Can't ping from router's outside interface after NAT translation

[KnightKirara]

Hello !

I have a network like such, with Router 1's configuration on the left side of the picture :

My question is : why can't i ping 12.12.12.1 (or any other host on the WAN network) from Router 1 ? 

[KnightKirara]

I have done so many times but don't really see what i did wrong ! The nat rules i've specified look fine to me and yet the problem persists.

[Flavio Miranda]

Hi @KnightKirara 

 You need to check the return routing on the Router1 to 172.168.x.x

Along side the commands ip nat inside and ip nat ouside on the Router2

You can attach your PacketTracer project here. Zip it first.

[KnightKirara]

Hi @Flavio Miranda,

I don't really understand what you mean by this : "You need to check the return routing on the Router1 to 172.168.x.x", since my problem doesn't seem to involve the 172.168.x.x network.

I also haven't done any NAT redirections on the router 2, i have only done so on the router 1. I have configured ip nat outside on router 1's f0/0 interface (12.12.12.2) and ip nat inside on router 1's f1/0 interface (172.168.2.254).

I have included my zipped project in this message !

[Flavio Miranda]

@KnightKirara 

 I managed to make it work but I replaced one router from Router-TP to a 1941 Router model. For some reason, the router you chose was not working the NAT overload.

 Take a look and let me know if worked on your side.

[KnightKirara]

@Flavio Miranda 

Thanks ! I've taken a look at it but the router didn't have the ip nat inside/outside configured and didn't redirect packets received on 12.12.12.2 to 172.168.2.1, which is what i was trying to do (i want the host on the far left to be able to connect to the website hosted on the server on the far right via NAT forwarding on the router you replaced).

So i've configured the router you replaced to make it do what i want it to do, and 192.168.1.1 can connect to the website hosted on 172.168.2.1 but the router still can't ping anything after i'm done configuring it, whereas it could ping prior to being configured for NAT. I've included the modifed version in this comment, i've only modified around 3 lines in the router's configuration.

[Flavio Miranda]

Hi @KnightKirara 

 Sorry about my privious file. I replaced the router and forget to replace the interface config for NAT.

The problem was not related to the router model  indeed. Actually, the NAT overload was the problem. What I did on this version was used static NAT on the network 192.168.1.0 and on the other end, where the web server is placed, I used the NAT outside instead inside  and used the port 80 to be translated from the IP address 12.12.12.1 to the IP address 172.168.2.1.

Take a look now please

[KnightKirara]

@Flavio Miranda 

Thanks ! However 192.168.1.0 and 172.168.2.0 are both supposed to be private networks and shouldn't be routable from the WAN, so i don't think they should be added to the eigrp network table. Also, i want to be able to access the cute cat picture by connecting to the router's outside interface (12.12.12.2), not by connecting directly to 172.168.2.1 as it shouldn't be routable from outside the LAN.

I've tweaked a bit and researched a bit more and it may just be a bug from Packet Tracer (https://community.cisco.com/t5/switching/can-t-ping-between-2-networks-with-nat-overload/td-p/4579938), i don't know if it's exactly the same problem as mine but it seems close enough, and after tweaking i've had the similar problem but in reverse, i could ping from Router 1 but not from BOX INTERNET, so i guess it kinda resembles the situation described there ? 

[Flavio Miranda]

Hi @KnightKirara 

 It is still possible to do but not with regular IOS router. The Router will not do the port translation while doing the NAT due the PacketTracer limitation.

 To overcome that, you can use another router model as I did on the file attached.

[KnightKirara]

Thanks @Flavio Miranda , but i think our friend @d3an.chen got the problem right ! Thanks for your help regardless, it got me thinking about the problem in a different way !

[d3an.chen · Accepted solution]

Hi, 

   If you issue the command "debug ip nat" on your Router1, then ping the 12.12.12.1. R2 will translate the change the destination address to the replying ICMP from R2. That's the reason that your R1 consider the ping to the 12.12.12.1 never get response back. 

[KnightKirara]

Oh that was actually what i was thinking in the first place when i posted the question on another forum but no one told me that it was it ! So it actually was the NAT redirection that was preventing 12.12.12.2 from ever getting the reply itself ! 

Thanks for your help, much appreciated ! And that debug ip nat command might come in handy.

[Flavio Miranda]

But after all, did you make the PC access the web server calling the IP 12.12.12.2?

[KnightKirara]

Yes, this has worked since the beginning !