Network address Translation (NAT) digunakan oleh kedua router tersebut untuk mengganti IP address host pengirim dan host penerima ke subnet yang berbeda.
Ilustrasi jaringan ditunjukan seperti gambar 1 dibawah ini.
Pada gambar diatas, ketika host 172.16.1.2 di site A akan mengakses host 172.16.1.3 di Site B, akan tersambung ke 172.19.1.2, bukan ke 172.16.1.2. Begitu juga sebaliknya, ketika host di site B mengakses site A, akan tersambung ke 172.18.1.2.
NAT di Router A akan menerjemahkan address 172.16.x.x sebagai 172.18.x.x host entry. NAT di Router B menerjemahkan 172.16.x.x menjadi 172.19.x.x
Untuk keamanan data, mengingat data akan dilewatkan melalui jaringan publik, data diacak/dienkripsi menggunakan fungsi crypto di setiap router sebelum dikirimkan melalui serial interface. Perhatikan bahwa proses NAT dilakukan sebelum data tersebut diacak/encrypted.
Konfigurasi
Router A: Cisco 2600Series IOS (tm) C2600 Software Release 12.3(6f)
Router A: Cisco 2600Series IOS (tm) C2600 Software Release 12.3(6f)
ROUTER A
Version 12.3
Service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router-A
!
boot-start-marker
boot-end-marker
!
no aaa new-model
ip subnet-zero
!
ip audit notify log
ip audit po max-events 100
ip ssh break-string
no ftp-server write-enable
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
crypto isakmp key cisco123 address 192.168.1.2
!
crypto ipsec transform-set myset1 esp-3des esp-md5-hmac
!
crypto map mymap 10 ipsec-isakmp
set peer 192.168.1.2
set transform-set myset1
!
match address 100
!
interface Serial0/0
description Interface to PUBLIC
ip address 192.168.1.1 255.255.0.0
ip nat outside
crypto map mymap
!
interface Ethernet0/0
ip address 172.16.1.1 255.255.255.0
no ip directed-broadcast
ip nat inside
!
ip nat inside source static network 172.16.0.0 172.18.0.0 / 16 no-alias
no ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0/0
!
access-list 100 permit 172.18.0.0 0.0.255.255 172.19.0.0 0.0.255.255
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
end
Router B
Version 12.3
Service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router-B
!
boot-start-marker
boot-end-marker
!
no aaa new-model
ip subnet-zero
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
crypto isakmp key cisco123 address 192.168.1.1
!
crypto ipsec transform-set myset1 esp-3des esp-md5-hmac
!
crypto map mymap 10 ipsec-isakmp
set peer 192.168.1.1
set transform-set myset1
!
match address 100
!
interface Serial0/0
description Interface to PUBLIC
ip address 192.168.1.2 255.255.0.0
ip nat outside
crypto map mymap
!
interface Ethernet0/0
ip address 172.16.1.1 255.255.255.0
no ip directed-broadcast
ip nat inside
!
ip nat inside source static network 172.16.0.0 172.19.0.0 / 16 no-alias
no ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0/0
!
access-list 100 permit 172.19.0.0 0.0.255.255 172.18.0.0 0.0.255.255
!
control-plane
!
line con 0
line aux 0
line vty 0 4
end
Validasi
Setelah melakukan konfigurasi, gunakan perintah berikut ini untuk memastikan apakan konfigurasi yang telah dibuat berjalan dengan benar.
- show crypto ipsec sa >> melihat fungsi security phase 2
- show crypto isakmp sa >> melihat fungsi security phase 1
- show ip nat translation >> melihat NAT yang sedang aktif.
Semoga bermanfaat...
Cheers!
Referensi:
www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00800b07ed.shtml
