Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

ovt Bronze
Bronze

PIX Outside NAT and Overlapping networks = No route to host

Hi!

I have simple test network with overlapping address spaces and want to solve the problem with PIX NAT on a single PIX firewall.

PIX inside = 192.168.1.0/24

PIX outside = 172.16.1.0/24

and the config is:

route outside 0.0.0.0 0.0.0.0 172.16.1.2 1

nat (inside) 1 0.0.0.0 0.0.0.0

global (outside) 1 interface

static (inside,outside) 172.16.1.10 192.168.1.4 netmask 255.255.255.255

static (outside,inside) 192.168.2.0 192.168.1.0 dns netmask 255.255.255.0

The overlapping network 192.168.1.0/24 is behind a router 172.16.1.2.

When I'm trying to connect to static address 172.16.1.10 from the outside overlapping network I see:

Built inbound TCP connection 43 for outside:192.168.1.112/11010 (192.168.2.112/11010) to inside:192.168.1.4/23 (172.16.1.10/23)

And:

No route to 192.168.1.112 from 172.16.1.10

This means that the problem is with the traffic returning from the inside host 192.168.1.4 (172.16.1.10).

Adding the route: "route outside 192.168.1.112 255.255.255.255 172.16.1.2" allows me to connect, but it obviously doesn't solve the general problem.

Adding the route "route outside 192.168.1.0 255.255.255.128 172.16.1.2" (as suggested by the PIX documentation) leads to "No route to 192.168.1.4 from 192.168.2.112" !!!

IS THIS A JOKE OF PIX DEVELOPERS???

It seems that the PIX is ALWAYS doing NAT before ROUTING, regardless of the direction of the traffic flow! THIS IS A WRONG IDEA.

The question is: is the PIX "solution" for overlapping networks really so broken?

Any comments are greatly appreciated.

Oleg Tipisov,

CCSI,

Redcenter,

Moscow

2 REPLIES
ovt Bronze
Bronze

Re: PIX Outside NAT and Overlapping networks = No route to host

Hi!

Yes, it is broken. The solution is to connect 2 overlapping nets with the IPSec tunnel. IPSec picks up the returning packet 172.16.1.10 (192.168.1.4 before NAT) -> 192.168.1.112 (192.168.2.112 before NAT) encapsulates it and sends it to the IPSec peer. After that routing process routes it to the IPSec peer wtihout any problem.

Thanks,

Oleg Tipisov,

CCSI,

Redcenter,

Moscow

New Member

Re: PIX Outside NAT and Overlapping networks = No route to host

Hi!

This is not a joke, it's just a fault in the documentation. Use

route inside 192.168.1.0 255.255.255.128 2

and

route inside 192.168.1.128 255.255.255.128 2

Then everything will work (for me :-)

Andreas Decker

258
Views
0
Helpful
2
Replies