Hello all,
Was hoping to get some "basic" help with NAT, in this case running on a 1720 router. This is an Internet router, running Frame Relay to the provider. The Ethernet side is a /29 network. Since they want more than 5 users, and do not have a firewall, NAT/PAT is obviously needed.
The router has one serial interface, and one fastethernet interface. The basic configuration is as follows (abbreviated for brevity):
int serial 0
encap frame-relay IETF
frame-relay lmi-type ansi
no ip address
int serial 0.1
ip address 192.168.1.2/30
frame-relay interface-dlci 250
ip nat outside
int fastethernet 0
ip address 192.168.2.1/29
ip nat inside
ip nat pool TEST 192.168.2.2 192.168.2.2 prefix-length 29
ip nat inside source list 99 pool TEST overload
access-list 99 permit 172.16.15.0 0.0.0.255
OK, I believe I already realize some of my mistakes. As an Internet router, the router's current two interfaces are BOTH "outside interfaces." So, questions are:
1). I believe I have to have a second Fastethernet interface, configured with e.g. RFC 1918 address, reflecing inside network. This will be the NAT INSIDE interface. The original Fastethernet interface will be the NAT OUTSIDE interface. Is this correct?
2). Is there any way to avoid a second fastethernet interface, and use just the two interfaces-the LAN and WAN interfaces-and have NAT/PAT work properly? I don't believe so, but I would like to have a definitive answer before having this client spring for another interface.
So this is how I feel it will look afterwards:
int fastethernet 0
ip address 192.168.2.1/29
ip nat outside
int fastethernet 1
ip address 172.16.15.0/24
ip nat inside
ip nat pool TEST 192.168.2.2 192.168.2.2 prefix-length 29
ip nat inside source list 99 pool TEST overload
access-list 99 permit 172.16.15.0 0.0.0.255
(Or I could tell them to buy a firewall ;)
Thanks in advance!
Sean Geist, Network Engineer
SEALI.com
