1

I have a Cisco 3925 on 15.01.

I'm attempting to allow machines on the Engineering network to access a webserver on the Management network on VLAN10 through a Static NAT. The webserver on the Management network is configured for 192.168.1.125. Any Engineering machine can hit the main page of the website at https://10.230.32.132 but as soon as I click on a link on the web page NAT appears to stop working. I can see it attempting to load the next webpage from 192.168.1.125 rather than 10.230.32.132 as I think it should until it times out. All webpages loaded from this web server should appear to be loaded from 10.230.32.132 from the perspective of any machine on the Engineering network.

Specific machines on the Management network are allowed to access the internet through interface gi/0/0 but machines on the engineering network are not. That last bit may not be relevant. The webserver also has access to the internet.

Relevant settings here:

Interface gi0/1.10  
 description Management Network  
 ip address 192.168.1.1 255.255.255.128  
 ip nat inside  
 encapsulation dot1Q 10  

Interface gi0/2  
 description Engineering Network  
 ip address 10.230.32.132 255.255.255.0  
 ip nat outside  

Interface gi0/0/0  
 description Connection to the Internet  
 ip address x.x.x.x 255.255.255.240  
 ip nat outside  

ip nat inside source list 1 interface GigabitEthernet0/0 overload  
ip nat inside source static 192.168.1.125 10.230.32.132  
ip route 0.0.0.0 0 0.0.0.0 X.X.X.X <-- default gateway to the internet.  

access-list 1 permit 192.168.1.111  
access-list 1 permit 192.168.1.121  
access-list 1 permit 192.168.1.125  
access-list 1 deny any

Any suggestions on how I can fix this?

|improve this question
  • Why do you want to NAT when it is unnecessary? NAT is a kludge to try to extend IPv4 until IPv6 becomes ubiquitous. It breaks the IP end-to-end paradigm, and it adds unnecessry complexity. You should never use NAT unless you need to. You can simply route between the Management and Engineering networks. – Ron Maupin♦ Mar 7 '17 at 14:25
  • Agreed. Normally I would simply route between the two networks. However, this is being dictated by company policy. They wish to limit access that Engineers may have to the Management network and only provide access/network connectivity to this single webserver within the Management network. I believe ACLs could be used here as well but my supervisor wants to me to get NAT working as an alternative. – dutsnekcirf Mar 7 '17 at 14:34
  • That would be the case for using an ACL, not NAT. Place an inbound extended ACL on G0/2 that allows traffic to the web server address and blocks traffic to all other addresses on that network. You should use the correct tool for the job. NAT has nothing to do with security, but ACLs do. – Ron Maupin♦ Mar 7 '17 at 14:37
  • Once again I agree. ACL should be used here. But my hands are tied and I'm being told I have to use a solution that involves NAT. Is it even possible to use NAT to accomplish this? – dutsnekcirf Mar 7 '17 at 14:41
  • 2
    As I said, NAT has nothing to do with security, and it will not prevent hosts on one network from communicating with hosts on the other network. You can use NAT, but that doesn't accomplish anything to do with preventing access. That would be for an ACL. As I wrote, NAT breaks the end-to-end paradigm, and it messes up some things. If the web pages are hard-coded to use specific IP addresses, NAT cannot deal with that. – Ron Maupin♦ Mar 7 '17 at 14:46
1

This is not an issue with your static NAT configuration - but actually with the content on the pages the web server is dishing out.

In most cases, a web server sh/would return relative links eg:

<a href="/some/other/location.html">Link</a>

in your case, it is returning absolute links in the form:

<a href="http://192.168.1.125/some/other/location.html">Link</a>

NAT occurs at Layer 3 - the web server returning links with it's address encoded into the URL is happening at Layer 7, and beyond the control of your router.

Static NAT is the wrong tool for the job in this case - explain to your Supervisor that the only way to resolve this issue is to use an ACL or have the web application re-written.

|improve this answer
1

After reading your comment, it appears that you have a need for an ACL instead of NAT. NAT is a method to save address space, essentially. Try doing this:

Router(config)# ip access-list extended ACL

Router(config-ext-nacl)# permit tcp 10.230.32.0 0.0.0.255 host 192.168.1.125 eq www

Router(config-ext-nacl)# deny tcp any host 192.168.1.125 eq www

Router(config-ext-nacl)# exit

ACLs look at their rules in a top-down fashion. So, when a packet enters an interface, the ACL will start at the top and work its way down the list until the packet matches a rule. If there is no rule in the ACL which addresses a packet, the packet gets dropped.

This is just an example configuration. You should read up on ACLs to ensure that you use the proper configuration for your situation.

The first step creates an extended ACL and moves the user to Extended ACL Configuration Mode.

The second step creates an ACL rule which allows traffic from all hosts in subnet 10.230.32.0 to reach the web server at 192.168.1.125 using destination TCP port 80 (HTTP). Note that ACLs use wildcard masks (e.g. 0.0.0.255) to describe a subnet mask, rather than the typical subnet mask you would use when creating static routes, DHCP pools, etc.

The third step denies all other hosts from accessing the web server via HTTP.

Next, you need to assign the ACL to an interface. With extended ACLs, you want to configure the router interface which is closest to the source. So, whichever interface is connected to the 10.230.32.0 needs to have your new ACL configured. We'll just use g0/1 as a placeholder for this example.

Router# configure terminal

Router(config)# interface GigabitEthernet 0/1

Router(config-if)# ip access-group ACL in

Router(config-if)# end

Finally, the last steps show how to configure your new ACL on the incoming interface of your router.

Good luck. And don't forget to remove your NAT configs first.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.