0

I am so confused with fundamentals that I used to be an expert in, so I have this topology enter image description here

Please answer to my questions separately,

Question 1) So if I have two DNS severs, and ofc two IP address(81.1.1.30 & 31) available from the ISP

This config would be suffice for Port forwarding?

Switch3650(config)#ip nat inside source static 192.168.1.50 80 81.1.1.30 80

Switch3650(config)#ip nat inside source static 192.168.1.51 80 81.1.1.31 80

Switch3650(config)#int vlan 1

Switch3650(config-if)#ip nat inside

Switch3650(config)#int fa1/2

Switch3650(config-if)#ip nat outside

and configuration of my outside interface only has to have one IP address configured or two?

Switch3650(config)#int fa1/2

Switch3650(config-if)#ip add 81.1.1.30 255.255.255.254

**or** defining two ip addresses on my interface

Switch3650(config)#int fa1/2

Switch3650(config-if)#ip add 81.1.1.30 255.255.255.255

Switch3650(config-if)#ip add 81.1.1.31 255.255.255.255 secondary

am I achieving the same result here? so when do we use secondary ip, when we can't cover our available valid(public) IPs with subnet mask in one line?

so what will happen if I only put one ip address on the outside interface? the nat won't translate anymore, because it can't find the outside interface, because it's not listed in the routing table, right?

Switch3650(config-if)#ip add 81.1.1.30 255.255.255.255

Question 2)

so let's say I wanna PAT overload the rest of my network which they are not those two servers and they are clients with ip ranges from 192.168.1.1 to 192.168.1.49 how should I calculate the wild card mask?

Switch3650(config)#access-list 1 permit 192.168.1????????????

Switch3650(config)#ip nat inside source list 1  81.1.1.30 80 overload

this is what I put

**0 0** 0 0 0 0 0 1 = 1

**0 0** 1 1 0 0 0 1 = 49

according to this algorithm

Network Address is 0 which is wrong it has to be 1, because it starts from 1,

what am I missing?

the Netmask has to be I guess: 192 equal to wildcard of 63

Please please answer to all my questions, I am so confused

Thanks

  • I know this is a packet-tracer picture, but I can't get passed the fact that Cisco Switches don't do NAT. Also, to specify ports in NAT, you also have to specify tcp or udp. – Ricky Beam Aug 13 at 5:59
  • 6500 series does – Lord Arthas Aug 13 at 6:10
0

1) You don't need to use IP address on the interface for NAT outside address at all. For your example, if you have 81.1.1.30/24 on your interface, you can use any other of 81.1.1.0/24 net for the NAT, 81.1.1.100 and 81.1.1.200, fo instance.

Also, your configuration with /32 mask (ip add 81.1.1.30 255.255.255.255) does not have much sense for me, how you can connect this to upstream?

2) if you need NAT addresses from 1 to 49 you need to split all address space to right subnets, for your example (1-49) it can be:

access-list 1 permit 192.168.1.1/32  
  access-list 1 permit 192.168.1.2/31  
  access-list 1 permit 192.168.1.4/30  
  access-list 1 permit 192.168.1.8/29  
  access-list 1 permit 192.168.1.16/28  
  access-list 1 permit 192.168.1.32/28  
  access-list 1 permit 192.168.1.49/32

It will work for (1-49), but it is very strange design for me, you can just use 192.168.1.0/27 (0-31) and 192.168.1.32/28 (32-47) for such thing.

  • yes that was just an example but thx for bringing it, because you need 1 IP with all host 0bits for NET and 1 IP with all 1 bits host for BCast, so 2 ip from the range is already allocated which makes 32 bits mask too short for usage, can you elaborate then when does secondary IP addresses on an interface come handy? – Lord Arthas Aug 13 at 6:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.