Questions tagged [nat]
For questions about Network Address Translation (NAT), a method of modifying network address information in IPv4 packet headers.
630
questions
4
votes
1
answer
9k
views
UDP Port Forwarding Range
We just purchased a cisco 3825 router running IOS 15.1. The slice of the
topology in question is as follows:
RTP (8000-20000) RTP (8000-20000)
192.168.2.1 <-------------->...
- 431
7
votes
2
answers
2k
views
PPPoE with NAT configuration broken
We are trying to replace our existing router with a newly purchased
Cisco router:
GigabitEthernet0/0: PPPoE
GigabitEthernet0/1: 192.168.2.1
The PPPoE is getting established perfectly, and I can ping
...
- 431
8
votes
2
answers
7k
views
NAT with VPN Site to Site and Remote LANs with same IP address
I have a ASA5510 to connect clients to my company. I use a site-to-site IPSec VPN with a variety of vendors on the other side (Cisco, Sonicwall, Zyxel, Checkpoint, etc...).
For every remote LAN, I ...
- 81
1
vote
1
answer
748
views
Block of 64 public IP's, how many usable?
We have been assigned a block of 64 IP's by ARIN (/26). We have a private range that is a /22. Every time we get a new block of public IP's we NAT them to the next available addresses in that range, ...
- 3,310
11
votes
2
answers
6k
views
Cisco ASA double NAT with DNS translation
I'm trying to set up double Auto NAT with DNS translation on Cisco ASA 9.0(3), and I'm having a few challenges with the DNS portion. I got double NAT working correctly, such that I have a server in ...
- 29.8k
2
votes
1
answer
4k
views
Unable to forward port 443 using Static NAT on Cisco 1921
I have configured Static NAT to forward port 443 to 192.168.0.3 internal IP address as follows:
ip nat inside source static tcp 192.168.0.3 443 interface Dialer1 443
However, I see "Page Not Found" ...
- 21
6
votes
1
answer
8k
views
Zyxel USG100. GS1910 Vlans cannot access wan
Iam trying to configure a network that looks like this:
My Vlans and static routing seams to work fine, i am able to ping between the VLANs. My problem is, when i try to make a connection to the ...
- 163
6
votes
1
answer
3k
views
HSRP and Static NAT behavior
May I have your opinion on the following matter?
Configuration:
Two 2911 routers.
Doing HSRP on Wan and LAN side with 2 standby groups.
Doing static NAT to internal servers.
Added redundacy keyword ...
- 333
3
votes
1
answer
1k
views
Forcing Cisco DNS relay to send requests from behind PAT [closed]
I have a Cisco 1811 configured with PAT:
interface FastEthernet0
ip address dhcp
ip nat outside
interface Vlan1
ip address 192.168.0.1 255.255.255.0
ip nat inside
ip nat inside source ...
- 133
6
votes
1
answer
4k
views
Traceroute to an internet address when I'm behind a Dynamic-PAT firewall?
Consider this network diagram:
In this scenario, the router is performing "Dynamic PAT" (I'm using Cisco's definition) where all "real" or "inside" addresses are mapped to a single outside address ...
- 904
1
vote
1
answer
177
views
How to map wan to my voip lan?
I am using SonicWall NSA 2400 in my organization. We configured two different lans in x0 and x3 interfaces. Initially we have only one Internet line which we configured in x2 and both the lan ...
- 11
2
votes
0
answers
571
views
How to force route for MIP in screenos, multiple ISP untrust
Scenairo: SSG140 in HA configuration. Four interfaces:
LAN (trust) eth0/0 172.20.0.0./24
ISP1 (untrust) eth0/1 1.1.1.130/28
ISP2 (untrust) eth0/2 2.2.2.194/28
ISP3 (untrust) eth0/3 3.3.3.130/28
...
- 21
3
votes
1
answer
767
views
internet access to remote subnet
I have a main building with static NAT (One IP Address from ISP) and a remote building with a Point to Point T1 connecting it to the main building.
If I use eigrp and redistribute static I can access ...
- 33
0
votes
1
answer
149
views
ASA 5505 Odd Issue
I've setup some static nat entries in an ASA 5505. If I ping the external ip, the response I get back is the internal ip address...
Example:
$ping 12.12.12.4
PING 12.12.12.4 (12.12.12.4): 56 data ...
- 1,378
3
votes
1
answer
724
views
CIsco ASA 5505 have to change IP address of Server due to restructure
I just went through and restructured my IP pool on vlan 1. My issue is that my Windows VPN Server is now 10.1.10.11 instead of 10.1.10.122. I statically assigned the Windows server outside of my IP ...
