1

enter image description here

Hi, i'm having some problems with the current configuration i have on this network.

I have two nat pools one for the blue square routers, and another for the yellow ones. And i'm using snat to have a primary and backup router in each "branch"(blue-> boston, yellow->Lisbon).

The nat translation works fine, i can ping from the pc on the blue square to the primary router of the yellow square, and vice versa but i cannot ping beetween pcs.

Here are the configurations i have at the moment Primary blue/Boston router:

interface FastEthernet0/0.1
 encapsulation dot1Q 2010
 ip address 10.64.64.1 255.255.240.0
 ip nat inside
 ip virtual-reassembly in

interface FastEthernet1/0
 ip address 200.1.1.128 255.255.254.0
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto

ip nat Stateful id 21
 primary 10.64.64.1
 peer 10.64.64.2
 mapping-id 10

ip nat pool BOSTONPOOL 200.1.1.130 200.1.1.254 netmask 255.255.254.0
ip nat inside source list 1 pool BOSTONPOOL mapping-id 10 overload
ip route 10.32.0.0 255.224.0.0 200.1.1.0
access-list 1 permit 10.64.0.0 0.31.255.255

and i have an identical configuration in the yellow primary router as well (with a diferent pool, etc). in the secondary router i have a similar configuraton only changing the primary to backup, and the peer address.

It is also to note that i have static routes in the routers to the other private network, in this case in the boston routers i have a static network to the lisbon network throug the address of the Lisbon router.

3

"The nat translation works fine, i can ping from the pc on the blue square to the primary router of the yellow square, and vice versa but i cannot ping beetween pcs."

That would be correct because you are using NAPT. If you originate traffic from inside, say from a host in the blue box, the blue router through which the traffic passes will create a NAT table entry so that return traffic can come back to the originating host. The yellow router will not have a NAT table entry, so the traffic originating from the host in the blue box will be destined for the address of the yellow router, and the yellow router, not a host in the yellow box. You will need to create a static NAT table entry for that to happen, but you can only create one per transport protocol and transport address.

You have run across a weakness in NAPT, where it breaks the IP premise of end-to-end connectivity.

I have two nat pools one for the blue square routers, and another for the yellow ones.

Actually, you have four routers, each with different NAPT pools, and they cannot share the pools. Each router will actually have three NAPT pools and tables; one each for TCP, UDP, and ICMP. The TCP NAPT table and pool on the blue primary router is not shared with the TCP NAPT table and pool on the blue secondary router. That can lead to problems if you have asymmetric routing.

2

NAT can't work in that case as Ron has pointed out.

In order to provide end-to-end connectivity for IPv4, a tunnel is required. The tunnel allows you to pass privately addressed packets over the Internet (encapsulated by publicly addressed packets) unchanged. An IPsec tunnel should be preferred as it also encrypts the tunneled traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.