Limited set of nat commands

[lcac]

I'm testing diferent types of nat in a cisco 6500 (ios 15.1(2)SY7) but the set of commands is basically limited to :

ip nat inside source list access-list-number

With this limitation I cannot test static or dynamic nat and when I try testing pat no entry appears in the translation table. 

Any idea why neither static nor dynamic nat seems to be supported or working in this configuration?

[balaji.bandi]

If i remember Cat 6K gone old for me , this is more of switch with some Limited NAT rules, depends on what sup card you have :

https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/97262-nat-cat665k-configex.html

we can not expect like Router/ FW does the NAT in this switch (depends on what you have ?)

by the way what command syntax you trying and not working ?

[lcac]

Our device is a cisco WS-C6506-E (M8572) with supervisor engine 2T.

The set of commands to set up nat is limited to :

router(config)#ip nat ?
create Create flow entries
inside Inside address translation
log NAT Logging
service Special translation for application using non-standard port
translation NAT translation entry configuration

router(config)#ip nat inside ?
source Source address translation

I can set up pat with the following commands :

access-list 1 permit 172.25.0.0 0.0.255.255
ip nat inside source list 1 interface Vlan2 overload
interface Vlan3
ip nat inside
interface Vlan2
ip nat outside

Both vlan are working but I cannot see neither translations nor statistics between them (I try ping from inside device 172.25.x.x to 8.8.8.8):

router#sh ip nat statistics
Total active translations: 0 (0 static, 0 dynamic; 0 extended)
Outside interfaces:
Vlan2
Inside interfaces:
Vlan3
Hits: 0 Misses: 0
CEF Translated packets: 0, CEF Punted packets: 33
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id: 1] access-list 2 interface Vlan2 refcount 0

[MHM Cisco World]

Your Config Is OK,
can I see 
show ip nat translation 
before and after ping.

[lcac]

Before ping :

router#sh ip nat translations verbose

router#

And after ping to 8.8.8.8 the result is the same :

router#sh ip nat translations verbose

router#

[balaji.bandi]

Do you mean to say that is working, but you cannot see the translation ?

how is your routing?

show IP route 

I would advise posting the full config will get an idea how the config and routing here.

[lcac]

Ping from the inside device (172.25.0.0) to 8.8.8.8 is not answering.

Our routes are :

router#sho ip route
...
Gateway of last resort is 10.10.100.13 to network 0.0.0.0

S* 0.0.0.0/0 [1/0] via 10.10.100.13
10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 10.10.100.12/30 is directly connected, Vlan512
L 10.10.100.14/32 is directly connected, Vlan512
x.x.0.0/16 is variably subnetted, 20 subnets, 3 masks
...
C x.x.35.0/24 is directly connected, Vlan2
L x.x.35.2/32 is directly connected, Vlan2
172.25.0.0/16 is variably subnetted, 2 subnets, 2 masks
C 172.25.0.0/16 is directly connected, Vlan3
L 172.25.0.2/32 is directly connected, Vlan3

And briefly our vlan set up is :

router#sh running-config

...

!
interface Vlan2
description Outside-Network
ip address x.x.35.2 255.255.255.0
ip access-group trafficNet35ExtUseIn in
ip access-group trafficNet35ExtUseOut out
ip nat outside
!
...
!
interface Vlan3
description Test-Private-Network
ip address 172.25.0.2 255.255.0.0
ip access-group trafficNet172ExtUseIn in
ip access-group trafficNet172ExtUseOut out
ip nat inside
!
...
ip access-list extended trafficNet35ExtUseIn
permit udp host 0.0.0.0 host 255.255.255.255
permit ip x.x.35.0 0.0.0.255 x.x.35.0 0.0.0.255
permit tcp x.x.35.0 0.0.0.255 any eq 22 reflect trafficNet35ExtUse timeout 28800
permit ip x.x.35.0 0.0.0.255 any reflect trafficNet35ExtUse
deny ip any any log
ip access-list extended trafficNet35ExtUseOut
permit ip x.x.35.0 0.0.0.255 x.x.35.0 0.0.0.255
evaluate trafficNet35ExtUse
deny ip any any log
...
ip access-list extended trafficNet172ExtUseIn
permit udp host 0.0.0.0 host 255.255.255.255
permit ip 172.25.0.0 0.0.255.255 x.x.35.0 0.0.0.255
permit ip 172.25.0.0 0.0.255.255 172.25.0.0 0.0.255.255
permit tcp 172.25.0.0 0.0.255.255 any eq 22 reflect trafficNet172ExtUse timeout 28800
permit tcp 172.25.0.0 0.0.255.255 any reflect trafficNet172ExtUse
deny ip any any log
ip access-list extended trafficNet172ExtUseOut
permit ip x.x.35.0 0.0.0.255 172.25.0.0 0.0.255.255
permit ip 172.25.0.0 0.0.255.255 172.25.0.0 0.0.255.255
evaluate trafficNet172ExtUse
deny ip any any log

[balaji.bandi]

Can you post vlan 512 config (10.10.100.13 - since this is your default exit configured) - is this going to internet ? )

[lcac]

Yes, this goes to the internet, the configuration is :

!
interface Vlan512
ip address 10.10.100.14 255.255.255.252
ip verify unicast source reachable-via rx allow-default 101
!

...

access-list 101 deny ip any any log