04-17-2009 01:56 AM - edited 03-06-2019 05:14 AM
Hi there,
this discussion (to EASY STORY) is supossed to :
1) get an confirmation, if the behaviour is bug or normal. If normal, what can I do to accomplish my task.
2) let someone with latest IOS train to test it, or perhaps to open a case if this is in his interest to be running, too. I dont have time, nor it's such criticial task to open a case on this.
So, after long time I underwent a research of full caveats document on the web, found nothing pointing to this NAT issue , for IOS 12.4(18), lets say IP ADv. Service I run. But issue \
may lie in whatever version of that train, even the latest 12.4(23)..
Well, I have a router with 2 interfaces, Fa0/0 to my PC (nat inside), Fa0/1 (nat outside) to modem and Internet.. and a single NAT rule set up, to establish a path to modem (has
a Web GUI), which normaly has no route back to PC. So the rule (static source) makes source IP of PC packets to get translated to source IP of F0/1 - direct link with that
modem. This is right, and 100% this must perform for packets traversing the router between these interfaces.
However, for traffic originating from router and related only to FE0/1 interface with modem (when I want to perform simple ping to existing Internet host), the router applies
this rule alike!!, and tries to translate the responses to go to your PC on F0/0! This is crazy. And the question 1 again is, if this is normal, and if yes, how can I make the
router traffic to run in parallel with NAT rule. If I turn it off, it runs OK.
THANKS!
3) The configuration first :
interface FastEthernet0/0
description <<e.g towards remote PC located on different subnet>
ip address 172.19.250.42 255.255.255.192
ip nat inside
ip virtual-reassembly
speed 100
full-duplex
!
interface FastEthernet0/1
description PS_UPLINK... to modem and Internet
ip address 172.16.254.97 255.255.255.248
ip nat outside
ip virtual-reassembly
speed 100
full-duplex
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 172.16.254.98
ip route a.a.78.65 172.19.250.1 // its the address of remote PC
!
!
no ip http server
no ip http secure-server
ip nat inside source static a.a.78.65 interface FastEthernet0/1
2) Failing pings, see the "." ...
SRCGRZ33#ping x.x.94.140
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to x.x.94.140, timeout is 2 seconds:
.
Apr 17 10:11:03.004 CET: NAT*: s=x.x.94.140, d=172.16.254.97->a.a.78.65 [41821].
Apr 17 10:11:05.067 CET: NAT*: s=x.x.94.140, d=172.16.254.97->a.a.78.65 [41822].
Apr 17 10:11:07.046 CET: NAT*: s=x.x.94.140, d=172.16.254.97->a.a.78.65 [41824].
Apr 17 10:11:09.074 CET: NAT*: s=x.x.94.140, d=172.16.254.97->a.a.78.65 [41826].
Success rate is 0 percent (0/5)
SRCGRZ33#
3) A cosmetic issue... look for icmptimeout value 60000.. when normally its defined in seconds, and counters decreseas in seconds properly :)
SRCGRZ33#sh ip nat translations verbose
Pro Inside global Inside local Outside local Outside global
icmp 172.16.254.97:27 a.a.78.65:27 x.x.94.140:27 x.x.94.140:27
create 00:00:09, use 00:00:04 timeout:60000, left 00:00:55,
flags:
extended, use_count: 0, entry-id: 1128, lc_entries: 0
Solved! Go to Solution.
04-17-2009 03:45 AM
Sorry , My Typo as usual.
!
ip nat inside source list YOURPC interface f0/1 overload
!
HTH,
Toshi
04-17-2009 03:12 AM
Peter,
###############
the router applies this rule alike!!, and tries to translate the responses to go to your PC on F0/0! This is crazy. And the question 1 again is, if this is normal,
Yes! This is normal and Yes!!! It's kinda crazy.(grin)
When you defined the static nat statement like that it will permanently show up in the NAT table. So whatever traffic coming into Dest,IP:172.16.254.97. Router will perform NAT those traffic to your PC.
###############
how can I make the router traffic to run in parallel with NAT rule.
Let's do the following steps.
!
ip access-list extended YOURPC
permit ip host a.a.78.65 any
!
ip nat inside source list YOURPC interface f0/0 overload
!
int f0/0
ip nat inside
!
int f0/1
ip nat outside
!
HTH,
Toshi
04-17-2009 03:45 AM
Sorry , My Typo as usual.
!
ip nat inside source list YOURPC interface f0/1 overload
!
HTH,
Toshi
04-20-2009 02:46 AM
Hi Toshi,
you are wise guy, it runs..Thank you!!
Anyway, it must be a bug or what, because I dont see nothing in "sh ip nat translations", and "sh ip nat stat.." shows 0 count..
SRCLNZ37#sh ip nat statistics
Total active translations: 0 (0 static, 0 dynamic; 0 extended)
Outside interfaces:
FastEthernet0/1
Inside interfaces:
FastEthernet0/0
Hits: 25207 Misses: 2971
CEF Translated packets: 26965, CEF Punted packets: 2426
Expired translations: 3135
Dynamic mappings:
-- Inside Source
[Id: 2] access-list aaa interface FastEthernet0/1 refcount 0
Queued Packets: 0
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: