NAT with different Subnets

Unanswered Question
Nov 29th, 2007
User Badges:

We have a hub and spoke architecture:


HQ - PIX515, Cisco 3662 Router

Location1 - Cisco 1600 Router

Location2 - Cisco 1600 Router

Location3 - Cisco 1600 Router

Location4 - Cisco 1600 Router


Each location is connect to HQ via a Point-to-Point Full T1.


Each location is on a diffent subnet (e.g. 10.100.X.X - HQ, 10.1.X.X - Loc1, 10.2.X.X - Loc2, etc.)


We have a Security Camera Workstation at each location, that we would like to be able to access from the outside via http.


I have setup a public IP for the HQ site, and can access HQ's security cameras from the outside.


I would like to be able to access the other workstations from the outside via public IP's, as well. How can I accomplish that? How would I NAT across different subnets?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Jon Marshall Fri, 11/30/2007 - 03:21
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Hi


1) Does the Internet only come into the HQ site

2) Where is the pix in relation to the 3662 router ie. where does the Internet connect and where do the 1600's connect

3) Where are you doing the HQ NAT

4) What is the version of Pix code.


Apologies for all the questions but we need to know more before we can answer the question.


Jon

rsinghnyc Fri, 11/30/2007 - 03:59
User Badges:

Jon,


In answer to your questions:


1) Yes

2) Internet->PIX->3662->1600's

3) On the PIX

4) 6.3(5)


Would this suffice on the PIX:


static (inside,outside) 12.34.56.7 10.100.2.2 netmask 255.255.255.255

static (inside,outside) 12.34.56.8 10.1.1.12 netmask 255.255.255.255

static (inside,outside) 12.34.56.9 10.2.2.11 netmask 255.255.255.255

static (inside,outside) 12.34.56.10 10.3.3.33 netmask 255.255.255.255


Jon Marshall Fri, 11/30/2007 - 07:38
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Hi


Yes, this should work fine. The key thing i was worried about was that you might be trying to send traffic back out the same interface it came in on with the pix and with pix v6.3 you can't do this.


But your setup should work fine. As long as the spoke sites use default routing to get back to the HQ 3662.


Jon

andyjames Fri, 11/30/2007 - 04:07
User Badges:

Hello,


I have natted through for remote subnets before on a router but not with a PIX involved.


I am guessing it would be the same though. Choose a different port number for each site and it should work the same as the setup you have for the HQ now.


HTH.


Andy.

Actions

This Discussion