Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

help configuring NAT

I am having difficulties configuring NAT POOL for traffic on my internal network when hitting a specific interface to my firewall.  When traffic from a specific subnet (matching the ACL) goes to a specific interface (firewall VLAN) I need that traffic to NAT from pool.  Here is my config:

Router#(config)

ip nat pool Remote-Offices 10.168.0.0 10.168.255.255 prefix-length 16 type match-host

access-list 150 permit ip 192.168.168.0 0.0.3.255 any log

ip nat inside source list 150 pool Remote-Offices

!

Router#(config-if)

interface Vlan170

description Firewall Network

ip address 172.18.7.4 255.255.255.240

ip directed-broadcast

ip nat inside

end

With this config I do not see any nat translations when issuing a pingfrom a host on the 192.168.168.0/22  to a destination address on my firewall dmz which passes through VLAN170, which is also my static default route (172.18.7.1)

Any assistance would be most appreciated.  Thanks.

8 REPLIES
Purple

help configuring NAT

Hi,

log keyword is not supported for NAT ACLs so just get rid of it.Also make sure your routing is correct because packets are routed first before being natted.

Regards

Alain

Don't forget to rate helpful posts.

Don't forget to rate helpful posts.
New Member

help configuring NAT

Hi Alain, Thanks for your reply.  I did remove the log keyword as suggested however that did not change the result.  Routing is functioning correctly as a traceroute I ran plots the expected path.

Any other thoughts?  Is there any additional detail I can provide which would help towards a solution?

Purple

help configuring NAT

Hi,

Have you got a route back to this 192.168.168.0/22  on the  NAT device ?

Regards

Alain

Don't forget to rate helpful posts.

Don't forget to rate helpful posts.
New Member

help configuring NAT

Alain,

Sorry for the delay in responding.  Yes, routing for this subnet has and still is working normally. 

Question....the svi interface, VLAN 170, should the configuration for NAT function as currently configured or do I need to change the switchports connecting the firewall to routed interfaces and put IPs on the gigabit interfaces?

Thanks.

-Fred

Purple

help configuring NAT

Hi,

No you can leave it as is but where is the nat outside configured ? I don't see it in your config snippet and could you also post a quick diagram of your topology ?

Regards

Alain

Don't forget to rate helpful posts.

Don't forget to rate helpful posts.
New Member

Re: help configuring NAT

Alain,

I have attached a diagram that should help explain better what we are attempting to do.

We have been internally discussing this this morning and re-reading the documentation and may have come up with a reason why we haven't been successful. Is it likely that we have been putting the ip nat inside statement on the wrong interface(s)?

Purple

help configuring NAT

Hi,

I don't see the diagram so I can't tell you.

Regards

Alain

Don't forget to rate helpful posts.

Don't forget to rate helpful posts.
New Member

Re: help configuring NAT

Alain, Sorry.  I had difficulties in getting the attachment in this duscussion.  Somehow the previous attachment I attempted went into a discussion area.  Anyway, I have attached the diagram into this discussion thread.  I am still hoping you can help.

Thanks

Fred

236
Views
0
Helpful
8
Replies
CreatePlease to create content