create an address pool. An address pool is a group of IP addresses from which the NAT router obtains an address when dynamically creating a new translation. You can create address pools with either a single range or multiple, nonoverlapping ranges.

When you create a single range, you specify the starting and ending IP addresses for the range in the root ip nat pool command. However, when you create multiple, nonoverlapping ranges, you omit the optional starting and ending IP addresses in the root ip nat pool command; this launches the IP NAT Pool Configuration (config-ipnat-pool) mode.

The config-ipnat-pool mode uses an address command to specify a range of IP addresses. You can repeat this command to create multiple, nonoverlapping ranges.

When you create or edit address pools, keep the following in mind:

address

ip nat pool

Defining Dynamic Translation Rules

You can use the CLI to define dynamic translation rules for inside and outside sources.

Caution: You must mark interfaces that participate in NAT translation as on the inside or the outside network. See Specifying Inside and Outside Interfaces for details.

You can create a dynamic translation rule to configure inside source or outside source translation. If the NAT router cannot locate a matching entry in its translation database for a given packet, it evaluates the access list of all applicable dynamic translation rules (inside source translation rules for outbound packets and outside source translation rules for inbound packets) against the packet. If an access list permits translation, the NAT router tries to allocate an address from the associated address pool to install a new translation.

When you create dynamic translation rules, keep the following in mind:

Creating Dynamic Inside Source Translation Rules

Use the ip nat inside source list command to create a dynamic inside source translation rule. This command creates a translation rule that:

The no version of this command removes the dynamic translation rule, but does not remove any previously created translations (resulting from the rule evaluation) from the translation table. To remove active translations from the translation table, see Clearing Dynamic Translations.

ip nat inside source list

Creating Dynamic Outside Source Translation Rules

Use the ip nat outside source list command to create a dynamic outside source translation rule. This command dynamically translates outside global source addresses to outside local addresses when packets are routed from the outside network to the inside network (and untranslates the destination address when a packet returns before a translation table entry times out).

The no version of this command removes the dynamic translation rule, but does not remove any previously created translations from the translation table. To remove active translations from the translation table, see Clearing Dynamic Translations.

ip nat outside source list

Defining Translation Timeouts

The router removes unused dynamic translations in the translation table. Use the ip nat translation command to change or disable NAT translation timeouts.

You can set the aging time (in seconds) never) for any of the specified timers:

All timeouts for this command support a maximum value of 2147483 seconds (about 25 days).

The no version of this command resets the timer to its default value.

ip nat translation