Overlapping IP address ranges in your own LAN and the local area network of the organization you’re partnering with is a common issue that network administrators are faced with in their daily jobs. The textbook solution for this issue is NAT.
Let us skip the explanations of how to do basic configurations for dynamic and static NAT scenarios that you use when you need to hide your internal IP address behind a public IP address in order to get access to outside resources (dynamic NAT), or allow internal resources to be available from the outside world (static NAT). You can find tutorials for these types of configurations in the “Basic Configuration of Cisco Router” and “Basic Configuration of Cisco ASA” articles, as well as the “Using NAT” article.
Destination address substitution
Let us look at an example, in which we need to create a special fictional dummy IP address, that is used to impersonate the real IP address that overlaps with something in your network, and redirects the traffic towards the real destination.
10.0.0.5 – the actual IP address of the server that you need to gain access to
1.1.1.1 – dummy IP address, that will redirect the user’s traffic to 10.0.0.5
In order to implement this scenario, you need to configure the router’s interfaces to be recognized as either inside or outside network using the following commands:
After you’ve done that, enter the command:
A) If the server is located on a network directly connected to one of the router’s interfaces, then use the server’s real IP address as the next hop:
B) If the server is located farther in the network behind some other router, use that devices IP address as the next hop (x.x.x.x):
Verifying NAT
Use the command sh ip nat translations in order to check the active translation rules for your IP addresses. Your output should look similar to this:
Substituting source and destination IP addresses at the same time
The scenario described above does not limit you from using “regular” NAT along with it. If you need to hide the real IP address of your workstation behind some “outside” IP, you will have to create the regular translation rules, like you use for dynamic NAT, for example.
Let’s say the real IP address of our workstation is 192.168.10.5 (source IP), and it needs to be hidden behind a dummy IP address of 2.2.2.2
Add the configuration lines for dynamic source address translation:
As a result of this configuration, the original packet from source IP 192.168.10.5 of our workstation destined for 1.1.1.1 will be converted into a packet with source 2.2.2.2 and destination 10.0.0.5 as it traverses our router.