Hi,
Hi,
I'm looking for some help in configuring NAT on my Cisco 891F router.
I have a pool of five public ip addresses provided by my ISP and would like to two of them to provide external access to my security camera's. My ISP also provided an additional router address as part of the public ip address range.
I have assigned the router address to the Dialer1 interface in my router configuration and attempted to NAT using two of the provided addresses as follows
ip nat inside source static udp 192.168.1.2 8000 81.150.26.63 8000 extendable
ip nat inside source static udp 192.168.1.3 8000 81.150.26.64 8000 extendable
The problem I have is I simply cannot get access to my inside network addresses from the outside, I wondered if one of you experts out there would kindly take a look at my configuration to see if there’s anything obvious that I'm doing wrong; one other thing that I did do was to enable autosec_firewall on the router and wondered if this might be having any interference.
Any help is fully appreciated.
Configuration.....
Building configuration...
Current configuration : 4500 bytes
!
version 15.3
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname Router
!
boot-start-marker
boot-end-marker
!
aqm-register-fnf
!
security authentication failure rate 10 log
security passwords min-length 6
logging console critical
enable secret 5 $1$QE2E$cu2ed.d7dKTs6.0ZhJ328/
enable password 7 142417081E573E6A
!
aaa new-model
!
!
aaa authentication login local_auth local
!
!
!
!
!
aaa session-id common
!
!
no ip source-route
no ip gratuitous-arps
!
!
!
!
!
ip dhcp excluded-address 192.168.1.1 192.168.1.10
!
ip dhcp pool vlan1pool
network 192.168.1.0 255.255.255.0
default-router 192.168.1.254
dns-server 213.120.234.70
!
!
!
no ip bootp server
no ip domain lookup
ip inspect audit-trail
ip inspect udp idle-time 1800
ip inspect dns-timeout 7
ip inspect tcp idle-time 14400
ip inspect name autosec_inspect ftp timeout 3600
ip inspect name autosec_inspect http timeout 3600
ip inspect name autosec_inspect rcmd timeout 3600
ip inspect name autosec_inspect realaudio timeout 3600
ip inspect name autosec_inspect smtp timeout 3600
ip inspect name autosec_inspect tftp timeout 30
ip inspect name autosec_inspect udp timeout 15
ip inspect name autosec_inspect tcp timeout 3600
ip cef
login block-for 5 attempts 3 within 5
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
license udi pid C891F-K9 sn FCZ2214137E
!
!
archive
log config
logging enable
username Grid password 7 097F4B0A0B560353
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface BRI0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
encapsulation hdlc
shutdown
isdn termination multidrop
!
interface FastEthernet0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0
no ip address
!
interface GigabitEthernet1
no ip address
!
interface GigabitEthernet2
no ip address
!
interface GigabitEthernet3
no ip address
!
interface GigabitEthernet4
no ip address
!
interface GigabitEthernet5
no ip address
!
interface GigabitEthernet6
no ip address
!
interface GigabitEthernet7
no ip address
!
interface GigabitEthernet8
description ### WAN interface ###
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface Vlan1
ip address 192.168.1.254 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly in
!
interface Async3
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
encapsulation slip
!
interface Dialer1
ip address 81.150.26.30 255.255.255.248
ip access-group autosec_firewall_acl in
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1492
ip nat outside
ip inspect autosec_inspect out
ip virtual-reassembly in
ip verify unicast source reachable-via rx allow-default 100
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname C000332@hg28.btclick.com
ppp chap password 7 1414130502512628757A60
no cdp enable
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip nat inside source list 1 interface Dialer1 overload
ip nat inside source static udp 192.168.1.2 8000 81.150.26.63 8000 extendable
ip nat inside source static udp 192.168.1.3 8000 81.150.26.64 8000 extendable
ip route 0.0.0.0 0.0.0.0 Dialer1
!
ip access-list extended autosec_firewall_acl
permit udp any any eq bootpc
deny ip any any
!
logging trap debugging
logging facility local2
no cdp run
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 100 permit udp any any eq bootpc
!
!
!
control-plane
!
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
banner motd ^CUNA^C
!
line con 0
exec-timeout 5 0
login authentication local_auth
no modem enable
transport output telnet
line aux 0
exec-timeout 15 0
login authentication local_auth
transport output telnet
line 3
exec-timeout 15 0
login authentication local_auth
modem InOut
speed 115200
flowcontrol hardware
line vty 0 4
login authentication local_auth
transport input telnet
!
scheduler allocate 20000 1000
!
end
Router#
I have a pool of five public ip addresses provided by my ISP and would like to two of them to provide external access to my security camera's. My ISP also provided an additional router address as part of the public ip address range.
