cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3250
Views
16
Helpful
6
Replies

NAT translations and IP secondary Addresses

admin_2
Level 3
Level 3

I am running out of IP Addresses on the outside interface and want to configure a secondary ip address range. I am using a few ip addresses for NAT translations from the outside interface, but wanted for the NAT pool to use the secondary ip address range from the outside interface instead of the primary ip address range. I have configured the outside interface with the secondary ip address range and changed the ip address range of the NAT pool to the secondary ip address range. I also configured the router to route the secondary ip address range, but did not work for me. Any suggestions would be greatly appreciated

2 Accepted Solutions

Accepted Solutions

Hello,

stupid question maybe, but can you check if your PIX allows the translated range (165.95.250.66 165.95.250.126 prefix-length 26) through ? Are the translated addresses arriving at the PIX ?

By the way, NAT and HSRP do not work well together. The standby router does not have the NAT translation table, so when the cutover from the active to the standby router occurs, your connections will time out.

Regards,

Georg

View solution in original post

rcostilla

It looks like your default gateway may be on the subnet with your primary ip address.

If this is the case then the replies probably have have no route back to your secondary ip address or your nat pool subnet.

another ip address in the same subnet as your secondary block needs to be added to the default gateway interface or the subnet mask needs to changed to range across both of your blocks.

If you already have a route from your isp to the secondary block then you can just remove the secondary ip address and nat through the primary ip address using the secondary pool.

hth

BT

View solution in original post

6 Replies 6

Hello,

can you post your configuration ? Here is what I have configured:

interface Ethernet0

ip address 135.13.20.1 255.255.255.252

no ip directed-broadcast

no ip proxy-arp

ip nat inside

!

interface Serial0

ip address 172.16.1.1 255.255.0.0 secondary

ip address 192.168.1.1 255.255.255.252

no ip directed-broadcast

no ip proxy-arp

ip nat outside

encapsulation frame-relay

frame-relay map ip 192.168.1.2 102 broadcast

no frame-relay inverse-arp

!

ip nat pool HOME 172.16.1.1 172.16.1.1 netmask 255.255.0.0

ip nat inside source list 1 pool HOME overload

ip route 0.0.0.0 0.0.0.0 192.168.1.2

Do you at least get your inside addresses translated ?

Regards,

Georg

Yes, the inside addresses are being translated. I see the route in the table, but hosts can't access the Internet. Below is the configuration:

interface Vlan416

description Outside Interface

ip address 165.95.250.65 255.255.255.192 secondary

ip address 165.95.241.35 255.255.255.224

ip broadcast-address 165.95.241.63

ip access-group 121 in

ip access-group 120 out

no ip redirects

no ip unreachables

ip nat outside

no ip route-cache

no ip mroute-cache

service-policy output llq

standby 7 ip 165.95.241.33

standby 7 priority 40

standby 7 preempt

interface Vlan50

description Inside Interface

ip address 192.168.2.2 255.255.255.0

ip broadcast-address 192.168.2.255

ip access-group 102 in

ip helper-address 165.95.240.51

no ip redirects

no ip unreachables

ip nat inside

no ip route-cache

no ip mroute-cache

standby 2 ip 192.168.2.1

standby 2 priority 40

standby 2 preempt

router ospf area 10

network 165.95.241.32 0.0.0.31 area 10

network 165.95.250.64 0.0.0.63 area 10

ip nat pool Outsideovrld 165.95.250.66 165.95.250.126 prefix-length 26

ip nat inside source list 21 pool Outsideovrld overload

ip route 0.0.0.0 0.0.0.0 165.95.241.38

access-list 21 deny 192.168.2.2

access-list 21 permit 192.168.2.0 0.0.0.255 log

Note: Vlan 416 is connecting via a fiber link to the pix firewall and then to the Internet. This is the only path out to the Internet. IP Address 165.95.241.38 is the next hop address.

Hello,

stupid question maybe, but can you check if your PIX allows the translated range (165.95.250.66 165.95.250.126 prefix-length 26) through ? Are the translated addresses arriving at the PIX ?

By the way, NAT and HSRP do not work well together. The standby router does not have the NAT translation table, so when the cutover from the active to the standby router occurs, your connections will time out.

Regards,

Georg

Hello Pauwen, I really appreciate your help. This is NOT a stupid question. I actually did forget to configure the route in the Pix Firewall. Once I did this, I tested and worked.

rcostilla

It looks like your default gateway may be on the subnet with your primary ip address.

If this is the case then the replies probably have have no route back to your secondary ip address or your nat pool subnet.

another ip address in the same subnet as your secondary block needs to be added to the default gateway interface or the subnet mask needs to changed to range across both of your blocks.

If you already have a route from your isp to the secondary block then you can just remove the secondary ip address and nat through the primary ip address using the secondary pool.

hth

BT

Not applicable

Hello Bill,

I tried this prior to adding the secondary ip address to the interface and it did not work for me; but it did not work for me because I did not have the route on the Pix. Once I added the route, I then tried this option as well and worked. I will use this configuration instead of adding the second ip address range to the interface because users noticed a delay when configuring the secondary ip address on the interface. Thank you so much for your input.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco