topic NAT in IOS static but bypass for direct access in Routing and SD-WAN

NAT in IOS static but bypass for direct access

cmccready — Mon, 04 Mar 2019 12:23:09 GMT

my company wants to have it's cake and eat it too. we are migrating an application from a legacy host system to a new host system. at a remote site, we want some users to telnet to the legacy ip address (244) and be redirected to the new ip address (144). we also want some users at the same remote site to be able to telnet directly to the new host system (144). if i implement a simple ip nat static, the first part (redirection) works fine but the second part (direct connect) fails. I understand why this is happening, but how do i get around it?

site A - subnet 172.20.14.0/24

host legacy 172.20.14.244

host new 172.20.14.144

remote site b - subnet 172.20.160.0/24

host joe 172.20.160.21

Re: NAT in IOS static but bypass for direct access

connect2world — Thu, 16 Apr 2009 01:52:17 GMT

Would putting an deny to those ip you wish to exclude from your nat access-list do the job?

Re: NAT in IOS static but bypass for direct access

cmccready — Thu, 16 Apr 2009 23:28:28 GMT

not sure ... I thought that the deny would be implied and that only the 'permit'-d addresses would be nat'd

i tested a new set of configs today and was able to get direct traffic to avoid the nat by policy-routing it out another interface. it's ugly but it works

Re: NAT in IOS static but bypass for direct access

connect2world — Fri, 17 Apr 2009 01:05:40 GMT

Yes you are correct.I have not thought of that! You could have assign ip address to those device which need direct connection, out of the nating access-list range. This way I think might also achieve what you need.

Re: NAT in IOS static but bypass for direct access

daybreak001 — Fri, 17 Apr 2009 05:53:44 GMT

Router# show proce cpu

CPU utilization for five seconds: 2%/0%; one minute: 5%; five minutes: 5%