Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

NAT

Helo guys,

I tyr to configure NAT for two subnets that I have, I have this command

Router(config) # access-list 101 permit tcp y.y.y.y 0.0.0.255 host x.x.x.x

then I put the nat outside in host x.x.x.x

Router(config)# int fa0/1

Router(config-if)# ip nat outside

Router(config)# ip nat outside source list 101 interface fa 0/1

but when i try to ping from any host in y.y.y.y network, I can't do.

Thanks for the tips,,,

6 REPLIES
Community Member

Re: NAT

sorry the last was....

router(config)#ip nat outside source list 101 pool (name_of_pool)

Re: NAT

Are you trying to do source NAT or destination NAT

I think you want source NAT which is

ip nat inside source source list 101 interface fa 0/1 overload

Don't forget the overload keyword so that PAT is used.

You also need to apply the 'ip nat inside' command to the inside interface of your network for this to work.

Hall of Fame Super Blue

Re: NAT

David

Could you be more specific as to what you are trying to do in terms of which are the source IP addresses, which are the destination addresses etc.

Jon

Community Member

Re: NAT

Hi,

I attach a diagram that can explain better the issue.

I want access all the network to server x.x.x.x in some services like http & https

thanks

Hall of Fame Super Blue

Re: NAT

David

Assuming

y.y.y.y network = 192.168.5.0/24

Interface on router that connects to y.y.y.y network = fa0/0

x.x.x.x = 172.16.15.10

Interface on router that connects to x.x.x.x = fa0/1 and it's IP address is 172.16.15.1

access-list 101 permit tcp 192.168.5.0 0.0.0.255 host 172.16.15.10 eq 80

access-list 101 permit tcp 192.168.5.0 0.0.0.255 host 172.16.15.10 eq 443

int fa0/0

ip nat inside

int fa0/1

ip nat outside

ip nat inside source list 101 interface fa0/1 overload

The above config will change all the 192.168.5.x addresses to 172.16.15.1 ie. the interface address of fa0/1.

Jon

Hall of Fame Super Gold

Re: NAT

David

There is another aspect of this issue. Your original post used an access list which had a statement that permitted tcp for certain source and destination. Jon's example here also uses permit tcp. That may be ok if what you really want to translate is tcp traffic. But if you do that you can not test it with ping, as your original post describes. Ping is not tcp traffic and therefore will not test your translation.

If you want to test with ping then I suggest that your access list should permit ip rather than permit tcp.

HTH

Rick

123
Views
10
Helpful
6
Replies
CreatePlease to create content