2

I've been trying to figure out this problem, and I'm just not up to the task. I have a Cisco 2911 router as follows:

Internet connection on GigabitEthernet0/1. Which has it's own static IP: A.B.C.38/30 And we also have some IPs allocated to us:

A.B.C.40/29

Which I use for NATing some services, and also for the PPPOE clients (detailed below)

Internal LAN connection on GigabitEthernet0/0.100

The router has also been setup as a PPPOE concentrator as we have some people who need an Internet connection through a microwave network through our network. I basically have VLANs set up for this, so I also have:

GigabitEthernet0/0.400, 500, and 600.

Finally, one of these people, have their own server located in our server room. This server is setup on it's own subnet and VLAN.

GigabitEthernet0/0.302 which has the IP 172.16.80.254/24. They run a server with VMWare, and have different VMs running on: 172.16.80.1, 172.16.80.2, etc.

I have some static NAT rules written up to get these on the public IP address: A.B.C.41.

Now for the most part, everything is working correctly. The PPPOE clients get their external IPs and can browse the Internet fine. The NATed servers can be reached externally without problems, that's all fine.

Our internal network computers are NATed to our public IP address fine, and we can browse.

Now, there are two problems. First, our internal NATed computers can't browse to the external address of any of our static NATed servers. So, for example. If I try to browse to A.B.C.41 from our internal network, it doesn't work, it times out (obviously 172.16.80.1, etc) work.

Secondly, any of the PPPOE clients (which end up with their own global public IPs A.B.C.42 - 44) can't browse to A.B.C.41 either.

The first problem, isn't really a problem. And I actually solved that by switching to what I believe is called a hairpin NAT? I basically rewrote all the NAT rules to remove "inside" and "outside", but that didn't solve the second problem, which is the actual problem I care about. (I've moved back to using "inside" and "outside" for the moment)

Here's what I believe, are the relevant details from the router config:

bba-group pppoe global
 virtual-template 2

interface Loopback0
 description IP for Unnumbered Tunnel Interfaces
 ip address 1.1.1.1 255.255.255.255

interface GigabitEthernet0/0.100
 description NetworkMaint
 encapsulation dot1Q 100 native
 ip address 192.168.100.1 255.255.255.0
 ip nat inside
 ip nat enable
 ip virtual-reassembly in
 ip ospf 100 area 0

interface GigabitEthernet0/0.300
 description Mushy PPPOE
 encapsulation dot1Q 300
 pppoe enable group global

interface GigabitEthernet0/0.302
 description Mushy Server
 encapsulation dot1Q 302
 ip address 172.16.80.254 255.255.255.0
 ip nat inside
 ip nat enable
 ip virtual-reassembly in

interface GigabitEthernet0/1
 bandwidth 50000
 ip address A.B.C.38 255.255.255.252
 ip access-group 160 out
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip nat enable
 ip virtual-reassembly in
 duplex auto
 speed auto
 no cdp enable

interface Virtual-Template2
 description PPPOE Concentrated Client
 mtu 1492
 ip unnumbered Loopback0
 no peer default ip address
 ppp authentication chap

ip local pool shared-client-pool A.B.C.42 A.B.C.46
ip default-gateway A.B.C.37

no ip nat service alg tcp dns
no ip nat service alg udp dns
ip nat pool Mushy-Server A.B.C.41 A.B.C.41 netmask 255.255.255.248
ip nat source static tcp 192.168.1.46 8443 A.B.C.38 443 extendable
ip nat inside source list 10 pool Mushy-Server overload
ip nat inside source route-map NAT-Fibre interface GigabitEthernet0/1 overload
ip nat inside source static tcp 192.168.1.46 3000 A.B.C.38 80 extendable
ip nat inside source static tcp 172.16.80.2 25 A.B.C.41 25 extendable
ip nat inside source static tcp 172.16.80.1 80 A.B.C.41 80 extendable
ip nat inside source static tcp 172.16.80.60 8080 A.B.C.41 8080 extendable

ip route 0.0.0.0 0.0.0.0 202.74.164.37

ip access-list extended LOCAL-LAN
 permit ip 192.168.0.0 0.0.255.255 any

access-list 10 remark -=Mushy Server=-
access-list 10 permit 172.16.80.0 0.0.0.255
access-list 11 remark -=Hosted Services=-
access-list 11 permit A.B.C.40 0.0.0.7

route-map NAT-Fibre permit 10
 match ip address LOCAL-LAN
 match interface GigabitEthernet0/1

route-map NAT-Mushy-Server permit 10
 match ip address MUSHY-SERVER
 match interface GigabitEthernet0/0.302

Basically, I would love to have the PPPOE clients be able to use the address A.B.C.41.

Any ideas, or help is greatly appreciated.

  • I'm pretty sure the problem is that the .41 address is in the same network as the .42, .43 etc. Routers route between networks, not from a network back to the same network. You must bridge for a host on a network to reach another host on the same network. – Ron Maupin Feb 9 '18 at 2:21
  • That sounds right, but the interface doesn't actually have those addresses associated with any interface. I'm pretty sure when I did some tracing, it sent the packets out the the gateway and then the gateway sent them back. When the gateway sent them back, I was sure that the router would follow the NAT rule? A problem I have is just visibility on here exactly packets are going, and why. – Mike Feb 9 '18 at 2:26
  • It's not the addresses on the interfaces, but the addresses on the packets. For example, the hairpin works because the packet addressing is from a network (LAN) to a different network (WAN), but not with the PPPoE to the .41 address because they are in the same network. The routing process typically ignores packets destined to the same network from which they originated. You may be able to do something with IRB. – Ron Maupin Feb 9 '18 at 2:31
  • What happens if you add a ip nat outside to the template interface and have the client reestablish PPP? – user3629081 Jul 13 '18 at 21:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.