Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

static nat on subinterfaces

Hello from Berlin :)

following scenario:

Now, i want to access the www server from public and insert a static ip nat inside arguemnt but it doesnt work. On the ww server (my pc in this example) i have a internet connection. All works fine, only the nat / pat translation doesent works.

Here is my config of my Router:

configure terminal

hostname Rtr_Chab

no ip http
no ip source-route

line con 0
 logging synchronous
exit

username vpn01 password vpn01
username vpn02 password vpn02

enable password xxx

interface loopback 0
 description Testinterface
 ip add 172.16.99.1 255.255.255.255
exit

line vty 0 15
 login local
 password xxx
exit

interface fa0/0
 description WAN Interface
 ip address dhcp
 ip nat outside
 no shutdown
exit

interface fa0/1
 description LAN Interface
 no shutdown
exit

interface fa0/1.10
 description VLAN 10 K-Netz
 encapsulation dot1q 10 native
 ip address 192.168.9.200 255.255.255.0
 ip nat inside
 no shutdown
exit

interface fa0/1.20
 description VLAN 20 Charlottenburg-Netz
 encapsulation dot1q 20
 ip address 172.16.20.1 255.255.255.0
 ip nat inside
 no shutdown
exit

interface fa0/1.30
 description VLAN 30 Charlottenburg-Admin-Netz
 encapsulation dot1q 30
 ip address 172.16.30.1 255.255.255.0
 ip nat inside
 no shutdown
exit

interface fa0/1.40
 description VLAN 40 VPN-Netz
 encapsulation dot1q 40
 ip address 172.16.40.1 255.255.255.0
 ip nat inside
 no shutdown
exit


ip dhcp excluded-address 172.16.20.1 172.16.20.100

ip dhcp pool Pool_Charlottenburg-Netz
 network 172.16.20.0 255.255.255.0
 default-router 172.16.20.1
 import all
exit

ip dhcp pool Pool_Charlottenburg-Admin-Netz
 network 172.16.30.0 255.255.255.0
 default-router 172.16.30.1
 import all
exit

ip dhcp pool Pool_VPN-Netz
 network 172.16.40.0 255.255.255.0
 default-router 172.16.40.1
 import all
exit

no access-list 1
access-list 1 permit 192.168.9.0 0.0.0.255
access-list 1 permit 172.16.20.0 0.0.0.255
access-list 1 permit 172.16.30.0 0.0.0.255
access-list 1 permit 172.16.40.0 0.0.0.255
access-list 1 permit 172.16.99.1 0.0.0.0

ip nat inside source list 1 interface fa0/0 overload
ip nat inside source static tcp 172.16.20.101 80 interface fa0/0 80

vpdn enable

vpdn-group 1
 accept-dialin
  protocol pptp
  virtual-template 1
exit


interface Virtual-Template1
 description PPTP Einwahl Interface fuer VPN Zugang
 ip unnumbered fa0/1.40
 no keepalive
 no cdp enable
 peer default ip address dhcp-pool Pool_VPN-Netz
 ppp encrypt mppe 128 required
 ppp authentication ms-chap-v2
exit
end

and my configuration of the switch:

configure terminal

default interface range fastEthernet0/1 - 24

hostname SW_Chab

line con 0
 logging synchronous
 exit


interface vlan 30
 ip address 172.16.30.2 255.255.255.0
 no shutdown
exit

ip default-gateway 172.16.30.1


interface fa0/1
 description Service-PC Admin-Netz
 switchport mode access
 switchport access vlan 30
 spanning-tree portfast
 spanning-tree bpduguard enable
 no shutdown
exit

interface fa0/2
 description Service-PC (temp) Admin-Netz
 switchport mode access
 switchport access vlan 30
 spanning-tree portfast
 spanning-tree bpduguard enable
 no shutdown
exit

interface fa0/9
 description Techniker-PC Chab
 switchport mode access
 switchport access vlan 20
 spanning-tree portfast
 spanning-tree bpduguard enable
 no shutdown
exit

interface fa0/10
 description Drucker Chab
 switchport mode access
 switchport access vlan 20
 spanning-tree portfast
 spanning-tree bpduguard enable
 no shutdown
exit

interface fa0/22
 description AccessPoint Chab
 switchport mode trunk
 switchport trunk native vlan 20
 no shutdown
exit

interface fa0/23
 description KAP-Netz
 switchport mode trunk
 switchport trunk native vlan 10
 no shutdown
exit

interface fa0/24
 description Router
 switchport mode trunk
 no shutdown
exit

 

Hopefully you can help me.