I have assigned the router address to the Dialer1 interface in my router configuration and attempted to NAT using two of the provided addresses as follows
ip nat inside source static udp 192.168.1.2 8000 81.150.26.63 8000 extendable
ip nat inside source static udp 192.168.1.3 8000 81.150.26.64 8000 extendable
The problem I have is I simply cannot get access to my inside network addresses from the outside, I wondered if one of you experts out there would kindly take a look at my configuration to see if there’s anything obvious that I'm doing wrong; one other thing that I did do was to enable autosec_firewall on the router and wondered if this might be having any interference.
Any help is fully appreciated.
Configuration.....
Building configuration...
Current configuration : 4500 bytes
!
version 15.3
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname Router
!
boot-start-marker
boot-end-marker
!
aqm-register-fnf
!
security authentication failure rate 10 log
security passwords min-length 6
logging console critical
enable secret 5 $1$QE2E$cu2ed.d7dKTs6.0ZhJ328/
enable password 7 142417081E573E6A
!
aaa new-model
!
!
aaa authentication login local_auth local
!
!
!
!
!
aaa session-id common
!
!
no ip source-route
no ip gratuitous-arps
!
!
!
!
!
ip dhcp excluded-address 192.168.1.1 192.168.1.10
!
ip dhcp pool vlan1pool
network 192.168.1.0 255.255.255.0
default-router 192.168.1.254
dns-server 213.120.234.70
!
!
!
no ip bootp server
no ip domain lookup
ip inspect audit-trail
ip inspect udp idle-time 1800
ip inspect dns-timeout 7
ip inspect tcp idle-time 14400
ip inspect name autosec_inspect ftp timeout 3600
ip inspect name autosec_inspect http timeout 3600
ip inspect name autosec_inspect rcmd timeout 3600
ip inspect name autosec_inspect realaudio timeout 3600
ip inspect name autosec_inspect smtp timeout 3600
ip inspect name autosec_inspect tftp timeout 30
ip inspect name autosec_inspect udp timeout 15
ip inspect name autosec_inspect tcp timeout 3600
ip cef
login block-for 5 attempts 3 within 5
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
license udi pid C891F-K9 sn FCZ2214137E
!
!
archive
log config
logging enable
username Grid password 7 097F4B0A0B560353
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface BRI0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
encapsulation hdlc
shutdown
isdn termination multidrop
!
interface FastEthernet0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0
no ip address
!
interface GigabitEthernet1
no ip address
!
interface GigabitEthernet2
no ip address
!
interface GigabitEthernet3
no ip address
!
interface GigabitEthernet4
no ip address
!
interface GigabitEthernet5
no ip address
!
interface GigabitEthernet6
no ip address
!
interface GigabitEthernet7
no ip address
!
interface GigabitEthernet8
description ### WAN interface ###
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface Vlan1
ip address 192.168.1.254 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly in
!
interface Async3
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
encapsulation slip
!
interface Dialer1
ip address 81.150.26.30 255.255.255.248
ip access-group autosec_firewall_acl in
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1492
ip nat outside
ip inspect autosec_inspect out
ip virtual-reassembly in
ip verify unicast source reachable-via rx allow-default 100
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname C000332@hg28.btclick.com
ppp chap password 7 1414130502512628757A60
no cdp enable
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip nat inside source list 1 interface Dialer1 overload
ip nat inside source static udp 192.168.1.2 8000 81.150.26.63 8000 extendable
ip nat inside source static udp 192.168.1.3 8000 81.150.26.64 8000 extendable
ip route 0.0.0.0 0.0.0.0 Dialer1
!
ip access-list extended autosec_firewall_acl
permit udp any any eq bootpc
deny ip any any
!
logging trap debugging
logging facility local2
no cdp run
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 100 permit udp any any eq bootpc
!
!
!
control-plane
!
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
banner motd ^CUNA^C
!
line con 0
exec-timeout 5 0
login authentication local_auth
no modem enable
transport output telnet
line aux 0
exec-timeout 15 0
login authentication local_auth
transport output telnet
line 3
exec-timeout 15 0
login authentication local_auth
modem InOut
speed 115200
flowcontrol hardware
line vty 0 4
login authentication local_auth
transport input telnet
!
scheduler allocate 20000 1000
!
end
Router#
