1

I thought I had a relatively simple question, however I can't seem to find a solution online easily.

My problem is: I have two Cisco 1941 routers configured each with their own direct internet facing connection. Lets assume R0 is the default gateway, and R1 acts as a backup connection. I want to be able to receive traffic from both Internet connections to my mail server. As the mail server has a default gateway of R0, if it receives traffic from R1 it will not make it back to the originator.

Logically I'm thinking this can be achieved by NAT on the source side of the Internet address so that routing is not used, and the server can get back to the router via the NAT IP address, which would be on the same subnet.

My starting configuration is this:

Simple config

R0 configuration:

gigabitethernet0/0
 ip address 192.168.200.1
 ip nat inside

Dialer0
 ip nat outside

ip nat inside source list 190 interface dialer0
ip nat inside source static tcp 192.168.200.10 25 interface dialer0 25
access-list 190 permit ip 192.168.200.0 255.255.255.0 any

R1 configuration:

gigabitethernet0/0
 ip address 192.168.200.2
 ip nat inside

Dialer0
 ip nat outside

ip nat inside source list 190 interface dialer0
ip nat inside source static tcp 192.168.200.10 25 interface dialer0 25
access-list 190 permit ip 192.168.200.0 255.255.255.0 any

My Mail Server is 192.168.200.10.

Any help appreciated.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 19:35
2

To do this -- eliminate the asymmetric routing -- you have to double NAT ("twice NAT") the packet. First NAT rewrites the destination (internet-to-internal), and the second rewrites the source to the transiting router. I've had to do that before; on IOS, it's a complex pain in the ass. I've seen examples using ip nat inside and ip nat outside at the same time, but I'm not sure that'll do both to the same packet. (which is why I resorted to complicated loopback interfaces)

(If you can get your hands on an ASA running 8.3+, the screwed up "new NAT" can do source and destination rewriting in one command. It's the only up-side to that insanity.)

| improve this answer | |
2

Addressing the problem of accepting incoming email via either internet connection: you could give your mail server two ip addresses (on two ether interfaces, or as a secondary address) and give it source address routing, so that it gets a different route depending on which IP address it is sending from. (howto for Linux.)

In the DNS, advertise server with two A records (sending clients will pick at random); alternatively with two MX records (can prioritise).

   isp0           isp1
    |1.1.1.1       |2.2.2.2
    r0             r1
    |.1            |.2
====+====+====+====+====
       |.11   |.22
         server

You can also consider a second email server, which accepts mail and forwards it to the primary. It makes the routing problem trivial and the mail problem a little harder: depends which is easier for you and your operating system, and where you see your risks that you want to minimise.

Addressing sending: easiest is again on the server, by having a script check reachability and manipulating the server's routes.

Of course, the proper internet design is to do this at the ISP's end, but you normally can't get rerouting done except for large address blocks. If both routers are connected to the same ISP they might have a way to help you; but you don't get much resilience if they both are on the same ISP.

Hope that helps

Jonathan.

| improve this answer | |
0

If I understand your problem, you must use the same router for both incoming and outgoing traffic for any single flow. That is because the NAT table for a router only exists on that router.

If you have traffic come in on R1, but responses go out R0, the conversation will be broken because the responses will have a different source address that doesn't match what the other end expects.

You need to set things up in such a way that any traffic responding to a flow will exit the same router where the original traffic entered your network. With a simple network, like you have, you really just need to create Active/Standby instead of what you are trying to do.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.