12-17-2008 05:06 AM - edited 03-06-2019 03:01 AM
Hi,
Imagine I have 3 networks: Lan1, Lan2, and WAN for example.
I want Lan1 clients to access Lan2 natted (ie overlapping Lan2 gw).
Up to here it seems to be an easy task. I do config ip nat inside and ip nat outside in Lan1 and Lan2 networks. I do configure ip nat static source list with an access-list which allows only Lan1 to Lan2 traffic.
What do I need to do if I want Lan1 hosts to accces Wan network without being natted? Without further configuration I do not have communication between Lan1 and Wan unless I add ip nat outside to Wan interface, and I change acl for allowing this traffic as well.
Is it possible this scenario?
Thanks in advance,
Jorge
12-17-2008 05:12 AM
Jorge
Could you post config of router.
Jon
12-17-2008 07:36 AM
Sure:
hostname 6501
!
no aaa new-model
ip subnet-zero
!
!
no ip domain-lookup
!
no mls flow ip
no mls acl tcam share-global
mls ip slb purge global
mls ip multicast flow-stat-timer 9
mls cef error action freeze
!
diagnostic cns publish cisco.cns.device.diag_results
diagnostic cns subscribe cisco.cns.device.diag_commands
!
redundancy
mode sso
main-cpu
auto-sync running-config
system flowcontrol bus auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
vlan access-log ratelimit 2000
!
!
no crypto ipsec nat-transparency udp-encaps
!
interface GigabitEthernet4/21
switchport
switchport access vlan1
no ip address
!
interface GigabitEthernet4/22
switchport
switchport access vlan2
no ip address
!
interface GigabitEthernet4/23
switchport
switchport access vlan3
no ip address
!
!
interface Vlan1
description LAN1
ip address 192.168.1.1 255.255.255.0
ip nat inside
!
interface Vlan2
description LAN2
ip address 192.168.2.1 255.255.255.0
ip nat outside
!
interface Vlan3
description WAN
ip address 192.168.3.1 255.255.255.0
!
ip nat static source list 101 interface vlan2 overlap
access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
!
ip default-gateway 192.168.3.2
ip classless
!
end
12-17-2008 07:47 AM
Hey!!
I found answer by myself. I think I need to use route-maps instead of access list!!
I ll try and let you know.
12-17-2008 09:14 AM
Hi again, couldnt make it work :-(
Packets from vlan 1 to vlan 2 natted, but no communication between vlan 1 and vlan 3.
Thing is that icmp request from vlan 1 reach unnatted vlan3, but icmp replays from vlan3 do not come back.
Any idea?
This is what I did:
hostname 6501
!
no aaa new-model
ip subnet-zero
!
!
no ip domain-lookup
!
no mls flow ip
no mls acl tcam share-global
mls ip slb purge global
mls ip multicast flow-stat-timer 9
mls cef error action freeze
!
diagnostic cns publish cisco.cns.device.diag_results
diagnostic cns subscribe cisco.cns.device.diag_commands
!
redundancy
mode sso
main-cpu
auto-sync running-config
system flowcontrol bus auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
vlan access-log ratelimit 2000
!
!
no crypto ipsec nat-transparency udp-encaps
!
interface GigabitEthernet4/21
switchport
switchport access vlan1
no ip address
!
interface GigabitEthernet4/22
switchport
switchport access vlan2
no ip address
!
interface GigabitEthernet4/23
switchport
switchport access vlan3
no ip address
!
!
interface Vlan1
description LAN1
ip address 192.168.1.1 255.255.255.0
ip nat inside
!
interface Vlan2
description LAN2
ip address 192.168.2.1 255.255.255.0
ip nat outside
!
interface Vlan3
description WAN
ip address 192.168.3.1 255.255.255.0
!
ip nat inside source route-map Nat_only_vlan1_2 interface vlan 6 overload
access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 101 deny ip 192.168.1.0 0.0.0.255 any
route-map Nat_only_vlan1_2 permit 1
match ip address 101
!
ip default-gateway 192.168.3.2
ip classless
!
end
Thanks in advance
12-17-2008 09:35 AM
Jorge
I'm not sure the NAT is the issue. Rather you don't seem to have a default-route on your switch. You have a default-gateway but this is something very different.
If you don't have it can you
1) remove "ip default-gateway 192.168.3.2"
2) add "ip route 0.0.0.0 0.0.0.0 192.168.3.2"
Jon
12-18-2008 12:16 AM
Hi,
finally, I could find the solution. It was as easy as the first configuration I made:
nterface Vlan1
description LAN1
ip address 192.168.1.1 255.255.255.0
ip nat inside
!
interface Vlan2
description LAN2
ip address 192.168.2.1 255.255.255.0
ip nat outside
!
interface Vlan3
description WAN
ip address 192.168.3.1 255.255.255.0
!
ip nat static source list 101 interface vlan2 overlap
access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
With this configuration, I can reach from lan1 lan2 with my packets natted, and I can reach from lan1 to Wan without being natted as I expected.
Problem I had was related to an indirect route issue, but nothing regarding default-gateway as Jon thought.
By the way Jon, why ip default-gateway is something very different than ip route 0.0.0.0?
Regards,
Jorge
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide