3

This lab is done on Dynamips, and the setting is like below: ip nat inside destination setting There are two identical servers(192.168.48.74, 75) inside NAT, and the servers will use one public IP 200.200.17.34/29. R1 is the NAT router, and SW3 is a L3 switch with the servers.

From what I can gather, I can do this with "ip nat inside destination" command.[2] It doesn't let me initiate a session from the server, and I just need outside people being able to access the server.

So, I set up a local address pool RETAIL-WEB-LOCAL which are the server addresses and an access-list RETAIL-WEB-GLOBAL with the public address for the servers. Then I put them together with "ip nat inside destination list RETAIL-WEB-GLOBAL pool RETAIL-WEB-LOCAL" command.

R1 configuration is as follows:

!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname SeoulR1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
!
!
ip cef
no ip domain lookup
!
interface Loopback0
 ip address 10.10.11.1 255.255.255.248
!
interface Loopback1
 ip address 192.168.48.2 255.255.255.224 secondary
 ip address 192.168.48.3 255.255.255.224 secondary
 ip address 192.168.48.4 255.255.255.224 secondary
 ip address 192.168.48.5 255.255.255.224 secondary
 ip address 192.168.48.6 255.255.255.224 secondary
 ip address 192.168.48.7 255.255.255.224 secondary
 ip address 192.168.48.8 255.255.255.224 secondary
 ip address 192.168.48.9 255.255.255.224 secondary
 ip address 192.168.48.10 255.255.255.224 secondary
 ip address 192.168.48.11 255.255.255.224 secondary
 ip address 192.168.48.12 255.255.255.224 secondary
 ip address 192.168.48.13 255.255.255.224 secondary
 ip address 192.168.48.14 255.255.255.224 secondary
 ip address 192.168.48.15 255.255.255.224 secondary
 ip address 192.168.48.16 255.255.255.224 secondary
 ip address 192.168.48.17 255.255.255.224 secondary
 ip address 192.168.48.18 255.255.255.224 secondary
 ip address 192.168.48.19 255.255.255.224 secondary
 ip address 192.168.48.20 255.255.255.224 secondary
 ip address 192.168.48.21 255.255.255.224 secondary
 ip address 192.168.48.22 255.255.255.224 secondary
 ip address 192.168.48.23 255.255.255.224 secondary
 ip address 192.168.48.1 255.255.255.224
 ip ospf network point-to-point
!
interface Loopback2
 ip address 192.168.48.34 255.255.255.224 secondary
 ip address 192.168.48.35 255.255.255.224 secondary
 ip address 192.168.48.36 255.255.255.224 secondary
 ip address 192.168.48.37 255.255.255.224 secondary
 ip address 192.168.48.38 255.255.255.224 secondary
 ip address 192.168.48.39 255.255.255.224 secondary
 ip address 192.168.48.33 255.255.255.224
 ip ospf network point-to-point
!
interface Loopback3
 ip address 192.168.64.2 255.255.255.224 secondary
 ip address 192.168.64.3 255.255.255.224 secondary
 ip address 192.168.64.4 255.255.255.224 secondary
 ip address 192.168.64.5 255.255.255.224 secondary
 ip address 192.168.64.6 255.255.255.224 secondary
 ip address 192.168.64.7 255.255.255.224 secondary
 ip address 192.168.64.1 255.255.255.224
 ip ospf network point-to-point
!
interface Loopback4
 ip address 192.168.64.34 255.255.255.224 secondary
