Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Problems with ‘outside source static’ on a NAT-enabled Router

A NAT-enabled router can allow some users to utilize NAT and allow other users on the same Ethernet interface to continue with their own IP addresses.

For example,

ip nat pool satellites 53.253.66.209 53.253.66.254 netmask 255.255.255.192

ip nat inside source list 20 pool satellites

access-list 20 permit 172.30.0.0 0.0.255.255

But, suppose we have the following static NAT config, as well as the above dynamic NAT config:

ip nat inside source static 172.30.16.30 53.253.66.194

ip nat outside source static 53.253.250.21 192.168.66.250

Now, the user utilizing NAT would enter the NAT-enabled router with say a source address of 172.30.16.31 for HTTP access to 192.168.66.250.

The source address would be translated using the nat pool and the destination address using the outside source static mapping. So, this should be OK.

But, the user on the same Ethernet interface wanting to continue with their own IP address, say 53.253.29.1, would HTTP to 53.253.250.21.

In this case, the source address and the destination address would not be translated on entering the inside interface on the NAT-enabled router.

But, would the reply packet on entering the outside interface on the NAT-enabled router translate the source address from 53.253.250.21 to 192.168.66.250 using the outside source static mapping?

If so, does this mean that users on the same Ethernet interface wanting to continue to use their own IP addresses will NOT be able to HTTP to 53.253.250.21?

1 REPLY
New Member

Re: Problems with ‘outside source static’ on a NAT-enabled Rou

Based on your description, I think you're right. It would be easier to determine looking at your configs and running debugs on the router. Might want to call TAC to help you out with that one.

91
Views
0
Helpful
1
Replies