topic Hello in Switching

NAT not working using Pool only when being NAT over an Interface

mjuchim27 — Fri, 08 Mar 2019 19:25:22 GMT

Hi, need some advice; I configured my Cisco 877 Router using some new Public IP address I got from my ISP but when I do a NAT using a pool of addresses; I can't browse the internet. The only way I will be able to browse the internet is if I do a NAT using an Interface and this happens only when using the fiber connection. I also have a DSL link of which I only changed the public IP address in the configuration of my Cisco 877 Router to reflect the Public IP address of the dsl link and my NAT using the pool of addresses works, as well when doing a NAT over an Interface. Please help.

Hi,

Reza Sharifi — Fri, 21 Jul 2017 16:48:22 GMT

Hi,

Can you post "sh run" from the router and point out the interface that is not working?

HTH

Hi Reza, thanks for the reply

mjuchim27 — Fri, 21 Jul 2017 17:39:06 GMT

Hi Reza, thanks for the reply, see below my current router config using fiber link. with the current config I cannot browse.

interface FastEthernet0
switchport access vlan 5
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
ip address 192.168.30.1 255.255.255.192
ip nat inside
ip virtual-reassembly
!
interface Vlan5
ip address 190.x.x.146 255.255.255.240
ip nat outside
ip virtual-reassembly
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 190.x.x.145
!
no ip http server
no ip http secure-server
ip nat pool BTL 190.x.x.147 190.x.x.148 netmask 255.255.255.240
ip nat inside source list INTERNET-BROwSING pool BTL overload
!
ip access-list extended INTERNET-BROwSING
permit ip 192.168.30.0 0.0.0.63 any

Hi,

Reza Sharifi — Fri, 21 Jul 2017 17:52:21 GMT

Hi,

Have you tried the NAT statement with prefix-list and test?

ip nat pool BTL 190.x.x.147 190.x.x.148 prefix-length 27

HTH

Hi,

mjuchim27 — Fri, 21 Jul 2017 18:07:10 GMT

Hi,

I just modified the config to

ip nat pool BTL 190.x.x.147 190.x.x.148 prefix-length 28

and is still not working. See ping from within router.

Router#ping 4.2.2.2 source vlan 1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 192.168.30.1
.....
Success rate is 0 percent (0/5

In addition, can you use the

Reza Sharifi — Fri, 21 Jul 2017 18:38:04 GMT

In addition, can you use the nat statement without overload?

ip nat inside source list INTERNET-BROwSING pool BTL

HTH

Hi Reza, thank you for you

mjuchim27 — Fri, 21 Jul 2017 18:48:29 GMT

Hi Reza, thank you for you help really appreciate it.

even without the overload, I still cannot browse. Like I mentioned in the original post, this happens only on the fiber link. If I switch over to dsl and use the public ips assigned on dsl network using the same nat pool statement, it works. Do you think its a problem with our ISP, I even tried a different router and still have the same problem?

Hi,

Reza Sharifi — Fri, 21 Jul 2017 19:02:50 GMT

Hi,

I don't think this is an ISP issue.

So, if you ping say 8.8.8.8 without the source address, this should use the outgoing interface which is vlan1 Does it work?

If it does than this is not an issue with the ISP.

ping 8.8.8.8

Can you try it with static nat and test?

ip nat inside source list INTERNET-BROwSING interface vlan5 overload

no ip nat pool BTL 190.x.x.147 190.x.x.148 netmask 255.255.255.240
HTH

Hi Reza,

mjuchim27 — Fri, 21 Jul 2017 19:13:13 GMT

Hi Reza,

yes if I ping 8.8.8.8 which uses the outgoing interface vlan 5 as per my configuration, it works.

Router#ping 8.8.8.8

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/25/28 ms

when I modified the NAT state to a static NAT

ip nat inside source list INTERNET-BROwSING interface Vlan5 overload,

it works as well

Router#ping 8.8.8.8 source vlan 1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
Packet sent with a source address of 192.168.30.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/26/32 ms

I'm puzzled, i'm not sure what i'm missing.

Hi,

Reza Sharifi — Fri, 21 Jul 2017 19:23:15 GMT

Hi,

So, definitely is not an ISP issue or NAT because static NAT works fine.

Have a look at this link and look at the section for dynamic NAT and see if anything is missing:

http://www.ciscozine.com/nat-and-pat-a-complete-explanation/

HTH

Hello,

Georg Pauwen — Fri, 21 Jul 2017 19:52:03 GMT

Hello,

on a side note, try a standard access list or a route map (with or without the 'overload'):

access-list 10 permit 192.168.30.0 0.0.0.63
!
ip nat pool BTL 190.x.x.147 190.x.x.148 netmask 255.255.255.240
ip nat inside source list 10 pool BTL (overload)

access-list 100 permit ip 192.168.30.0 0.0.0.63 any
!
ip nat pool BTL 190.x.x.147 190.x.x.148 netmask 255.255.255.240
!
route-map TO_ISP permit 10
match ip address 100
!
ip nat inside source route-map TO_ISP pool BTL (overload)

Most likely that this is ISP

Predrag Jovic — Sat, 22 Jul 2017 08:39:18 GMT

If you cleared NAT table during switching from DSL to fiber, most likely that this is ISP routers configuration. For testing, you might also want to include 190.x.x.146 in your pool configuration, otherwise .146 will not be used for NAT. If you include this one in pool most likely you will be able to successfully forward traffic via that IP address (at least until all ports in are not exhausted from .146 (or at least pool with just .146 will work)) while using NAT pool via fiber.

From data that are available here, I don't think this is configuration issue on your side. I guess that ISP is not routing traffic properly for some reason (like, ISP is statically advertise your network range from DSL router into their network?) so return traffic does not have proper return path, or some similar issue.

Hello

paul driver — Sat, 22 Jul 2017 11:13:33 GMT

Hello

I have see this before that you cannot nat sourced from the rtrs interface nat is applied on, but its successful from behind the natted interface.

I cannot remember if i upgraded the IOS or utilized NVI nat ( domain less nat)

Have you tested ping from behind the vlans other than the svi address themselves or tried NVI nat?

sh run | in ip nat
ping 8.8.8.8 (from host behind natted vlan)
sh ip nat translations
debug ip nat detail
debug ip packet detail

int x/x
no ip nat inside
ip nat enable

int x/x
no ip nat outside
ip nat enable

no ip nat inside source list INTERNET-BROwSING pool BT
ip nat source list INTERNET-BROwSING pool BT

sh ip nat nvi translations

res
Paul