 ip address 192.168.64.35 255.255.255.224 secondary
 ip address 192.168.64.36 255.255.255.224 secondary
 ip address 192.168.64.37 255.255.255.224 secondary
 ip address 192.168.64.38 255.255.255.224 secondary
 ip address 192.168.64.39 255.255.255.224 secondary
 ip address 192.168.64.33 255.255.255.224
 ip ospf network point-to-point
!
interface Loopback5
 ip address 192.168.80.98 255.255.255.224 secondary
 ip address 192.168.80.99 255.255.255.224 secondary
 ip address 192.168.80.97 255.255.255.224
 ip ospf network point-to-point
!
interface Loopback6
 ip address 192.168.80.194 255.255.255.224 secondary
 ip address 192.168.80.195 255.255.255.224 secondary
 ip address 192.168.80.193 255.255.255.224
 ip ospf network point-to-point
!
interface Serial0/0
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
 no frame-relay inverse-arp
 frame-relay lmi-type ansi
!
interface Serial0/0.13 multipoint
 ip address 200.200.17.5 255.255.255.252
 ip ospf network point-to-point
 frame-relay map ip 200.200.17.6 103 broadcast
!
interface Serial0/1
 ip address 200.200.17.13 255.255.255.252
 serial restart-delay 0
!
interface Serial0/2
 no ip address
 serial restart-delay 0
!
interface Serial0/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface Ethernet1/0
 ip address 200.200.17.18 255.255.255.252
 ip nat outside
 ip virtual-reassembly
 full-duplex
!
interface Ethernet1/1
 no ip address
 full-duplex
!
interface Ethernet1/1.15
 encapsulation dot1Q 600
 ip address 166.15.13.1 255.255.255.252
!
interface Ethernet1/1.17
 encapsulation dot1Q 107
 ip address 192.168.32.1 255.255.255.240
 ip nat inside
 ip virtual-reassembly
!
interface Ethernet1/1.18
 encapsulation dot1Q 108
 ip address 192.168.32.17 255.255.255.240
 ip nat inside
 ip virtual-reassembly
!
interface Ethernet1/2
 no ip address
 shutdown
 half-duplex
!
interface Ethernet1/3
 no ip address
 shutdown
 half-duplex
!
router ospf 1
 router-id 10.10.11.1
 log-adjacency-changes
 area 0 authentication message-digest
 area 192 virtual-link 10.10.13.3 message-digest-key 53 md5 sj79aqj2dn0js
 passive-interface default
 no passive-interface Serial0/0.13
 no passive-interface Serial0/1
 no passive-interface Ethernet1/1.17
 no passive-interface Ethernet1/1.18
 network 192.168.32.1 0.0.0.0 area 1003
 network 192.168.32.17 0.0.0.0 area 1003
 network 192.168.48.0 0.0.0.63 area 1003
 network 192.168.64.0 0.0.0.63 area 1003
 network 192.168.80.96 0.0.0.31 area 1003
 network 192.168.80.192 0.0.0.31 area 1003
 network 200.200.17.5 0.0.0.0 area 192
 network 200.200.17.13 0.0.0.0 area 192
 default-information originate always
!
ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 200.200.17.17
!
!
ip nat pool RETAIL-WEB-LOCAL 192.168.48.74 192.168.48.75 prefix-length 29 type rotary
ip nat inside source list NAT-GRP interface Ethernet1/0 overload
ip nat inside destination list RETAIL-WEB-GLOBAL pool RETAIL-WEB-LOCAL
!
!
ip access-list standard NAT-GRP
 permit 192.168.48.0 0.0.0.63
 permit 192.168.64.0 0.0.16.255
ip access-list standard RETAIL-WEB-GLOBAL
 permit 200.200.17.34
!
control-plane
!
line con 0
 exec-timeout 0 0
 logging synchronous
line aux 0
line vty 0 4
 login
!
end

