Hi Jon,

You're spot on with that it's a 6509 switch.

Thanks

Dan

Hello Dan

There is an old post with a similar requirement pls refer to it

http://supportforums.cisco.com/message/1319492#1319492

Thanks for that. So would the my current configuration work?

wr mem

conf t

access-list 30 10.4.80.0 0.0.0.255
access-list 30 10.4.81.0 0.0.0.255
access-list 30 10.4.180.0 0.0.255.255

ip nat pool nat-pool 10.10.51.124 10.10.51.124 255.255.255.252
ip nat inside source list 30 pool nat-pool

exit

One concern I have is what the "255.255.255.252" means in the pool statement.

Thanks

Dan

dan_track wrote:
Thanks for that. So would the my current configuration work?
wr mem
conf t
access-list 30 10.4.80.0 0.0.0.255
access-list 30 10.4.81.0 0.0.0.255
access-list 30 10.4.180.0 0.0.255.255
ip nat pool nat-pool 10.10.51.124 10.10.51.124 255.255.255.252
ip nat inside source list 30 pool nat-pool
exit
One concern I have is what the "255.255.255.252" means in the pool statement.
Thanks
Dan

Dan

Is the 10.10.51.124 an interface address ? If so you don't need to bother with a NAT pool ie.

ip nat inside source list 30 interface overload

Jon

Hi Jon,

Thanks, yes the 10.10.51.124 is an interface address.

Thanks for the tip so my new config on both 6500 switches will be:

wr mem

conf t

access-list 30 10.4.80.0 0.0.0.255
access-list 30 10.4.81.0 0.0.0.255
access-list 30 10.5.180.0 0.0.255.255

ip nat inside source list 30 interface vlan 251 overload

exit

Is that right?

Thanks

Dan

dan_track wrote:
Hi Jon,
Thanks, yes the 10.10.51.124 is an interface address.
Thanks for the tip so my new config on both 6500 switches will be:
wr mem
conf t
access-list 30 10.4.80.0 0.0.0.255
access-list 30 10.4.81.0 0.0.0.255
access-list 30 10.5.180.0 0.0.255.255

ip nat inside source list 30 interface vlan 251 overload
exit
Is that right?
Thanks
Dan

Dan

access-list 30 needs the "permit" keyword ie.

access-list 30 permit 10.4.80.0 0.0.0.255

etc...

Personally i always use an extended acl in NAT statements but yours should work fine. Note if you wanted to do policy NAT ie. only NAT the addresses if they are going to a certain destination IP then you would need to use an extended acl.

Jon

Thanks Jon,

It's been very englightening, here's my update to this, please can you advise if it's ok:

wr mem

conf t

access-list  30 extended permit ip 10.4.80.0 0.0.0.255 host 10.30.70.29

access-list  30 extended permit ip 10.4.80.0 0.0.0.255 host 10.30.70.30
access-list 30 extended permit ip 10.4.81.0 0.0.0.255 host 10.30.70.29

access-list 30 extended permit ip 10.4.81.0 0.0.0.255 host 10.30.70.30
access-list  30 extended permit ip 10.5.180.0 0.0.255.255 host 10.30.70.29

access-list  30 extended permit ip 10.5.180.0 0.0.255.255 host 10.30.70.30

ip nat inside source list 30  interface vlan 251 overload

exit

Would the above work, also I read when creating access lists for nat always use the keyword "ip" never use protocols, is that right?

Thanks

Dan

dan_track wrote:
Thanks Jon,
It's been very englightening, here's my update to this, please can you advise if it's ok:
wr mem
conf t
access-list  30 extended permit ip 10.4.80.0 0.0.0.255 host 10.30.70.29
access-list  30 extended permit ip 10.4.80.0 0.0.0.255 host 10.30.70.30
access-list 30 extended permit ip 10.4.81.0 0.0.0.255 host 10.30.70.29
access-list 30 extended permit ip 10.4.81.0 0.0.0.255 host 10.30.70.30
access-list  30 extended permit ip 10.5.180.0 0.0.255.255 host 10.30.70.29
access-list  30 extended permit ip 10.5.180.0 0.0.255.255 host 10.30.70.30

ip nat inside source list 30  interface vlan 251 overload
exit
Would the above work, also I read when creating access lists for nat always use the keyword "ip" never use protocols, is that right?
Thanks
Dan

Dan

Your acl would no NAT those source IPs only if they were going to destination IP 10.30.70.29 or 10.30.70.30 - is that correct ?

You need to change your acl number to be in the 100 - 199 range because it is extended.

Apart from that yes it should work fine. As for using IP rather than TCP/UDP ports, never really done it to be honest so can't say for sure. Perhaps i'll lab it up later on.

Jon

Thanks Jon,

Could you please clarify your nat statement as I don't understand it. According to my perspective when an ip e.g. 10.4.81.32 tries to connect to 10.30.70.29 or 10.30.70.30 the connection will be natted to the vlan 251 interface which is configured with the ip 10.10.51.124 and 10.10.51.126 depending on which switch you are on.

However if the ip 10.4.81.32 connects to any other ip going out of vlan 251 the connection will not be natted.

Am I right?

Thanks

Dan

Dan

According to my perspective when an ip e.g. 10.4.81.32 tries to connect to 10.30.70.29 or 10.30.70.30 the connection will be natted to the vlan 251 interface which is configured with the ip 10.10.51.124 and 10.10.51.126 depending on which switch you are on.

However if the ip 10.4.81.32 connects to any other ip going out of vlan 251 the connection will not be natted.

Am I right?

Exactly.

Jon

Hi Jon,
You're spot on with that it's a 6509 switch.
Thanks
Dan

Hi Dan,

Only 6500 series switch support natting configuration ,check out the below link for NAT Configuration examples.

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080094e77.shtml

Hope to Help !!

Ganesh.H