I have a Cisco MMS891 ISR as my edge router with several static NAT entries, which are set up to NAT my LAN IP addresses (which are statically assigned to printers) to access an externally hosted application that my users print through.
Here is an example of how my LAN is NAT'd to the external network (last 6 lines is the beginning of my printer NAT rules, with IP information de-identified):
ip nat pool ASP 10.x.x.2 10.x.x.255 netmask 255.255.255.0 type match-host ip nat inside source route-map abs pool ASP ip nat inside source route-map nat interface GigabitEthernet0 overload ip nat inside source route-map nat_failover interface FastEthernet8 overload ip nat inside source static 192.168.1.23 10.x.x.23 ip nat inside source static 192.168.1.39 10.x.x.39 ip nat inside source static 192.168.1.40 10.x.x.40 ip nat inside source static 192.168.1.45 10.x.x.45 ip nat inside source static 192.168.1.82 10.x.x.82 ip nat inside source static 192.168.1.90 10.x.x.90
And here is the configuration for my DHCP pool (edit: added exclusion config):
! ip dhcp pool Local_LAN utilization mark high 80 log network 192.168.0.0 255.255.252.0 default-router 192.168.1.1 dns-server 192.168.1.100 lease 8 ! ip dhcp excluded-address 192.168.1.1 192.168.1.101 ip dhcp excluded-address 192.168.2.1 192.168.2.255 ip dhcp excluded-address 192.168.3.1 192.168.3.255 ip dhcp excluded-address 192.168.0.1 192.168.0.255 ip dhcp excluded-address 192.168.1.176
I've had several users approach me in the last few days with the fairly generic "My internet isn't working" complaint. What I've discovered is that my router is responding to DHCP requests and assigning IP addresses that are statically NAT'd as above. For example, a user received 192.168.1.90 via DHCP, which has a static NAT entry to 10.x.x.90, and thus my problem. I'm aware that I can add individual DHCP exclusions (as seen in above DHCP exclusions config with 192.168.1.176), but as these NAT rules span a large IP range, I'd rather steer away from adding individual lines for each exclusion, and I'm unable to exclude the entire range. This doesn't seem like a standard behavior to me and thus -
My question is: why does my router assign IP addresses via DHCP that have static NAT rules, and is there any way to stop this?
I can post more configuration information if necessary.