I have been working for the past 3 days to no avail. I have goggled and searched for all matter of solutions but still no success.

My task is to find a way to map an address to another. But, the network it is going in to does not have a default gateway. (Vlan1) (I cannot configure the default gateway on these devices.)

The scenario is that this device is about to be used for VPN site to site access. When the other site is connected it will connect using the ip address we map to it ( For now its only one server that needs to access. But, in the future it might be two or more.

An idea of how a ping to would work after finished.

Source: -RangeOfIPs- (Lets say
Source: Destination: (Internal Server)

On the return the following would happen:

Source: (Internal Server)
Destination: -RangeOfIPs- (

The Router in use is currently a Cisco 881 and has one WAN port and 4 Switch Ports
The WAN port is connected to the other networks and one of the switch ports is connected to our local network switch.

The roll of Loopback 0 is to create a network that the other side of the VPN site to site will use. They connect to the router via VPN which is to its public IP (, then, they would connect to the server via to access that resource. That way, we dont need default routes and at the same time control which server they have access too via VPN.

I plan on making the VPN after this is complete and ready, and i am going to use ACLs to prevent the VPN from accessing the 192 network. At least, to my knowledge should be possible.

Here is the configuration that i have to start with.

interface Loopback0
 ip address
interface FastEthernet4
 ip address
 duplex auto
 speed auto
interface FastEthernet0
 switchport mode access
interface FastEthernet1
 switchport mode access
interface FastEthernet2
 switchport mode access
interface FastEthernet3
 switchport mode access
interface Vlan1
 ip address
ip classless
ip route 

Example Network Topology: enter image description here Key:
Grey: Internal Network
Orange: VPN Site to Site (I'll work on this later, I know how to do this part)
Dark Blue: Public Network
1.1.1.X: Represent real public IP addresses.

The right most server:
External IP: / Gateway:
Internal IP: / Gateway: None

1 Answer 1


To test your scenario I set up the following lab:

NAT topology

The network is your -RangeOfIPs-

When traffic comes from it will be NATed to Traffic sourcing from will be NATed to


R3(config)#int f0/0
R3(config-if)#ip nat outside
R3(config-if)#int f0/1
R3(config-if)#ip nat inside

The above commands define the interfaces as outside and inside.

R3(config)#ip nat inside source static

This command translates the inside local address of to an inside global address of

R3(config)#access-list 1 permit

This access-list will define which hosts on the outside that will get NATed.

R3(config)#ip nat pool NAT_POOL netmask

We create a NAT pool consisting of a single address.

R3(config)#ip nat outside source list 1 pool NAT_POOL add-route 

Then we configure so that hosts matching access-list 1 will get NATed to

It is important to configure add-route here or to add a static route because when doing inside to outside NAT, NAT takes place before routing in the order of operations. That means that R3 must have a route for

R3 now has the following NAT table:

R3#show ip nat translations 
Pro Inside global      Inside local       Outside local      Outside global
--- ---                ---      
---      ---                ---

Note that R4 has configured with an IP and ip routing turned off to emulate a host. Debugging of ICMP on R1 is enabled and debugging of ip nat on R3 is also enabled.

R1#debug ip icmp
ICMP packet debugging is on

R3#debug ip nat 
IP NAT debugging is on

A ping is then issued from R1:

R1#ping so f0/1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to, timeout is 2 seconds:
Packet sent with a source address of 
Success rate is 100 percent (5/5), round-trip min/avg/max = 80/86/104 ms
ICMP: echo reply rcvd, src, dst
ICMP: echo reply rcvd, src, dst
ICMP: echo reply rcvd, src, dst
ICMP: echo reply rcvd, src, dst
ICMP: echo reply rcvd, src, dst

Debug and NAT table from R3:

NAT*: s=>, d= [15]
NAT*: s=, d=> [15
NAT: s=>, d= [15]
NAT: s=, d=> [15]

R3#show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- ---                ---      
---      ---                ---

I think that this is the kind of configuration you are looking for.

However, note that there is a caveat because there is no overload (PAT) available for outside to inside translation. That means that as soon as one of your hosts communicate with, there will be no free IP's in the pool. What you can do is to increase the pool size so that you reserve maybe 10 IP's that are only used for NAT.

  • Wow, I really appreciate the level of detail. (I havent gotten to test it yet) The only thing im worried about is will it work between a loopback and vlan interface? Also, with the server having no default gateway. Also, there might be multiple hosts connecting to one server. So I will need to create a way to provide multiple connections. Aug 14, 2014 at 14:59
  • I have added an example network topology to further explain what I am doing. Now to test your setup. But, would love to hear more about the PAT idea in this situation. Aug 14, 2014 at 15:36
  • For some reason, in my test environment, it kept failing. I got so frustrated with it, it decided to go ahead and deploy it in the real environment and it worked like a charm. No idea what makes a big differance. different versions. Maybe. I dunno. But before i check this as answered. I respectfully request that info about PAT. Seeing as the range of hosts / servers could be rather large later. Aug 14, 2014 at 16:44
  • What's the role of the loopback in your configuration? We might be able to reverse the inside and outside interfaces and do a overload on the inside instead. If you explain a bit more.
    – Daniel Dib
    Aug 14, 2014 at 17:33
  • Maybe i spoke to soon. I cant get the connection to work anymore. Aug 14, 2014 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.