IP Pool Nat

[tester125]

Hi Everyone,

I'm New to Cisco, any info will be great.

I have a Cisco 2600 and Want to setup up an IP Pool Nat: Nat poll will be 172.12.19.x.

I want everyone on the 10.8.5.0 network to be translated to 172.12.19.x But only when they try to access 199.214.35.0. Otherwise no Nat is to be done.

Do you know how I go about doing this, could anyone give me some examples using the address that I provided and rules.

Thanks for any input.

[olorunloba]

Check

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080093fca.shtml

or

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080094e77.shtml

Try

interface (local lan)

ip nat inside

interface (WAN)

ip nat outside

ip nat pool NAT 172.12.19.1 172.12.19.254 netmask 255.255.255.0

ip nat inside source list 199 pool NAT overload

access-list 199 permit ip 10.8.5.0 0.0.0.255 172.12.9.0 0.0.0.255

This should work

[tester125]

Hi Olorunloba,

I followed one of the doc's and what you mention line by line.

But when I do show log's it does not show that translation is happening when I try to access one of the network in question.

Is there anything else that I need to turn on?

[tester125]

Maybe a little more info will shed some light. Please any help.

Maybe this might clear up some confusion.

The Cisco Serial Interface goes to another building.

My lan is connected to Ethernet0/0.

I want the packet to hit Ethernet0/0 gets translated and go out my default route to my firewall.

the packet should not touch the Serial Interface. That's for my side.

Now the building that's connected via the Serial Interface, I want the packet to come thru the serial gets translated then go out the Ethernet0/0 onto my firewall.

Hope this clears it up a little.

Thanks for any help.

[olorunloba]

Is your routing well configured?.

Give us the running config and the show ip nat translations

[olorunloba]

If I get you right, the firewall is connected to the ethernet of the router. That means traffic is entering and leaving the same interface (and you still want it translated). Normally, the inside and outside interfaces should be different. To achieve the above, you will need to configure NAT on a stick.

Check

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080094430.shtml

Traffic coming from the serial follows the normal NAT traffic pattern.

Hope this helps

[tester125]

VIRCIS20.2>show interface

FastEthernet0/0 is up, line protocol is up

Hardware is AmdFE, address is 000c.31eb.e5c0 (bia 000c.31eb.e5c0)

Internet address is 10.5.20.2/16

MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation ARPA, loopback not set

Keepalive set (10 sec)

Half-duplex, 100Mb/s, 100BaseTX/FX

ARP type: ARPA, ARP Timeout 04:00:00

Last input 00:00:00, output 00:00:00, output hang never

Last clearing of "show interface" counters never

Input queue: 0/75/60/0 (size/max/drops/flushes); Total output drops: 0

Queueing strategy: fifo

Output queue :0/40 (size/max)

5 minute input rate 75000 bits/sec, 17 packets/sec

5 minute output rate 12000 bits/sec, 13 packets/sec

31333505 packets input, 2709610083 bytes

Received 8055305 broadcasts, 0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

0 watchdog

0 input packets with dribble condition detected

20761053 packets output, 3765938094 bytes, 0 underruns

0 output errors, 3438 collisions, 2 interface resets

0 babbles, 0 late collision, 17441 deferred

0 lost carrier, 0 no carrier

0 output buffer failures, 0 output buffers swapped out

Serial0/0 is up, line protocol is up

Hardware is PQUICC with Fractional T1 CSU/DSU

Internet address is 10.1.11.1/24

MTU 1524 bytes, BW 1536 Kbit, DLY 100 usec,

reliability 255/255, txload 11/255, rxload 1/255

Encapsulation PPP, loopback not set

LCP Open

Listen: CDPCP

Open: IPCP

Last input 00:00:00, output 00:00:00, output hang never

Last clearing of "show interface" counters 4w6d

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 13003

Queueing strategy: weighted fair

Output queue: 0/1000/64/12999 (size/max total/threshold/drops)

Conversations 0/23/256 (active/max active/max total)

Reserved Conversations 0/0 (allocated/max allocated)

Available Bandwidth 1152 kilobits/sec

5 minute input rate 10000 bits/sec, 12 packets/sec

5 minute output rate 68000 bits/sec, 13 packets/sec

21322634 packets input, 3536524261 bytes, 0 no buffer

Received 0 broadcasts, 0 runts, 5 giants, 0 throttles

2589 input errors, 962 CRC, 1285 frame, 0 overrun, 0 ignored, 342 abort

23921255 packets output, 1292851117 bytes, 0 underruns

0 output errors, 0 collisions, 80 interface resets

0 output buffer failures, 0 output buffers swapped out

15 carrier transitions

DCD=up DSR=up DTR=up RTS=up CTS=up

Hey when I try to show IP nat translation, it does not show me a log. I know I was getting a log earlier.

Gateway of last resort is 10.x.x.x to network 0.0.0.0

10.0.0.0/8 is variably subnetted, 5 subnets, 4 masks

C 10.1.11.0/24 is directly connected, Serial0/0

C 10.1.11.2/32 is directly connected, Serial0/0

S 10.0.0.0/8 [1/0] via 10.5.35.1

S 10.4.0.0/16 [1/0] via 10.1.11.2

C 10.5.0.0/16 is directly connected, FastEthernet0/0

S 192.168.0.0/24 [1/0] via 10.1.11.2

S* 0.0.0.0/0 [1/0] via 10.x.x.x

Any help is great

[john-lucero]

you may be able to apply the nat to a sub interface on the serial port. Route the traffic destined for the 199 network to the sub interface, and then it will get a address translation.

All other traffic will go out the primary interface.

[olorunloba]

Do your configuration step by step. Try the remote branch coming in via the serial. This is straight forward NAT like the config previously given. When this is working, try and configure NAT on a stick, for the local users coming in from the ethernet. Note the steps required from the link given (Policy base routing etc).

Hopefully, it should work.