Thanks!

Marcel

Everyone's tags (1)
1 ACCEPTED SOLUTION

Accepted Solutions

Hello"Remove the old

Hello

"Remove the old statements before applying the below"

int xx

no ip nat inside
no ip nat outside
ip nat enable
exit

no ip nat inside source list 1 interface fa0/0 overload
no ip nat inside source static tcp 172.16.20.101 80 interface fa0/0 80

ip nat source list 1 interface fa0/0 overload
ip nat source static tcp 172.16.20.101 80 interface fa0/0 80 extendable ( if applicable)

res

Paul
 

Please don't forget to rate any posts that have been helpful. Thanks.
6 REPLIES

HelloCan you try adding the

Hello

Can you try adding the extenable keyword to the end of the static mapping
 

ip nat inside source static tcp 172.16.20.101 80 interface fa0/0 80 extenable
 

res
Paul

Please don't forget to rate any posts that have been helpful. Thanks.
New Member

Hi Paul,i doesent have the

Hi Paul,

i doesent have the extenable command in my ios version. I have the version c1841-adventerprisek9-mz.151-4.M1.bin installed. Should i try with another version?

Marcel

helloYes you can do, however

hello

Yes you can do, however befroe you do that try using NVI Nat ( domainless nat) its nat order is different then domain nat as it performs lookups before and after translation

Remove the old statments before applying the below:

int xx
ip nat enable

ip nat source list 1 interface fa0/0 overload
ip nat source static tcp 172.16.20.101 80 interface fa0/0 80
extenable

res

Paul

 

Please don't forget to rate any posts that have been helpful. Thanks.
New Member

Sorry, dont know if i

Sorry, dont know if i understand you right.

I have disable now the ip virtual-reassembly and downgrade to ios 12.4.

I have try to apply the statements you post but i havent the extenable command.

Here is my complete show run, hope you can find something (the ip route statements are dynamically because the ip nat statements):

Current configuration : 3170 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Rtr_Chab
!
boot-start-marker
boot system flash:/c1841-adventerprisek9-mz.124-25f.bin
boot-end-marker
!
!
no aaa new-model
no ip source-route
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 172.16.20.1 172.16.20.100
!
ip dhcp pool Pool_Charlottenburg-Netz
   import all
   network 172.16.20.0 255.255.255.0
   default-router 172.16.20.1
!
ip dhcp pool Pool_Charlottenburg-Admin-Netz
   import all
   network 172.16.30.0 255.255.255.0
   default-router 172.16.30.1
!
ip dhcp pool Pool_VPN-Netz
   import all
   network 172.16.40.0 255.255.255.0
   default-router 172.16.40.1
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
vpdn enable
!
vpdn-group 1
! Default PPTP VPDN group
 accept-dialin
  protocol pptp
  virtual-template 1
!
!
crypto pki token default removal timeout 0
!
!
username vpn01 password 0 vpn01
username vpn02 password 0 vpn02
!
!
controller DSL 0/0/0
 line-term cpe
!
interface Loopback0
 description Testinterface
 ip address 172.16.99.1 255.255.255.255
!         
interface FastEthernet0/0
 description WAN Interface
 ip address dhcp
 ip nat outside
 ip nat enable
 no ip virtual-reassembly
 duplex auto
 speed auto
!
interface FastEthernet0/1
 description LAN Interface
 no ip address
 ip nat enable
 duplex auto
 speed auto
!
interface FastEthernet0/1.10
 description VLAN 10 KAP-Netz
 encapsulation dot1Q 10 native
 ip address 192.168.9.200 255.255.255.0
 ip nat inside
 ip nat enable
 no ip virtual-reassembly
!
interface FastEthernet0/1.20
 description VLAN 20 Charlottenburg-Netz
 encapsulation dot1Q 20
 ip address 172.16.20.1 255.255.255.0
 ip nat inside
 ip nat enable
 no ip virtual-reassembly
!
interface FastEthernet0/1.30
 description VLAN 30 Charlottenburg-Admin-Netz
 encapsulation dot1Q 30
 ip address 172.16.30.1 255.255.255.0
 ip nat inside
 ip nat enable
 no ip virtual-reassembly
!
interface FastEthernet0/1.40
 description VLAN 40 VPN-Netz
 encapsulation dot1Q 40
 ip address 172.16.40.1 255.255.255.0
 ip nat inside
 ip nat enable
 no ip virtual-reassembly
!
interface Virtual-Template1
 description PPTP Einwahl Interface fuer VPN Zugang
 ip unnumbered FastEthernet0/1.40
 peer default ip address dhcp-pool Pool_VPN-Netz
 no keepalive
 ppp encrypt mppe 128 required
 ppp authentication ms-chap-v2
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 91.64.82.254 254
ip route 0.0.0.0 0.0.0.0 91.64.191.254 254
ip route 0.0.0.0 0.0.0.0 91.64.81.254 254
ip route 0.0.0.0 0.0.0.0 24.134.39.254 254
!
!
no ip http server
no ip http secure-server
ip nat source static tcp 172.16.20.101 80 interface FastEthernet0/0 80
ip nat inside source list 1 interface FastEthernet0/0 overload
!
access-list 1 permit any
!
!
!
control-plane
!

end   

Hello"Remove the old

Hello

"Remove the old statements before applying the below"

int xx

no ip nat inside
no ip nat outside
ip nat enable
exit

no ip nat inside source list 1 interface fa0/0 overload
no ip nat inside source static tcp 172.16.20.101 80 interface fa0/0 80

ip nat source list 1 interface fa0/0 overload
ip nat source static tcp 172.16.20.101 80 interface fa0/0 80 extendable ( if applicable)

res

Paul
 

Please don't forget to rate any posts that have been helpful. Thanks.
New Member

Hi Paul,

Hi Paul,

thank you very much! That was the solution for my problem. For all others, here is my final config:


interface loopback 0
 description Testinterface
 ip add 172.16.99.1 255.255.255.255
exit

interface fa0/0
 description WAN Interface
 ip address dhcp
 ip nat enable
 no shutdown
exit

interface fa0/1
 description LAN Interface
 ip nat enable
 no shutdown
exit

interface fa0/1.10
 encapsulation dot1q 10 native
 ip address 192.168.9.200 255.255.255.0
 ip nat enable
 no shutdown
exit

interface fa0/1.20
 encapsulation dot1q 20
 ip address 172.16.20.1 255.255.255.0
 ip nat enable
 no shutdown
exit

interface fa0/1.30
 encapsulation dot1q 30
 ip address 172.16.30.1 255.255.255.0
 ip nat enable
 no shutdown
exit

interface fa0/1.40
 encapsulation dot1q 40
 ip address 172.16.40.1 255.255.255.0
 ip nat enable
 no shutdown
exit

access-list 1 permit 192.168.9.0 0.0.0.255
access-list 1 permit 172.16.20.0 0.0.0.255
access-list 1 permit 172.16.30.0 0.0.0.255
access-list 1 permit 172.16.40.0 0.0.0.255
access-list 1 permit 172.16.99.1 0.0.0.0

ip nat source list 1 interface FastEthernet0/0 overload
ip nat source static tcp 172.16.30.3 20 interface FastEthernet0/0 20
ip nat source static tcp 172.16.30.3 21 interface FastEthernet0/0 21
ip nat source static tcp 172.16.30.3 80 interface FastEthernet0/0 80

 

625
Views
0
Helpful
6
Replies