1

I have configured BGP for routing and NAT for HQ and Branch. I can ping from windows / server to public IP and also Linux Mint ping to public IP. but, I cannot ping / communicate between network HQ to Branch and Branch cannot ping / communicate to network HQ. Is it necessary to configure something in R2 / R3 or may it be necessary to configure R1.

Btw, for the NAT I follow https://www.geeksforgeeks.org/types-of-network-address-translation-nat/ for PAT configuration. Thank you.

Windows Server: DHCP server

Ubuntu: Web Server

enter image description here

R2/HQ Router:

 interface FastEthernet0/0
 no ip address
 speed auto
 duplex full
!
interface FastEthernet0/0.22
 encapsulation dot1Q 22
 ip address 192.168.27.129 255.255.255.248
 ip nat inside
!
interface FastEthernet0/0.100
 encapsulation dot1Q 100
 ip address 192.168.27.1 255.255.255.192
 ip helper-address 192.168.27.130
 ip helper-address 192.168.27.131
 ip nat inside
!
interface FastEthernet0/1
 no ip address
 shutdown
 speed auto
 duplex auto
!
interface Serial1/0
 ip address 200.200.10.2 255.255.255.0
 ip nat outside
 serial restart-delay 0
!
interface Serial1/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
router bgp 3001
 bgp router-id 2.2.2.2
 bgp log-neighbor-changes
 network 192.168.27.0 mask 255.255.255.192
 network 192.168.27.128 mask 255.255.255.248
 network 200.200.10.0
 neighbor 200.200.10.1 remote-as 3000
!
ip nat inside source list 1 interface Serial1/0 overload
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
access-list 1 permit 192.168.27.0 0.0.0.63
access-list 1 permit 192.168.27.128 0.0.0.7

R3/Branch Router

 interface FastEthernet0/0
 no ip address
 speed auto
 duplex full
!
interface FastEthernet0/0.200
 encapsulation dot1Q 200
 ip address 192.168.27.65 255.255.255.192
 ip helper-address 192.168.27.130
 ip helper-address 192.168.27.131
 ip nat inside
!
interface FastEthernet0/1
 no ip address
 shutdown
 speed auto
 duplex auto
!
interface Serial1/0
 ip address 200.200.20.2 255.255.255.0
 ip nat outside
 serial restart-delay 0
!
interface Serial1/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
router bgp 3002
 bgp router-id 3.3.3.3
 bgp log-neighbor-changes
 network 192.168.27.64 mask 255.255.255.192
 network 200.200.20.0
 neighbor 200.200.20.1 remote-as 3000
!
ip nat inside source list 1 interface Serial1/0 overload
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
access-list 1 permit 192.168.27.64 0.0.0.63

R1/ISP Router

interface Serial1/0
 ip address 200.200.10.1 255.255.255.0
 serial restart-delay 0
!
interface Serial1/1
 ip address 200.200.20.1 255.255.255.0
 serial restart-delay 0
!
interface Serial1/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 no ip address
 shutdown
 serial restart-delay 0
!
router bgp 3000
 bgp router-id 1.1.1.1
 bgp log-neighbor-changes
 network 200.200.10.0
 network 200.200.20.0
 neighbor 200.200.10.2 remote-as 3001
 neighbor 200.200.20.2 remote-as 3002

enter image description here enter image description here

Improve this question

1 Answer 1

Reset to default
1

You seem to have multiple problems:

  • Your interface FastEthernet0/0 does not need helper addresses as nothing is on the default.
  • Does your switch have a trunk enabled to the router?
  • You are using the NAT ACL, so you do not need or want the ip nat pool command.
  • You do not advertise networks via BGP that get translated because to the outside world they do not exist, only the outside address exists. You cannot Initiate traffic from outside the NAT unless you forward specific ports to specific inside addresses. That will certainly stop your ping.
  • You will need to forward DHCP to one of the DHCP servers (you can only forward one port to one inside address.

What it seems that you want to do is create a tunnel from the HQ to the Branch in order to share resources between the two. You can dump BGP (it's not really doing anything for you the way you have it configured) and use default routes from both sites to R1.

Then, you set up a tunnel between the HQ and Branch routers.

Improve this answer
3
  • Problem 1: Already delete the IP helper. Problem 2: Yes. I already configure trunk. Problem 3: Noted. Already delete too. Problem 4: I already edit my question and my configuration. Is it true need to add network for 200.200.10.0 mask 255.255.255.0 on R2 and 200.200.20.0 mask 255.255.255.0 in R3 at router bgp on both side? Problem 5: What do you mean?Windows and Linux get DHCP from windows server. Statement for tunnel: Does it means need to create tunnel first and Branch can open web server from Ubuntu and can ping the HQ ? Statement dump BGP: so I still can proceed with my BGP?
    – Script Kiddies
    Dec 8, 2020 at 6:44
  • You definitely want a tunnel. It provides a direct, virtual link between your locations, providing end-to-end connectivity for your privately addressed networks without NAT.
    – Zac67 ♦
    Dec 8, 2020 at 10:08
  • Okay now I understand. For branch, I do not need to get IP DHCP from HQ, just create another DHCP server on R3 router. For NAT I create static/PAT for HQ and for Branch using dynamic NAT. So PC at branch will get access to HQ using site to site tunneling right? So mark this question as solved. Thank you. I get the idea now.
    – Script Kiddies
    Dec 8, 2020 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.