- 463
4
votes
1
answer
1k
views
Enabled VPN -- Site to site -- Cannot access internet now .. Cisco ASA 5505
I had just enabled site to site VPN access ... I am assuming something got messed up with NAT ... It's the strangest thing .. I cannot find anything wrong through ASDM, or CLI .. Yet, I can ...
- 463
6
votes
1
answer
8k
views
Cisco ASA cannot get "inside" vlan to internet through "outside" vlan
I just got my outside vlan configured up-and-running See Post Here. I was able to get vlan 2 pinging to the internet 8.8.8.8 specifically. However, now I honestly think I am misunderstanding what ...
- 463
5
votes
1
answer
15k
views
IOS - Nat from a VRF to WAN interface in global routing table
Trying to get my head round how best to achieve the above
In essence we have s speed test server that is available in the CPE's global routing table , that we would like the customer in VRF X to test ...
- 1,609
13
votes
4
answers
35k
views
What layer of the OSI model does NAT work?
Simple question and the answer is layer 3 of course, but can we say that PAT is working on layer 4 also because it deals with port numbers which is a layer 4 function?
Or is it only a layer 3 ...
- 133
8
votes
2
answers
2k
views
SNAT vs PBR for Server Load Balancing
In an one-armed SLB configuration, SNAT is used to force return-traffic to pass through the SLB. This has one negative: simply that web logs cannot capture the true client IP unless passed in XFF (X-...
- 7,094
8
votes
1
answer
7k
views
About the inside local and outside local and inside global and outside global
I have some concept problem with the NAT. Here is the Cisco definition for the local and Global and the NAT operation.
Local address—A local address is any address that appears on the inside ...
- 369
7
votes
2
answers
19k
views
Cisco ASA 8.4(3); NAT multiple ports on public IP to private IP
I have the following configuration on an ASA running 8.4 already;
object network SERVER-01
host 192.168.0.1
!
object network SERVER-01
nat (Inside,Outside) static interface service tcp 3389 5001
I ...
- 5,290
11
votes
4
answers
23k
views
Using IP addresses from IP pool given by ISP
My ISP says that it can provide an optic fiber connection with a pool of 4 static IP addresses (subnet 255.255.255.248 i think).
My question is that if I get that connection,
1 ip will be used for ...
- 213
13
votes
2
answers
30k
views
Open a range of TCP ports in Cisco IOS NAT
ip nat inside source static 192.168.1.10 10.10.10.9 route-map RANGE
!
route-map RANGE permit 100
match ip address 102
!
access-list 102 permit tcp host 192.168.1.10 range 3000 3389 any
The ...
- 131
10
votes
3
answers
8k
views
interpreting ping results
I'm pinging yahoo.com and am I'm puzzled by the result.
C:\Users\jon>ping -t yahoo.com
Pinging yahoo.com [98.138.253.109] with 32 bytes of data:
Reply from 98.138.253.109: bytes=32 time=195ms TTL=...
- 203
8
votes
2
answers
6k
views
How to host server in DMZ zone of an ASA
I have an ASA5525-X with 9.1.2. On it are several interfaces, but primarily I'm looking at:
(fake subnets)
inside 10.0.0.0/24, security level 100
outside 10.0.200.0/24, security level 0
DMZ 10.0.100....
- 3,052
9
votes
2
answers
9k
views
pfSense multi-wan Bridge, NAT, Load balancing and CARP
Context
I currently have :
1 pfSense 2.0.2 router (on a Firebox X-Peak X5000)
2 WAN
1 LAN
3 Servers
My interfaces
WAN1 68.XX.XXX.98 to 69.XX.XXX.102
WAN2 65.XXX.XXX.58 to 66.XXX.XXX.62
LAN 192.168....
- 337
21
votes
3
answers
4k
views
CEF operations on L3 switch vs router
I understand that L3 switches use CEF for faster packet forwarding. However, CEF will not work for packets that need to undergo NAT. Does this mean CEF isn't used by edge routers and edge L3 switches? ...
- 1,005
6
votes
1
answer
3k
views
Cisco 867 forward UDP port range
I need to forward an UDP port range to a specific private IP address in my LAN.
In order to forward one port to an internal IP I do:
access-list <acc_list_number> permit <port_type> any ...
- 206
8
votes
4
answers
14k
views
ASA use of proxy ARP for NAT
I will be performing NAT on the outside interface of an ASA to a web server within a DMZ. I would like to disable proxy-arp on all the interfaces that I can. I know that outside interface will need to ...
- 799