They are all using RFC1918 space :-) on different networks inside 10.x.x.x but none are using 10.0.x.x

You are also correct about them performing NAT on their public side... In most cases when the VAN would pull up here is how the connectivity would work...

1. VAN's plugs in at the school and the VAN’s router (1811) pulls an IP via DHCP (real example, 10.180.16.250)

2. That address is then NAT'd on the 1811 to an inside private net of 10.0.0.0/28. That DHCP address is overloaded and also static NATs are defined from 10.0.0.2 (Tandberg unit) to Fas0 (the DHCP’d schools address) to allow all known H.323 ports.

3. In summary, 10.0.0.2, the Tandberg unit inside the VAN is NAT'd to 10.180.16.250 (My NAT) which is then NAT'd to a public address of 67.x.x.x (Schools NAT) assigned to the school through their firewall (PIX 525)

Crazy huh? :)

Interesting you pointing out the "ip nat inside source static 10.0.0.2 interface FastEthernet0" option, not sure why it didn’t cross my mind to simply try that. I was so caught up in all the H323 port mess. Unfortunately I can’t try any of this out because I'm back in town from the trip. I should be going back down in a few weeks to mess with this again. I just wanted to post this somewhere to wrap my mind around how to make this work

Well crazy or not, im sure there is a solution.

However I'm pretty sure the PIX 525 will ruin everything, unless you where to open up and NAT the 67.x.x.x address to the outside address on the 1800 router (10.180.16.250), but that means that you need that IP reserved on the schools DHCP server. So the van allways gets the same IP address. And in case you were to later change the router in the van, you are to move the MAC-address of FastEthernet0 to the new router.

All this is possible, but I guess you need all these things done on multiple schools, right?

Which makes a bit of a nightmare, when trying to document the whole thing.

Maybe there is a better solution......I hope so.

After doing some more research as long as fixup H323 is used on the PIX, that part shouldn’t be an issue. Also I have very good cooperation from the schools so setup on their end is not an issue. The NAT to the school's public address 67.x.x.x to the router's global address 10.180.x.x is already setup. And yes idea was there would be a DHCP reservation setup at each school with external NAT setup to that reservation. All of that is fine the real issue is the second NAT on my end in the VAN.

The question still remains, are there any equivalent commands on the router that would accomplish "port forwarding/ranges" like on linksys/netgear broadband router? Or should "ip nat inside static 10.0.0.2 interface Fastethernet0" be enough?

I would go with the ip nat inside static 10.0.0.2 interface Fastethernet0", however if you want to NAT only the specified port numbers, I think this is the way to go:

ip nat inside source static 10.0.0.2 10.180.16.250 route-map BLAH extendable

!

ip access-list extended ACL-FOR-THE-TANDBERG

permit tcp host 10.0.0.2 any eq www

permit tcp host 10.0.0.2 any eq 443

permit udp host 10.0.0.2 any eq 1719

permit tcp host 10.0.0.2 any eq 1720

permit udp host 10.0.0.2 any range 2326 2373

permit tcp host 10.0.0.2 any range 5555 5587

!

route-map BLAH permit 10

match ip address ACL-FOR-THE-TANDBERG

UnfortuNATly it only works by stating the WAN address (10.180.16.250), you can't state the interface (FastEthernet0). This sort of ruins the idea that you want to be able to connect the router to any school network, without having to reconfig the router.

And I'm not sure this config allows NAT to work from both inside->outside as well as outside->inside.

Interesting... never would have thought of doing it that way. Using that example I could script it out for each school then have the folks in the VAN excute it from a shortcut on the desktop. I think I have enough to go on here and make something work...

Thanks again for the help and suggestions.

You are welcome.

And please make sure to post back here, when you have found a working solution.

Thanx for the tip, and as you mentioned.. i wish it could work with interface! i have dynamic ip on my dsl and i needed that...

Oh well.. anyway thanx again for the info