SW3 config is as follows:

no service password-encryption
!
hostname SW3
!
boot-start-marker
boot-end-marker
!
no aaa new-model
memory-size iomem 5
ip cef
!
no ip domain lookup
!
interface Loopback1
 ip address 192.168.48.66 255.255.255.248 secondary
 ip address 192.168.48.67 255.255.255.248 secondary
 ip address 192.168.48.68 255.255.255.248 secondary
 ip address 192.168.48.69 255.255.255.248 secondary
 ip address 192.168.48.70 255.255.255.248 secondary
 ip address 192.168.48.65 255.255.255.248
 ip ospf network point-to-point
!
interface Loopback2
 ip address 192.168.48.74 255.255.255.248 secondary
 ip address 192.168.48.75 255.255.255.248 secondary
 ip address 192.168.48.76 255.255.255.248 secondary
 ip address 192.168.48.77 255.255.255.248 secondary
 ip address 192.168.48.73 255.255.255.248
 ip ospf network point-to-point
!
interface Loopback3
 ip address 192.168.48.82 255.255.255.248 secondary
 ip address 192.168.48.83 255.255.255.248 secondary
 ip address 192.168.48.84 255.255.255.248 secondary
 ip address 192.168.48.85 255.255.255.248 secondary
 ip address 192.168.48.81 255.255.255.248
 ip ospf network point-to-point
!
interface Loopback4
 ip address 192.168.80.2 255.255.255.224 secondary
 ip address 192.168.80.3 255.255.255.224 secondary
 ip address 192.168.80.4 255.255.255.224 secondary
 ip address 192.168.80.5 255.255.255.224 secondary
 ip address 192.168.80.6 255.255.255.224 secondary
 ip address 192.168.80.7 255.255.255.224 secondary
 ip address 192.168.80.1 255.255.255.224
 ip ospf network point-to-point
!
interface Loopback5
 ip address 192.168.80.34 255.255.255.224 secondary
 ip address 192.168.80.35 255.255.255.224 secondary
 ip address 192.168.80.36 255.255.255.224 secondary
 ip address 192.168.80.37 255.255.255.224 secondary
 ip address 192.168.80.38 255.255.255.224 secondary
 ip address 192.168.80.39 255.255.255.224 secondary
 ip address 192.168.80.33 255.255.255.224
 ip ospf network point-to-point
!
interface Loopback6
 description Human Resources - Intranet/Web Service
 ip address 192.168.48.138 255.255.255.248 secondary
 ip address 192.168.48.139 255.255.255.248 secondary
 ip address 192.168.48.137 255.255.255.248
 ip ospf network point-to-point
!
interface Port-channel1
 switchport mode trunk
!
interface Port-channel2
 switchport mode trunk
!
interface Port-channel3
 switchport mode trunk
!
interface FastEthernet0/0
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface FastEthernet1/0
 switchport access vlan 210
!
!
interface FastEthernet1/9
 switchport mode trunk
 channel-group 2 mode on
!
interface FastEthernet1/10
 switchport mode trunk
 channel-group 2 mode on
!
interface FastEthernet1/11
 switchport mode trunk
 channel-group 3 mode on
!
interface FastEthernet1/12
 switchport mode trunk
 channel-group 3 mode on
!
interface FastEthernet1/13
 switchport mode trunk
 channel-group 1 mode on
!
interface FastEthernet1/14
 switchport mode trunk
 channel-group 1 mode on
!
interface FastEthernet1/15
!
interface Vlan1
 no ip address
!
interface Vlan108
 ip address 192.168.32.18 255.255.255.240
 ip access-group CTRL-RETAIL-TELLER in
!
interface Vlan708
 ip address 192.168.32.34 255.255.255.240
 ip access-group CTRL-RETAIL-TELLER in
!
router ospf 1
 router-id 10.10.11.3
 log-adjacency-changes
 passive-interface default
 no passive-interface Vlan108
 no passive-interface Vlan708
 network 192.168.32.18 0.0.0.0 area 1003
 network 192.168.32.34 0.0.0.0 area 1003
 network 192.168.48.64 0.0.0.31 area 1003
 network 192.168.80.0 0.0.0.7 area 1003
 network 192.168.80.32 0.0.0.7 area 1003
!
ip http server
no ip http secure-server
!
ip access-list extended CTRL-RETAIL-TELLER
 permit ip 192.168.48.0 0.0.0.15 192.168.48.68 0.0.0.1
 permit ip 192.168.48.32 0.0.0.7 192.168.48.68 0.0.0.1
 deny   ip any 192.168.48.64 0.0.0.7
 permit ip any any
!
control-plane
!
line con 0
 exec-timeout 0 0
 logging synchronous
line aux 0
line vty 0 4
 login
!
end

ip nat statistics on R1 shows the following:

