cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
557
Views
0
Helpful
1
Replies

NAT help required

gouwsandre7
Level 1
Level 1

Hi All

I was wondering if anyone can shine some light on a natting problem I am having.

We recently aqquired a new outisde link and was assigned a block of IP addresses.

Point-to-point IP:   66.8.29.242/30

Point default route to  66.8.29.241/30

Allocated /28 subnet:  66.8.29.80/28

I am using a Cisco 2821 to terminate this link.

We usually do our termination and natting etc on our asa's, but I have no more spare interfaces on these devices.

My problem is I get the link up and running on the 2821 and receive internet breakout but I can not seem to get the natting correct.

I am trying to assign public IPs in the allocated subnet to some of our new servers that needs public access.

Here is the config for the interface:

interface GigabitEthernet0/0.302

description MTN Link

encapsulation dot1Q 302

ip address 66.8.29.242 255.255.255.252

ip access-group 15 in

ip nat outside

ip virtual-reassembly in

interface GigabitEthernet0/1

description MTN_Local_Link

ip address 172.16.1.120 255.255.255.0

ip nat inside

ip virtual-reassembly in

duplex auto

speed auto

I have done the following simple static nat configuration without success.

ip nat inside source list 10 interface Loopback1 overload

ip nat inside source list 15 interface GigabitEthernet0/0.302 overload

ip nat inside source list 20 interface Loopback2 overload

ip nat inside source static 172.16.1.59 66.8.29.80

ip nat inside source static 172.16.1.82 66.8.29.82

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0.302 66.8.29.241

ip route 172.16.3.0 255.255.255.0 172.16.1.199

ip route 172.16.5.0 255.255.255.0 172.16.1.199

!

logging esm config

access-list 10 permit any

access-list 15 permit any

access-list 20 permit any

The loopback interfaces I only used for testing purposes.

I made sure our server at 172.16.1.59 is using 172.16.1.120 as a default gateway.

I am still unable to ping 66.8.29.80 from the public side.

Any help or advice will truely be appreciated.

Thanks

Andre

1 Reply 1

rizwanr74
Level 7
Level 7

Hi Andre,

Please create an ACL as shown below.

access-list 101 permit ip any host 66.8.29.80

access-list 101 permit ip any host 66.8.29.82

interface GigabitEthernet0/0.302

no ip access-group 15 in

ip access-group 101 in

Let me know, this helps.

thanks

Rizwan Rafeek