0

I am forwarding two ports of broadcast UDP data from an inside private network VLAN (VLAN 100) to two outside private networks via WAN connections on an ISR4431. The broadcast forwarding seems to work using the ip-helper addresses in the VLAN. The sources of the broadcast data are also NAT'd to the sources on the WAN ports. I am wanting to separate the packets to their appropriate outside private networks. However, I am having an issue with both ports of UDP data on both networks, port 5207 is from source 10.1.1.87 , this belongs on the 10.194.234.0 network and port 6001 is from source 10.1.1.99 and belongs on the 10.0.1.0 network. I have tried several iterations of extended access control lists on the VLAN output to control that data from each source to the WAN connections. I am currently at a loss. I have tried standard access lists on the two WAN ports with no affect, as well. I have attached relevant part of myconfiguration. Any and all comments and suggestions are welcome!

interface GigabitEthernet0/0/0
ip address 10.0.1.33 255.255.255.0
ip nat outside

interface GigabitEthernet0/0/1
ip address 10.194.234.1 255.255.255.0
ip nat outside

interface VLAN 100
 ip address 10.1.1.190 255.255.255.0
 ip helper-address 10.194.234.99
 ip helper-address 10.0.1.210
 ip nat inside
 ip access-group V100OUT in
ip nat inside source static 10.1.1.87 10.194.234.1
ip nat inside source static 10.1.1.99 10.0.1.33
ip forward-protocol udp 5207
ip forward-protocol udp 6001
ip access-list extended V100OUT
permit udp host 10.1.1.0 host 10.1.1.255
permit udp host 10.1.1.87 host 10.194.234.99
permit udp host 10.1.1.99 host 10.0.1.210
Improve this question
5
  • BEst thing to do is to google “Cisco interface packet order” and see in what order services are hit on an interface, that way you will know what IP’s etc to configure in the various sections.
    – Matt Douhan
    Feb 29, 2020 at 1:10
  • I suspect the destination IP address when the ACL is evaluated is the broadcast address. But I’m not sure if that’s 10.1.1.255 or 255.255.255.255 without seeing a tcpdump. I’d suggest changing the acl line to “permit udp host 10.1.1.87 any eq 5207 log” and see what gets logged. Then narrow it down.
    – Darrell Root
    Feb 29, 2020 at 2:22
  • I think you’re right. I know broadcast messages are 10.1.1.255 destinations for the respective ports. I will try the log on the acl as suggested. If the acl is applied on the broadcasts, it makes me wonder how to filter on WAN interface versus the other from the VLAN output.
    – Joe Hughes
    Feb 29, 2020 at 3:02
  • Just to clarify... From the inside private network src:10.1.1.87 dest 10.1.1.255 port 5207 broadcast UDP with ip-helper in vlan100 of 10.194.234.99 & ip forward of 5207, results in outside private network unicast udp output from G0/0/1 src: 10.194.134.1 dest of 10.194.234.99 port 5207 (works as intended). I also have src: 10.0.1.99 dest 10.194.234.99 port 6001 packets on this network. These packets are not wanted on this outside network. I also have the opposite condition of unwanted packets on the other outside private network. I want to control the broadcast forwarding.
    – Joe Hughes
    Feb 29, 2020 at 18:29
  • You really do not want to forward broadcasts. Broadcasting has really been deprecated, and IPv6 does not have broadcast. Broadcasts interrupt every host on the LAN, including hosts not at all interested in the broadcast. The modern way of doing it is to use multicast, and there are methods to route multicast.
    – Ron Maupin ♦
    Mar 1, 2020 at 2:10

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.