R1#sh ip nat stat
Total active translations: 0 (0 static, 0 dynamic; 0 extended)
Outside interfaces:
  Ethernet1/0
Inside interfaces:
  Ethernet1/1.17, Ethernet1/1.18
Hits: 0  Misses: 0
CEF Translated packets: 0, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id: 1] access-list NAT-GRP interface Ethernet1/0 refcount 0
-- Inside Destination
[Id: 2] access-list RETAIL-WEB-GLOBAL pool RETAIL-WEB-LOCAL refcount 0
 pool RETAIL-WEB-LOCAL: netmask 255.255.255.248
        start 192.168.48.74 end 192.168.48.75
        type rotary, total addresses 2, allocated 0 (0%), misses 0
Queued Packets: 0

Problem: When I tried to ping 200.200.17.34 from ISP, it fails. It doesn't even create any ip nat translation entry. It tries to route the address without going through nat at all. (ISP has a route for 200.200.17.34, and the packet comes to R1 when I debug ip packet. And I added a route for 200.200.17.34 on R1 too because before that route added on, R1 tries to route first and fails. So I thought it's doing the routing first and then translates. But when I added the route, it still doesn't translate.) What have I done wrong?

And I'm not sure if this plays any role, but between R1 and SW3, there's an L2 switch.

Improve this question
22
  • You need to edit your question to give us full network device configurations. You are missing some information.
    – Ron Maupin ♦
    Feb 18, 2018 at 5:54
  • @RonMaupin, I did that for R1 & SW3. If you need other info, let me know. Thanks.
    – saba
    Feb 18, 2018 at 6:13
  • You have a static route pointing to another router: ip route 200.200.17.32 255.255.255.248 Ethernet1/1.17 192.168.32.18. What is the configuration of that router?
    – Ron Maupin ♦
    Feb 18, 2018 at 6:16
  • Man, I made a mistake on that route. It should be {ip route 200.200.17.32 255.255.255.248 Ethernet1/1.18 192.168.32.18}.. let me change that and get back to you. I am sorry.
    – saba
    Feb 18, 2018 at 6:20
  • OK, but we still need the configuration of the router to which you are routing that traffic. The servers are on the other side of that router.
    – Ron Maupin ♦
    Feb 18, 2018 at 6:23

1 Answer 1

Reset to default
2

Change ip nat inside destination list RETAIL-WEB-GLOBAL pool RETAIL-WEB-LOCAL to: ip nat outside destination list RETAIL-WEB-GLOBAL pool RETAIL-WEB-LOCAL

Improve this answer
5
  • Hmm.. I don't get this. I just tried your suggestion, and it didn't support that command. 'ip nat outside' only has source command. And since you implied that to let the session initiated from outside, outside command should be used, I tried to ping 200.200.17.34 from inside with my original setting, it fails. It goes to R1 and it reaches 200.200.17.18 which is nat outside interface on R1. Then it keeps cycling inside that interface. Like : 1 192.168.32.1 268 msec 2 * * * 3 200.200.17.18 68 msec 4 * * * 5 200.200.17.18 108 msec But there's no translation entry.
    – saba
    Feb 18, 2018 at 10:09
  • It may not be supported on your router, it needs to be outside as that is the direction the traffic comes from to initiate the nat, the alernative would be inside source with static pat, but that wouldn’t give you load balancing
    – user27899
    Feb 18, 2018 at 10:19
  • alternatively, you may be able to configure a static NAT on R1 to a dummy address on 192.168.32.16/28 and then configure your load-balancing NAT on SW3 with the inside/outside interfaces reversed, or look into SLB on SW3 if supported: cisco.com/c/en/us/td/docs/ios/slb/configuration/guide/…
    – user27899
    Feb 18, 2018 at 10:26
  • You could also try using NAT NVI, remove the ip nat outside and inside statements and use ip nat enable on the interfaces instead, now remove the ip nat inside destination command and replace with: ip nat destination list RETAIL-WEB-GLOBAL pool RETAIL-WEB-LOCAL, remove your overload nat and replace with: ip nat source list NAT-GRP interface e0/0 overload
    – user27899
    Feb 18, 2018 at 11:35
  • My IOS doesn't support ip nat destination list. So I went ahead with your another suggestion of SLB. Thank you.
    – saba
    Feb 22, 2018 at 11:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.