cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
570
Views
0
Helpful
6
Replies

NAT and no NAT together?

jorolas
Level 1
Level 1

Hi,

Imagine I have 3 networks: Lan1, Lan2, and WAN for example.

I want Lan1 clients to access Lan2 natted (ie overlapping Lan2 gw).

Up to here it seems to be an easy task. I do config ip nat inside and ip nat outside in Lan1 and Lan2 networks. I do configure ip nat static source list with an access-list which allows only Lan1 to Lan2 traffic.

What do I need to do if I want Lan1 hosts to accces Wan network without being natted? Without further configuration I do not have communication between Lan1 and Wan unless I add ip nat outside to Wan interface, and I change acl for allowing this traffic as well.

Is it possible this scenario?

Thanks in advance,

Jorge

6 Replies 6

Jon Marshall
Hall of Fame
Hall of Fame

Jorge

Could you post config of router.

Jon

Sure:

hostname 6501

!

no aaa new-model

ip subnet-zero

!

!

no ip domain-lookup

!

no mls flow ip

no mls acl tcam share-global

mls ip slb purge global

mls ip multicast flow-stat-timer 9

mls cef error action freeze

!

diagnostic cns publish cisco.cns.device.diag_results

diagnostic cns subscribe cisco.cns.device.diag_commands

!

redundancy

mode sso

main-cpu

auto-sync running-config

system flowcontrol bus auto

spanning-tree mode pvst

spanning-tree extend system-id

!

vlan internal allocation policy ascending

vlan access-log ratelimit 2000

!

!

no crypto ipsec nat-transparency udp-encaps

!

interface GigabitEthernet4/21

switchport

switchport access vlan1

no ip address

!

interface GigabitEthernet4/22

switchport

switchport access vlan2

no ip address

!

interface GigabitEthernet4/23

switchport

switchport access vlan3

no ip address

!

!

interface Vlan1

description LAN1

ip address 192.168.1.1 255.255.255.0

ip nat inside

!

interface Vlan2

description LAN2

ip address 192.168.2.1 255.255.255.0

ip nat outside

!

interface Vlan3

description WAN

ip address 192.168.3.1 255.255.255.0

!

ip nat static source list 101 interface vlan2 overlap

access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

!

ip default-gateway 192.168.3.2

ip classless

!

end

Hey!!

I found answer by myself. I think I need to use route-maps instead of access list!!

I ll try and let you know.

Hi again, couldnt make it work :-(

Packets from vlan 1 to vlan 2 natted, but no communication between vlan 1 and vlan 3.

Thing is that icmp request from vlan 1 reach unnatted vlan3, but icmp replays from vlan3 do not come back.

Any idea?

This is what I did:

hostname 6501

!

no aaa new-model

ip subnet-zero

!

!

no ip domain-lookup

!

no mls flow ip

no mls acl tcam share-global

mls ip slb purge global

mls ip multicast flow-stat-timer 9

mls cef error action freeze

!

diagnostic cns publish cisco.cns.device.diag_results

diagnostic cns subscribe cisco.cns.device.diag_commands

!

redundancy

mode sso

main-cpu

auto-sync running-config

system flowcontrol bus auto

spanning-tree mode pvst

spanning-tree extend system-id

!

vlan internal allocation policy ascending

vlan access-log ratelimit 2000

!

!

no crypto ipsec nat-transparency udp-encaps

!

interface GigabitEthernet4/21

switchport

switchport access vlan1

no ip address

!

interface GigabitEthernet4/22

switchport

switchport access vlan2

no ip address

!

interface GigabitEthernet4/23

switchport

switchport access vlan3

no ip address

!

!

interface Vlan1

description LAN1

ip address 192.168.1.1 255.255.255.0

ip nat inside

!

interface Vlan2

description LAN2

ip address 192.168.2.1 255.255.255.0

ip nat outside

!

interface Vlan3

description WAN

ip address 192.168.3.1 255.255.255.0

!

ip nat inside source route-map Nat_only_vlan1_2 interface vlan 6 overload

access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

access-list 101 deny ip 192.168.1.0 0.0.0.255 any

route-map Nat_only_vlan1_2 permit 1

match ip address 101

!

ip default-gateway 192.168.3.2

ip classless

!

end

Thanks in advance

Jorge

I'm not sure the NAT is the issue. Rather you don't seem to have a default-route on your switch. You have a default-gateway but this is something very different.

If you don't have it can you

1) remove "ip default-gateway 192.168.3.2"

2) add "ip route 0.0.0.0 0.0.0.0 192.168.3.2"

Jon

Hi,

finally, I could find the solution. It was as easy as the first configuration I made:

nterface Vlan1

description LAN1

ip address 192.168.1.1 255.255.255.0

ip nat inside

!

interface Vlan2

description LAN2

ip address 192.168.2.1 255.255.255.0

ip nat outside

!

interface Vlan3

description WAN

ip address 192.168.3.1 255.255.255.0

!

ip nat static source list 101 interface vlan2 overlap

access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

With this configuration, I can reach from lan1 lan2 with my packets natted, and I can reach from lan1 to Wan without being natted as I expected.

Problem I had was related to an indirect route issue, but nothing regarding default-gateway as Jon thought.

By the way Jon, why ip default-gateway is something very different than ip route 0.0.0.0?

Regards,

Jorge

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card