Router, Routing, NAT, DHCP and DNS Playbook

What a router actually gives the client

A router connects IP networks and makes forwarding decisions from the routing table. In a business network it commonly provides the path between VLANs, the default route toward an ISP or firewall, and sometimes services such as NAT, DHCP relay or WAN failover. The benefit is controlled communication between separate networks rather than one flat broadcast domain.

The routing decision

When a host sends traffic outside its local subnet, it sends the frame to its configured default gateway. The router looks for the most specific matching route for the destination. A default route is only used when no more specific route matches.

Cisco IOS XE style examples

ip route 0.0.0.0 0.0.0.0 203.0.113.1
ip route 10.40.0.0 255.255.255.0 192.0.2.2

The addresses are documentation examples. Verify syntax on the exact platform and software release.

Inter-VLAN routing

VLANs are Layer 2 broadcast domains. Traffic between them needs Layer 3 forwarding, normally on a router, firewall or multilayer switch. Each routed VLAN needs a gateway interface in that subnet.

interface Vlan10
 description STAFF-GATEWAY
 ip address 192.0.2.1 255.255.255.0

interface Vlan30
 description CAMERA-GATEWAY
 ip address 198.51.100.1 255.255.255.0

A switch trunk may carry both VLANs to the Layer 3 device, but simply allowing the VLAN on a trunk does not create a gateway or routing policy.

DHCP relay

DHCP Discover starts as a local broadcast. Routers do not forward ordinary broadcasts between subnets. A DHCP relay receives the local request and forwards it toward the configured DHCP server. Cisco IOS XE uses ip helper-address on an interface for this function.

interface Vlan30
 ip address 198.51.100.1 255.255.255.0
 ip helper-address 192.0.2.50

When DHCP fails across VLANs

1. Confirm the client switch port is in the correct VLAN.
2. Confirm the VLAN reaches the router.
3. Confirm the gateway interface is up.
4. Confirm the helper points to the correct DHCP server.
5. Confirm the DHCP server has a scope for the client subnet.
6. Confirm routing and firewall policy allow the request/reply path.

NAT and PAT

PAT, also called NAT overload, lets many inside addresses share one or a small number of public addresses by tracking transport-layer ports. Cisco distinguishes static translation, dynamic translation and PAT. NAT is address translation, not a replacement for firewall policy.

Important client benefit

PAT conserves public IPv4 addresses and allows many private hosts to use an Internet connection. Static translations can publish selected internal services, but exposing a service should always be combined with deliberate firewall policy and secure service configuration.

DNS troubleshooting

DNS problems are often misdiagnosed as Internet problems. Test in this order:

1. Can the client reach its default gateway by IP?
2. Can it reach a known remote IP?
3. What DNS server is configured?
4. Can the client query that DNS server?
5. Does the resolver return the expected record?
6. Does the application reach the resolved address and service?

If IP connectivity works but names fail, routing may be fine and the fault can be isolated to DNS configuration, reachability or records.

Common router mistakes

• Two DHCP servers on one client VLAN: clients can receive inconsistent gateways or DNS settings.
• Wrong subnet mask: hosts disagree about what is local and what belongs through the gateway.
• Default route hides missing specific routes: traffic may leave toward the ISP instead of the intended internal network.
• NAT mistaken for security: translation changes addressing but does not replace an explicit security policy.
• Router-on-a-stick without trunk consistency: one VLAN works and another silently disappears because the switch trunk and router subinterfaces disagree.

Commissioning checklist

• Every routed subnet has one intentional gateway address.
• Routing table contains connected and required static/dynamic routes.
• Default route points toward the intended upstream path.
• DHCP scope gateway and DNS values are correct.
• DHCP relay works from every routed client VLAN.
• NAT translations appear for intended traffic only.
• DNS resolution is tested independently from raw IP reachability.
• Configuration backup is saved.

Router products at Server Warehouse | VLAN and Trunk Guide | Fault-Finding Playbook