Lose connectivity between branches when IP nat outside is enabled

[Jonathan Nali]

Hi Everyone,

I have a Cisco router 2911 at my branch office, the problem is as follow:

when I do "ip nat outside" on g0/0 I lose the connectivity between the branches but the branch office successfully gains internet access from HQ

but if I do "no ip nat outside" on g0/0, I gain connectivity between branches but the branche loses internet connectivity.

How do I resolve it?

!
ip dhcp relay information option
ip dhcp relay information trust-all
ip dhcp excluded-address 192.168.11.253
ip dhcp excluded-address 192.168.11.252
ip dhcp excluded-address 192.168.8.1 192.168.8.50
!
ip dhcp pool CAIR-POOL
network 192.168.8.0 255.255.255.0
default-router 192.168.8.3
dns-server 10.10.1.4
domain-name repro.local
!
!
!
no ip domain lookup
ip name-server 8.8.8.8
no ipv6 cef
multilink bundle-name authenticated
!
!
!
!
license udi pid CISCO2911/K9 sn FGL171911RN
!
!
!
!
!
!
!
!
interface Loopback0
ip address 2.2.2.2 255.255.255.255
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
description Internet
ip address 192.168.124.6 255.255.255.252
ip helper-address 192.168.124.6
ip directed-broadcast
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface GigabitEthernet0/1
ip dhcp relay information option-insert
ip address 192.168.8.3 255.255.255.0
ip helper-address 192.168.8.3
ip directed-broadcast
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
interface GigabitEthernet0/2
no ip address
shutdown
duplex auto
speed auto
!
ip forward-protocol nd
ip forward-protocol udp talk
!
no ip http server
no ip http secure-server
!
ip nat inside source list 111 interface GigabitEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 192.168.124.5
ip route 192.168.8.0 255.255.255.0 192.168.8.1
ip route 192.168.124.0 255.255.255.252 192.168.124.5
ip route 192.168.124.0 255.255.255.252 192.168.124.2 254
ip route 192.168.124.4 255.255.255.252 192.168.124.5
!
access-list 111 permit ip 192.168.8.0 0.0.0.255 any
!

[Jon Marshall · Accepted solution]

You don't say what your branch subnets are but try - 

access-list 111 deny ip 192.168.8.0 0.0.0.255 <branch subnet1> <wildcard mask> 

access-list 111 deny ip 192.168.8.0 0.0.0.255 <branch subnet2> <wildcard mask> 

etc. for each branch subnet

access-list 111 permit ip 192.168.8.0 0.0.0.255 any 

Jon

[Giuseppe Larosa · Accepted solution]

Hello @Jonathan Nali ,

as explained by Jon Marshall your extended ACL 111 used for NAT must first deny communication with branch subnets and then have a final permit .

In this way the router will understand that it should NAT only when going to the Internet as desired.

The same reasoning would apply if the branch subnets are reached via a VPN for example.

Hope to help

Giuseppe

[Jonathan Nali]

Hi @Giuseppe Larosa  and @Jon Marshall ,

I have read your replies but do not understand.

Should I leave my g0/0 interface on "ip nat outside"?

Also, what should I deny??

@Jon Marshall , To answer your question, my LAN only has one subnet which is /24, so do I deny only that one line??

[Jon Marshall]

Yes leave the "ip nat outside". 

Look at the example I have given ie. you need to add deny lines for the remote branch subnets whatever they are and then you need the permit at the end for your LAN to get to the internet as described by Giuseppe. 

I am not sure how to explain it any clearer. 

Jon

[Jonathan Nali]

Hi Jon,

This is what I have done according to your advice. Again, maybe I did not understand what you were saying but it didn't work

#sh access-lists
Extended IP access list 110
10 deny ip 192.168.8.0 0.0.0.255 any (597 matches)   (so you said I should first deny LAN access)
20 permit ip 192.168.8.0 0.0.0.255 any                         (Then I should permit it)
30 permit ip any any (201 matches)

Am I on track?

[Giuseppe Larosa]

Hello @Jonathan Nali ,

unfortunately your extended ACL is wrong as the first line prevents NAT to happen for whatever destination.

#sh access-lists
Extended IP access list 110
10 deny ip 192.168.8.0 0.0.0.255 any (597 matches) (so you said I should first deny LAN access)
20 permit ip 192.168.8.0 0.0.0.255 any (Then I should permit it)
30 permit ip any any (201 matches)

First list the IP subnets of the branch offices that you need to reach WITHOUT NAT

example 192.168.12.0/24

The logic for using an extended ACL with NAT is the following:

first you deny the traffic coming from internal LAN and destined to internal destinations that do not need NAT

Later you permit traffic coming from your local internal LAN to any = Internet and this means it will be NATTed

access-list 115 remark NAT example

access-list 115 deny ip 192.168.8.0 0.0.0.255 192.168.12.0 0.0.0.255

access-list 115 permit ip 192.168.8.0 0.0.0.255 any

the ip nat outside has to remain on your Internet facing interface. It is the ACL that has to provide the intelligence to perform a selective NAT.

Hope to help

Giuseppe

[Jonathan Nali]

Hi @Giuseppe Larosa ,

after reading your reply 100 times and rewatching ACL tutorials, I now understand what you are saying here:

"

In this way the router will understand that it should NAT only when going to the Internet as desired.

"

the problem is, I don't know what to deny. Can I deny they same network I am trying to permit?

Nali

[Georg Pauwen]

Hello,

what are the IP address ranges of your branches (e.g. 192.168.4.0/24) ?

[Jonathan Nali]

Hi @Georg Pauwen ,

My branch office is 192.168.8.0/24 and to reach my HQ packets have to go through 192.168.124.0/32 to reach our HQ on 10.10.1.0/24

I hope this makes sense.

[Giuseppe Larosa · Accepted solution]

Hello @Jonathan Nali ,

see the answer I have just provided to your ACL

You need to list the subnets of all branch ofices or at least find an aggregate like 192.168.0.0 0.0.255.255 to describe all of them

>> the problem is, I don't know what to deny. Can I deny they same network I am trying to permit?

in the NAT ACL the deny just means do not NAT traffic from local LAN to this destination it does not filter traffic like an ACL applied to an interface.

So yes you should deny all the networks that you want to reach without using NAT.

Hope to help

Giuseppe

[Jonathan Nali]

Hi @Giuseppe Larosa ,

One last question. On the same network I can now ping HQ from branch but I cannot ping from HQ to branch. So, do I put access-lists on the LAN side as well? I have tried this on the g0/1 (LAN) interface but not success. 

From HQ(10.10.1.0/24) I can ping only upto the LAN interface (192.168.8.3)

How do I fix this?

Nali

[Jonathan Nali]

Ok, I finally understood and got it right, thank you.

Add a deny statement to the other network and then the permit so that it only does NAT translations when going to the internet. 

Thank you again @Jon Marshall  and @Giuseppe Larosa 

Nali