Configuring NAT for Dual-Homed Cisco IOS Router - CCIE Security Exam Answer

Configuring NAT for Dual-Homed Cisco IOS Router

Prev Question Next Question

Question

An internal DNS server requires a NAT on a Cisco IOS router that is dual-homed to separate ISPs using distinct CIDR blocks.

Which NAT capability is required to allow hosts in each CIDR block to contact the DNS server via one translated address?

Answers

Explanations

Click on the arrows to vote for the correct answer

A. B. C. D. E.

B.

To enable hosts in each CIDR block to contact an internal DNS server via a single translated address, we need to use NAT. In this scenario, we have a Cisco IOS router with two interfaces, each connected to a separate ISP network with different CIDR blocks. The internal DNS server resides on the internal network and has a private IP address that cannot be reached from the external networks.

To enable external hosts to reach the internal DNS server, we need to use NAT to translate the private IP address of the DNS server into a public IP address that is routable from the external networks. However, we need to ensure that hosts in each CIDR block can contact the DNS server via a single translated address.

Out of the given options, the NAT capability that is required to achieve this is NAT service-type DNS (Option D). NAT service-type DNS is a type of NAT that allows DNS queries from external hosts to be translated to the IP address of an internal DNS server. It maps the public IP address of the router to the private IP address of the DNS server and modifies the DNS query to reflect the new IP address.

NAT service-type DNS is a one-to-one NAT, which means that each external host is mapped to a unique internal IP address. This ensures that hosts in each CIDR block can contact the DNS server via one translated address.

Option A (NAT overload) is also known as Port Address Translation (PAT) or dynamic NAT, which allows multiple private IP addresses to share a single public IP address. However, it does not guarantee that hosts in each CIDR block can contact the DNS server via one translated address.

Option B (NAT extendable) is a type of NAT that allows multiple public IP addresses to be mapped to a single private IP address. It is useful when a single internal host needs to communicate with multiple external hosts. However, it does not address the requirement to allow hosts in each CIDR block to contact the DNS server via one translated address.

Option C (NAT TCP load balancing) is a type of NAT that distributes incoming TCP traffic across multiple servers. It is typically used in high-traffic environments where multiple servers are used to handle incoming traffic. However, it does not address the requirement to allow hosts in each CIDR block to contact the DNS server via one translated address.

Option E (NAT port-to-application mapping) is a type of NAT that maps a specific port number to a specific application or service. It is useful when multiple applications are running on a single host and need to be accessed from the external network. However, it does not address the requirement to allow hosts in each CIDR block to contact the DNS server via one translated address.