Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Router originated traffic NAT issue/conflict

Hi there,

this discussion (to EASY STORY) is supossed to :

1) get an confirmation, if the behaviour is bug or normal. If normal, what can I do to accomplish my task.

2) let someone with latest IOS train to test it, or perhaps to open a case if this is in his interest to be running, too. I dont have time, nor it's such criticial task to open a case on this.

So, after long time I underwent a research of full caveats document on the web, found nothing pointing to this NAT issue , for IOS 12.4(18), lets say IP ADv. Service I run. But issue \

may lie in whatever version of that train, even the latest 12.4(23)..

Well, I have a router with 2 interfaces, Fa0/0 to my PC (nat inside), Fa0/1 (nat outside) to modem and Internet.. and a single NAT rule set up, to establish a path to modem (has

a Web GUI), which normaly has no route back to PC. So the rule (static source) makes source IP of PC packets to get translated to source IP of F0/1 - direct link with that

modem. This is right, and 100% this must perform for packets traversing the router between these interfaces.

However, for traffic originating from router and related only to FE0/1 interface with modem (when I want to perform simple ping to existing Internet host), the router applies

this rule alike!!, and tries to translate the responses to go to your PC on F0/0! This is crazy. And the question 1 again is, if this is normal, and if yes, how can I make the

router traffic to run in parallel with NAT rule. If I turn it off, it runs OK.

THANKS!

3) The configuration first :

interface FastEthernet0/0

description <<e.g towards remote PC located on different subnet>

ip address 172.19.250.42 255.255.255.192

ip nat inside

ip virtual-reassembly

speed 100

full-duplex

!

interface FastEthernet0/1

description PS_UPLINK... to modem and Internet

ip address 172.16.254.97 255.255.255.248

ip nat outside

ip virtual-reassembly

speed 100

full-duplex

!

ip forward-protocol nd

ip route 0.0.0.0 0.0.0.0 172.16.254.98

ip route a.a.78.65 172.19.250.1 // its the address of remote PC

!

!

no ip http server

no ip http secure-server

ip nat inside source static a.a.78.65 interface FastEthernet0/1

2) Failing pings, see the "." ...

SRCGRZ33#ping x.x.94.140

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to x.x.94.140, timeout is 2 seconds:

.

Apr 17 10:11:03.004 CET: NAT*: s=x.x.94.140, d=172.16.254.97->a.a.78.65 [41821].

Apr 17 10:11:05.067 CET: NAT*: s=x.x.94.140, d=172.16.254.97->a.a.78.65 [41822].

Apr 17 10:11:07.046 CET: NAT*: s=x.x.94.140, d=172.16.254.97->a.a.78.65 [41824].

Apr 17 10:11:09.074 CET: NAT*: s=x.x.94.140, d=172.16.254.97->a.a.78.65 [41826].

Success rate is 0 percent (0/5)

SRCGRZ33#

3) A cosmetic issue... look for icmptimeout value 60000.. when normally its defined in seconds, and counters decreseas in seconds properly :)

SRCGRZ33#sh ip nat translations verbose

Pro Inside global Inside local Outside local Outside global

icmp 172.16.254.97:27 a.a.78.65:27 x.x.94.140:27 x.x.94.140:27

create 00:00:09, use 00:00:04 timeout:60000, left 00:00:55,

flags:

extended, use_count: 0, entry-id: 1128, lc_entries: 0

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Router originated traffic NAT issue/conflict

Sorry , My Typo as usual.

!

ip nat inside source list YOURPC interface f0/1 overload

!

HTH,

Toshi

3 REPLIES

Re: Router originated traffic NAT issue/conflict

Peter,

###############

the router applies this rule alike!!, and tries to translate the responses to go to your PC on F0/0! This is crazy. And the question 1 again is, if this is normal,

Yes! This is normal and Yes!!! It's kinda crazy.(grin)

When you defined the static nat statement like that it will permanently show up in the NAT table. So whatever traffic coming into Dest,IP:172.16.254.97. Router will perform NAT those traffic to your PC.

###############

how can I make the router traffic to run in parallel with NAT rule.

Let's do the following steps.

!

ip access-list extended YOURPC

permit ip host a.a.78.65 any

!

ip nat inside source list YOURPC interface f0/0 overload

!

int f0/0

ip nat inside

!

int f0/1

ip nat outside

!

HTH,

Toshi

Re: Router originated traffic NAT issue/conflict

Sorry , My Typo as usual.

!

ip nat inside source list YOURPC interface f0/1 overload

!

HTH,

Toshi

New Member

Re: Router originated traffic NAT issue/conflict

Hi Toshi,

you are wise guy, it runs..Thank you!!

Anyway, it must be a bug or what, because I dont see nothing in "sh ip nat translations", and "sh ip nat stat.." shows 0 count..

SRCLNZ37#sh ip nat statistics

Total active translations: 0 (0 static, 0 dynamic; 0 extended)

Outside interfaces:

FastEthernet0/1

Inside interfaces:

FastEthernet0/0

Hits: 25207 Misses: 2971

CEF Translated packets: 26965, CEF Punted packets: 2426

Expired translations: 3135

Dynamic mappings:

-- Inside Source

[Id: 2] access-list aaa interface FastEthernet0/1 refcount 0

Queued Packets: 0

344
Views
0
Helpful
3
Replies
CreatePlease to create content