1

I have a Cisco MMS891 ISR as my edge router with several static NAT entries, which are set up to NAT my LAN IP addresses (which are statically assigned to printers) to access an externally hosted application that my users print through.

Here is an example of how my LAN is NAT'd to the external network (last 6 lines is the beginning of my printer NAT rules, with IP information de-identified):

ip nat pool ASP 10.x.x.2 10.x.x.255 netmask 255.255.255.0 type match-host
ip nat inside source route-map abs pool ASP
ip nat inside source route-map nat interface GigabitEthernet0 overload
ip nat inside source route-map nat_failover interface FastEthernet8 overload
ip nat inside source static 192.168.1.23 10.x.x.23
ip nat inside source static 192.168.1.39 10.x.x.39
ip nat inside source static 192.168.1.40 10.x.x.40
ip nat inside source static 192.168.1.45 10.x.x.45
ip nat inside source static 192.168.1.82 10.x.x.82
ip nat inside source static 192.168.1.90 10.x.x.90

And here is the configuration for my DHCP pool (edit: added exclusion config):

!
ip dhcp pool Local_LAN
 utilization mark high 80 log
 network 192.168.0.0 255.255.252.0
 default-router 192.168.1.1
 dns-server 192.168.1.100
 lease 8
!
ip dhcp excluded-address 192.168.1.1 192.168.1.101
ip dhcp excluded-address 192.168.2.1 192.168.2.255
ip dhcp excluded-address 192.168.3.1 192.168.3.255
ip dhcp excluded-address 192.168.0.1 192.168.0.255
ip dhcp excluded-address 192.168.1.176

I've had several users approach me in the last few days with the fairly generic "My internet isn't working" complaint. What I've discovered is that my router is responding to DHCP requests and assigning IP addresses that are statically NAT'd as above. For example, a user received 192.168.1.90 via DHCP, which has a static NAT entry to 10.x.x.90, and thus my problem. I'm aware that I can add individual DHCP exclusions (as seen in above DHCP exclusions config with 192.168.1.176), but as these NAT rules span a large IP range, I'd rather steer away from adding individual lines for each exclusion, and I'm unable to exclude the entire range. This doesn't seem like a standard behavior to me and thus -

My question is: why does my router assign IP addresses via DHCP that have static NAT rules, and is there any way to stop this?

I can post more configuration information if necessary.

1 Answer 1

1

DHCP is independent from NAT. Neither are a routing function; it's just that these are services that are often convenient to run on a router.

If you don't want DHCP to assign the addresses, then you must exclude them in DHCP. You should have a range set aside for statically assigned addresses, and you can exclude the range.

For example, in the 192.168.1.0/24 network, you could have 192.168.1.200 to 192.168.1.254 set aside for statically assigned devices like server and printers. You would then use:

ip dhcp excluded-address 192.168.1.200 192.168.1.254

That will exclude addresses from 192.168.1.200 to 192.168.1.254 from being assigned by the router DHCP service.

3
  • Right, and knowing that, and the fact that my NAT'd addresses span virtually an entire subnet, I'm understanding that the best solution here is to add individual line dhcp exclusions? I was hoping for a way to exclude all NAT'd addresses. My concern here is that this issue seems to have just started, and there have never been exclusions in this configuration that specifically exclude the NAT'd IP addresses. Bear in mind this solution would warrant an additional ~30 lines of individual DHCP exclusions. Dec 13, 2017 at 17:53
  • If you don't set aside a range for your static/NAT addresses, then you will need to have individual exclusions. You should really reevaluate and fix your network.
    – Ron Maupin
    Dec 13, 2017 at 18:21
  • I was afraid of that. And yeah that's why they hired me haha. Thanks Ron, I'll mark this answered. Dec 13, 2017 at 18:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.