2

I have following network connections

LAN -> Cisco Router -> 16 port switch -> Server (netflow)
                                      -> ISP

And i have following config on Cisco router

interface FastEthernet0/0
 ip address 10.10.10.1 255.255.255.0
 ip nat inside
interface FastEthernet0/1
 ip address <router ip> 255.255.255.x
 ip nat outside
ip route 0.0.0.0 0.0.0.0 <gateway ip>
ip flow-export destination <server ip> <port>

I have allowed router ip on Server. Though I had no data received on server:port which a service was running. But when I tcpdump the port:

$ tcpdump -pn udp port <port>
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eno1, link-type EN10MB (Ethernet), capture size 262144 bytes
12:30:52.926946 IP 10.10.10.1.59663 > server:port: UDP, length 1464
12:30:52.927521 IP 10.10.10.1.59663 > server:port: UDP, length 1464

Which is weird to me. I was expecting the router ip.

  1. Why does it show LAN address?
  2. Is it ok to allow 10.10.10.1 to my server ?
3
  • You need to edit your question with the full router configuration. You have not even given us the NAT configuration. You can obfuscate the passwords and public addresses, but we need to the the whole configuration. – Ron Maupin Nov 7 '17 at 5:08
  • ip flow-export source f0/1 – Ricky Nov 7 '17 at 5:25
  • @RickyBeam ip flow-export source Loopback0 must be the issue. – Ariunbayar Nov 8 '17 at 2:30
2
  1. The traffic is surely the netflow export UDP packets you have configured. It would normally come from the inside interface, hence the inside address. Use ip flow-export source to change the source interface.

  2. Yes, allow traffic from the inside of the router to the server, otherwise your server will not send packets to and from the router, such as logging, configuration, NTP, whatever. Unless of course your intention is to really separate this server somehow.

1
  • Thank you. ip flow-export source Loopback0 must be the reason. – Ariunbayar Nov 8 '17 at 2:30
3

If it's is souce nat translation then source private ip address is translated to natted public ip .

So in cisco router

"When debug nat command is on "

Logs will reflect lan subnet ip address to translating natted public IPaddress.

For destination nat scenario will be quite reverse .

Logs will reflects public ip address translation to natted private IPaddress

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.