I have a Cisco Catalyst 3725 router running IOS 12.4 and I am having substantial difficulties trying to get the router to forward traffic from a public IP address to an interface. I have two bonded T1's in a multilink group and one public IP assigned to the multilink interface. I have a private LAN IP assigned to FastEthernet0/0 which connects our office network to the internet.
Our teleworker server has two network connections. One connection has a static LAN IP which responds fine on our network. The other interface that is supposed to be public facing has a hardcoded, unchangeable public IP address. I have connected this public facing interface to FastEthernet0/1. Our public IP block includes multiple addresses, of which the teleworker has one. Our remote phones are supposed to connect to the public IP address of the teleworker server to function correctly. FastEthernet0/1 does not have any ip address assigned to it at this time.
What I need to have happen here is to have the router pick up any traffic coming in on our teleworker public IP address and forward it through FastEthernet0/1 to the teleworker server. I also need to have the teleworker server send traffic back out. The teleworker server's hardcoded public IP address must be on a public facing connection with no firewall between it and the outside world (apparently it has it's own internal firewall).
How do I configure the router to do this?
Accepted Solutions
brainboy17 wrote:
I have a Cisco Catalyst 3725 router running IOS 12.4 and I am having substantial difficulties trying to get the router to forward traffic from a public IP address to an interface. I have two bonded T1's in a multilink group and one public IP assigned to the multilink interface. I have a private LAN IP assigned to FastEthernet0/0 which connects our office network to the internet.
Our teleworker server has two network connections. One connection has a static LAN IP which responds fine on our network. The other interface that is supposed to be public facing has a hardcoded, unchangeable public IP address. I have connected this public facing interface to FastEthernet0/1. Our public IP block includes multiple addresses, of which the teleworker has one. Our remote phones are supposed to connect to the public IP address of the teleworker server to function correctly. FastEthernet0/1 does not have any ip address assigned to it at this time.
What I need to have happen here is to have the router pick up any traffic coming in on our teleworker public IP address and forward it through FastEthernet0/1 to the teleworker server. I also need to have the teleworker server send traffic back out. The teleworker server's hardcoded public IP address must be on a public facing connection with no firewall between it and the outside world (apparently it has it's own internal firewall).
How do I configure the router to do this?
If the public interface of the teleworker server is connected to fa0/1 then configure fa0/ with an IP from the same public IP range, otherwise how will router and teleworker server commuicate ?
Edit - Chris is the problem that you have allocated the outside interface from that public IP range ?? If so can the teleworker server actually have a private IP on it's "public" facing interface and then you can NAT that on the router using one of your public IPs ?
Jon
Perhaps Chris T. had a bad subnet mask on fa0/1 the first time he attempted to put the teleworker servers default gateway address on it.
Chris T,
My approach to your problem was to first determine how NAT works in your environment. These are the pertinent commands from your config:
interface Multilink1
ip nat outside
interface FastEthernet0/0
ip nat inside
ip nat pool Public_IP_Pool 206.15.67.20 206.15.67.23 netmask 255.255.255.248
ip nat inside source list 1 interface Multilink1 overload
ip nat inside source static tcp 192.168.100.8 1723 interface Multilink1 1723
I was specifically looking for static nat that may conflict with your teleworker netblock; I found none.
There is only dynamic NAT and that is for hosts behind fa0/0 destined to the internet via Mu1. These hosts assume the address of the Mu1 interface so no conflict there.
I did notice a nat pool that not only overlaps with the teleworker netblock but it contains the teleworker server address. This pool is not invoked anywhere so it's no factor. In fact this pool should be deleted to avoid confusion in the future.
no ip nat pool Public_IP_Pool 206.15.67.20 206.15.67.23 netmask 255.255.255.248
At this point it was clear the teleworker netblock is isolated and should be assigned to the fa0/1 interface. For some reason this interface had an address of 192.168.1.1. The 192.168.1.1 address didn't fit the scenario and it seemed an acceptable risk to replace it. You told us the teleworker server had an IP address of 206.15.67.23 and a default gateway of 206.15.67.17. The only question left; what's the subnet mask?
Evaluating the host and gateway addresses it appeared the smallest subnet possible was a /28 (255.255.255.240). If a /29 was selected the teleworkder address would represent the broadcast address of the subnet; therefore it shouldn't be a /29.
Something to keep in mind in the future. These days public IPv4 space is sparse and folks want to use it very efficiently. Assigning an address to a ethernet interface will render two addresses unusable; the network and broadcast addresses. In this case 206.15.67.16 and 206.15.67.31. In order to use all 16 addresses in a /28 NAT can be utilized instead of allowing a physical interface to participate in the public netblock.
Chris
