04-05-2010 05:04 AM - edited 03-06-2019 10:27 AM
Dear Experts,
I'm quite new to Cisco and I'm currently working on my CCNA. I recently had the opportunity to take a closer look at the following devices:
- Cisco 1841 ISR
- Cisco Catalyst 2950 24 port
- Cisco Aironet 1231AG
As a start, I wanted to replace my soho hardware and upgrade my home network to these devices. My ISP provides Internet connectivity through cable which is basically Fast Ethernet through the cable modem. The FastEthernet 0/1 is connected to the modem and acquires ip address through DHCP. The internal interface of the 1841 has a static ip address of 192.168.0.1/24. On the router I enabled the onboard dns server and enabled port address translation. The configuration file looks like the following:
Current configuration : 3253 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Odin
!
boot-start-marker
boot system flash c1841-adventerprisek9-mz.124-24.T1.bin
boot-end-marker
!
logging message-counter syslog
enable secret 5 $1$ZgH.$IeANuKYd/rNpxUuqXo6.k/
!
no aaa new-model
dot11 syslog
ip source-route
!
!
no ip dhcp use vrf connected
Everything works fine (I mean all the internal devices have Internet connectivity and CBAC works as expected, but these are not listed in the config). The problem I'm posting this is that when I add static NAT entries (in soho devices this is called port mapping) I can only reach internal services from an outside IP address. The problematic entry:
ip nat inside source static tcp 192.168.0.50 80 interface FastEthernet0/1 8080
This means that I can reach the web server on my internal network from another network on port 8080 but I cannot reach it from 192.168.0.0/24. Let's say that the outside address is 11.111.111.12, then from 192.168.0.50 or 192.168.0.10 I am unable to browse the homepage at 11.111.111.12:8080.
I read lots of forum threads and manuals but I can't see the reason for this happening. I had no such problem with soho devices like D-link or SMC.
I tried to make a "raw" connection with Putty to the port and outside IP address, but the router closes the connection ("Connection closed by remote host").
I also experienced an interesting effect with the router:
When I change the outside interface's MAC address to one that is on the inside network the communication with these devices fail. Again this is not a problem with most SOHO devices. Is there a way to isolate the inside and outside interfaces?
Any help would be greatly appreciated (the static NAT problem is of much higher importance), thank you in advance!
Márton
Solved! Go to Solution.
04-21-2010 08:16 AM
Dear Marton,
Please try this:
!
interface FastEthernet0/0
ip nat enable
!
interface FastEthernet0/1
ip nat enable
!
ip nat source list 1 interface FastEthernet0/1 overload
ip nat source static tcp 192.168.0.50 80 interface FastEthernet0/1 8080
!
This is the "NAT Virtual Interface Support" of the IOS which is used to Inside-to-Inside NAT.
This feature was introduced in version 12.3(14)T. I hope that your IOS supports it.
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gtnatvi.html
I hope that this is useful for you.
Best wishes,
Laszlo
04-05-2010 06:39 AM
Why not just use a host file with real IP for internal clients? Only traffic coming through an interface tagged with 'ip nat outside' triggers the NAT rule.
04-05-2010 07:00 AM
Thanks for your answer! But can you be more specific? Are you suggesting that when i enter the outside IP address to the browser it doesn't trigger the static rule? Is it possible to make it persistent?
Best regards,
Márton
04-05-2010 07:09 AM
Not if you're sourcing from the 192.168.0.0/24 network. You have to connect to 192.168.0.50 on port 80 directly if you're inside. From outside you would connect to your WAN interface on port 8080. If it's registered in DNS you can modify your host file to point to the real IP address instead while outside users will resolve the WAN IP. If the router supports it you can also use DNS doctoring.
04-05-2010 08:04 AM
Thank You!
If I understand correctly then what I seek is not possible . Don't you happen to know why? Actually the inside services are not that important to use DNS, these are just simple port forwards to allow specific applications to work properly.
This is strange, because Linksys and other home routers have no problems accessing the outside IP and port forwards.
Anyway thank you for your help!
04-21-2010 08:16 AM
Dear Marton,
Please try this:
!
interface FastEthernet0/0
ip nat enable
!
interface FastEthernet0/1
ip nat enable
!
ip nat source list 1 interface FastEthernet0/1 overload
ip nat source static tcp 192.168.0.50 80 interface FastEthernet0/1 8080
!
This is the "NAT Virtual Interface Support" of the IOS which is used to Inside-to-Inside NAT.
This feature was introduced in version 12.3(14)T. I hope that your IOS supports it.
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gtnatvi.html
I hope that this is useful for you.
Best wishes,
Laszlo
04-22-2010 05:27 AM
Dear Laszlo,
Thank you very much for your help, your configuration has just solved my problem!
Best regards,
Márton
04-22-2010 06:46 AM
Good find. What exactly does it do to fix it?
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: