Xbox Live NAT issue 887VA

[stevenr_robins]

Hi All.

My router is connecting fine over ADSL but xbox is reporting moderate/strict NAT.  Has anyone come across the issue and fixed it?

Xbox is being leased an ip from routers DHCP pool (192.168.0 /24).

I believe it involves some port forwards? but cant remember how.

[Seb Rupik · Accepted solution]

Hi Steven,

I'm making the assumption you have the follow interfaces configured. VLAN1 is a layer 3 VLAN on the inside of your network, and Dialer0 is connected to your ISP:

Add the following config:

!

interface Vlan1

  ip nat inside

!

interface Dialer0

  ip nat outside

!

...we now need to set up NAT for the XBox live ports. You need to put your XBox on a fixed IP and fill in the blank :

!

ip nat inside source static tcp 53 interface Dialer0 53

ip nat inside source static udp 53 interface Dialer0 53

ip nat inside source static tcp 80 interface Dialer0 80

ip nat inside source static udp 88 intrerface Dialer0 88

ip nat inside source static tcp 3074 interface Dialer0 3074

ip nat inside source static udp 3074 interface Dialer0 3074

!

...that should do the trick.

cheers,

Seb.

[stevenr_robins]

Thanks Seb.

I set the xbox to a static ip of 192.168.0.12 and excluded that ip from the cisco's dhcp pool.

I then applied the settings mentioned above to the config (and did a copy run start and a reload to confirm it was saved)

However still doesnt appear to work.  On xbox live connection test it reports connectivity fine but moderate/strict NAT.

Also when turning the xbox on (xbox connected to FastEthernet1 port on cisco) the interface on the cisco doesnt seem to come up quick enough to sign in to xbox live initially :/

[johnlloyd_13]

Hi Steven,

I believe you're rerferring to UPnP feature.

I'm afraid your ISR/887 doesn't support it. This feature is usually found on SOHO type of routers (i.e. Linksys).

https://supportforums.cisco.com/thread/2178076

https://supportforums.cisco.com/thread/1004198

Sent from Cisco Technical Support iPhone App

[Seb Rupik]

Hi Steven,

Try the following command:

!

int fa0/1

  spanning-tree portfast

!

...that reduce the time it takes for the swithport to come up.

Can you post the cofig of your router? There maybe an ACL somewhere blocking the traffic, and we can also configure on to see what traffic is incoming.

John, I agree that the xbox service does use uPNP, but I have seen examples of ASA configs to get this service funtional, so am sure a combination of ACLs and NAT should do the trick.

cheers,

Seb.

[stevenr_robins]

Hi Seb.  Config below as requested:

Router#sh run

Building configuration...

Current configuration : 2314 bytes

!

! Last configuration change at 12:45:54 UTC Sun Aug 4 2013

version 15.1

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname Router

!

boot-start-marker

boot-end-marker

!

!

enable secret 4 cW5ldN/EjyvA5QrEqv8XXvWQgGAtQmiAYpmz2kK0XkI

!

no aaa new-model

memory-size iomem 10

crypto pki token default removal timeout 0

!

!

ip source-route

!

!

!

ip dhcp excluded-address 192.168.0.1

ip dhcp excluded-address 192.168.0.12

!

ip dhcp pool HomeNetwork

import all

network 192.168.0.0 255.255.255.0

default-router 192.168.0.1

dns-server 62.24.199.13 62.24.199.23

lease 0 2

!

ip dhcp pool homenetwork

dns-server 192.168.0.1

!

!

ip cef

no ip domain lookup

no ipv6 cef

!

!

license udi pid CISCO887VA-K9 sn FCZ17119094

!

!

!

!

!

!

controller VDSL 0

!

!

!

!

!

!

!

!

interface Ethernet0

no ip address

shutdown

!

interface ATM0

no ip address

no atm ilmi-keepalive

pvc 0/38

  pppoe-client dial-pool-number 1

!

!

interface ATM0.1 point-to-point

!

interface FastEthernet0

no ip address

!

interface FastEthernet1

no ip address

!

interface FastEthernet2

no ip address

!

interface FastEthernet3

no ip address

!

interface Vlan1

ip address 192.168.0.1 255.255.255.0

ip nat inside

ip virtual-reassembly in

ip tcp adjust-mss 1452

!

interface Dialer0

ip address negotiated

ip mtu 1432

ip nat outside

ip virtual-reassembly in

encapsulation ppp

dialer pool 1

ppp authentication chap pap callin

ppp chap hostname bob

ppp chap password 0 bob

ppp pap sent-username bob password 0 bob

!

ip forward-protocol nd

no ip http server

no ip http secure-server

!

ip nat inside source list 101 interface Dialer0 overload

ip nat inside source static tcp 192.168.0.12 53 interface Dialer0 53

ip nat inside source static udp 192.168.0.12 53 interface Dialer0 53

ip nat inside source static tcp 192.168.0.12 80 interface Dialer0 80

ip nat inside source static udp 192.168.0.12 88 interface Dialer0 88

ip nat inside source static tcp 192.168.0.12 3074 interface Dialer0 3074

ip nat inside source static udp 192.168.0.12 3074 interface Dialer0 3074

ip route 0.0.0.0 0.0.0.0 Dialer0

!

access-list 101 permit ip 192.168.0.0 0.0.255.255 any

!

!

!

!

!

line con 0

no modem enable

line aux 0

line vty 0 4

login

transport input all

!

end

[Seb Rupik]

With the xbox switched on and attempting to connect, what is the output of 'sh ip nat trans' ?

[stevenr_robins]

Seb - It worked - thanks for all your help.