gDay to u @Adam_S alright. let me go all in here. First, u’re mixing classic NAT (inside/outside) with NVI (ip nat enable).
- WAN Gi0/0/1 is ip nat outside (classic).
- Your LAN SVIs use ip nat enable (NVI).
When u mix the two, the router won’t treat LAN traffic as “inside,” so ur NAT_ACL never gets hit and no translations are created. That’s also why NVI0 never appears. And u have some options here.
Option 1, which is recommended, USE CLASSIC NAT only. So on every lan svi, replace ip nat enable with ip nat inside;
conf t
int Vlan12
no ip nat enable
ip nat inside
int Vlan16
no ip nat enable
ip nat inside
int Vlan17
no ip nat enable
ip nat inside
int Vlan20
no ip nat enable
ip nat inside
int Vlan40
no ip nat enable
ip nat inside
int Vlan112
no ip nat enable
ip nat inside
int Vlan212
no ip nat enable
ip nat inside
int Vlan213
no ip nat enable
ip nat inside
int Gig0/0/1
ip nat outside (already present)
end
2. Tighten the NAT ACL so it only matches your internal subnets (optional but cleaner). For example:
ip access-list extended NAT_ACL
no 10
no 20
no 80
no 90
no 100
no 110
10 permit ip 10.0.0.0 0.255.255.255 any
20 permit ip 172.16.0.0 0.0.255.255 any
30 permit ip 192.168.0.0 0.0.255.255 any
3. Keep ur existing overload rule,,,, and do some tests
OPTION B: USE NVI so no inside /outside:
int Gig0/0/1
no ip nat outside
ip nat enable
(ensure all LAN SVIs have 'ip nat enable' they already do)
end
----------------------
Then use either of these (both generally work with NVI; if in doubt, use NVI0):
ip nat source list NAT_ACL interface NVI0 overload
or
ip nat source list NAT_ACL interface GigabitEthernet0/0/1 overload
So, if u switch to Option A (classic), u should immediately see hits in show ip nat statistics and active entries in show ip nat translations.
This turned into a long answer, but I had fun writing it! Hope it’s useful!
-Enes
more Cisco?!
more Gym?!
If this post solved your problem, kindly mark it as Accepted Solution. Much appreciated!
