0

Using this scenery, How Can I deny private address, but in this case, 192.168.0.0/24 network to going out without use a public address?

The Traffic will only be allowed if they're translated, in this case, 10.0.0.1 addr

Topology

Enterprise Router

!
ip dhcp pool VLAN2
 network 192.168.0.0 255.255.255.192
 default-router 192.168.0.1
ip dhcp pool VLAN3
 network 192.168.0.64 255.255.255.224
 default-router 192.168.0.65
ip dhcp pool VLAN4
 network 192.168.0.96 255.255.255.248
 default-router 192.168.0.97
!
!
interface FastEthernet0/0
 no ip address
 ip nat inside
 duplex auto
 speed auto
!
interface FastEthernet0/0.2
 encapsulation dot1Q 2
 ip address 192.168.0.1 255.255.255.192
!
interface FastEthernet0/0.3
 encapsulation dot1Q 3
 ip address 192.168.0.65 255.255.255.224
!
interface FastEthernet0/0.4
 encapsulation dot1Q 4
 ip address 192.168.0.97 255.255.255.248
!
interface FastEthernet0/1
 no ip address
 duplex auto
 speed auto
 shutdown
!
interface Serial0/0/0
 ip address 10.0.0.1 255.255.255.252
 ip nat outside
 clock rate 2000000
!
!
ip nat inside source list 100 interface Serial0/0/0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 10.0.0.2 
!

disregard this line "ip nat inside sourcer list 100.." I removed an ACL..

Improve this question
6
  • This looks a lot like a homework question
    – Ron Trunk
    Aug 5, 2015 at 18:09
  • Curiosity for CCNA, I don't need to make more homework :x
    – Shinomoto Asakura
    Aug 5, 2015 at 19:18
  • Tell us more about how you've configured the router. Do you have NAT configured? Can you post the configuration? There are several ways to accomplish what you've asked for.
    – Ron Trunk
    Aug 5, 2015 at 19:24
  • Ok, I'll update
    – Shinomoto Asakura
    Aug 5, 2015 at 20:31
  • I'm not clear on what you're trying to accomplish. Do you want to NAT all the 192.168.0.0/24? Or just some of them?
    – Ron Trunk
    Aug 5, 2015 at 20:42

2 Answers 2

Reset to default
0

If you're trying to block devices that are inside local from reaching the ISP without getting NAT'd first (changed from 192.168.0.x to 10.0.0.x): Create an ACL which either allows all traffic that isn't 192.168.0.x, or only allows 10.0.0.x, and apply it to the outgoing interface of Enterprise Router.

Something like this would block 192.168.0.x, but allow everything else:

ip access-list standard 101

deny 192.168.0.0 0.0.0.255

permit any

And this would allow only the 10.0.0.x network through:

ip access-list standard 101

permit 10.0.0.0 0.0.0.255

deny any

(You don't need to enter the "deny any" command, as ACLs have an explicit deny command at the end by default)

Then apply one of these to the S0/0/0 interface of Enterprise Router:

interface S0/0/0

ip access-group 101 out

Things to note: This is using a standard ACL rather than an extended one since you just want to permit or deny based on the source IP. If you wanted to filter out based on ports or permit/deny based on source and destination IP, you would use and extended ACl. Also, since this is a standard ACL, it gets put as close to the destination as possible; this way you don't filter out legitimate traffic with the stuff you want to block. This means assigning it as outgoing on the S0/0/0 port in this case.

Improve this answer
9
  • Ho, Perfectly! It's Working! (: I read about Standard x Extended, any way I used an extended for deny my source IP and assigned it as outgoing on se 0/0/0.. Is There any watchful about it?
    – Shinomoto Asakura
    Aug 6, 2015 at 18:31
  • Good, good. I much prefer extended ACLs, but in a live environment, it's nice to keep things simple when possible. I'm sorry, what do you mean by 'watchful'?
    – ProfessorJV
    Aug 6, 2015 at 19:03
  • beeh, I'm not native English speaker, sorry, I want to say "alert" or a little care if you prefer!
    – Shinomoto Asakura
    Aug 6, 2015 at 19:26
  • No need to apologize. Yes and no: there isn't, to my knowledge, a way to be alerted when an ACL is tripped. You could, however, enter show ip access-lists 101 in privileged exec mode to see how many times each rule in ACL 101 has been "triggered".
    – ProfessorJV
    Aug 6, 2015 at 21:00
  • The Packet Tracer has that "timer"? Or Just IOS running in the Router Device?
    – Shinomoto Asakura
    Aug 6, 2015 at 21:11
0

Put the NAT statement back:

ip nat inside source list 100 interface Serial0/0/0 overload
access-list 100 permit ip 192.168.0.0 0.0.255.255 any
Improve this answer
6
  • That was my previous statement. When I used "debug ip packet" I confirmed that NAT was working, but I don't get understand that ACL, even I don't setting up "ip nat inside" the packet passed by ACL
    – Shinomoto Asakura
    Aug 6, 2015 at 14:07
  • Sorry, I'm not clear on what you're trying to do. What else do you want the router to do?
    – Ron Trunk
    Aug 6, 2015 at 14:09
  • "Enterprise Router" should block all packets that are with "Inside Local Address"
    – Shinomoto Asakura
    Aug 6, 2015 at 14:12
  • All the enterprise subnets are being NATted. Are there other inside networks that you're trying to block?
    – Ron Trunk
    Aug 6, 2015 at 18:21
  • No, I think no.. Ok, If I use that command above, still write access-list command for deny all packet and apply it as outgoing interface se0/0/0.. Is There any order about ACL? Like "Squid" ?
    – Shinomoto Asakura
    Aug 6, 2015 at 19:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.