04-15-2013 07:16 AM - edited 03-04-2019 07:36 PM
Hi All
I was wondering if anyone can shine some light on a natting problem I am having.
We recently aqquired a new outisde link and was assigned a block of IP addresses.
Point-to-point IP: 66.8.29.242/30
Point default route to 66.8.29.241/30
Allocated /28 subnet: 66.8.29.80/28
I am using a Cisco 2821 to terminate this link.
We usually do our termination and natting etc on our asa's, but I have no more spare interfaces on these devices.
My problem is I get the link up and running on the 2821 and receive internet breakout but I can not seem to get the natting correct.
I am trying to assign public IPs in the allocated subnet to some of our new servers that needs public access.
Here is the config for the interface:
interface GigabitEthernet0/0.302
description MTN Link
encapsulation dot1Q 302
ip address 66.8.29.242 255.255.255.252
ip access-group 15 in
ip nat outside
ip virtual-reassembly in
interface GigabitEthernet0/1
description MTN_Local_Link
ip address 172.16.1.120 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
I have done the following simple static nat configuration without success.
ip nat inside source list 10 interface Loopback1 overload
ip nat inside source list 15 interface GigabitEthernet0/0.302 overload
ip nat inside source list 20 interface Loopback2 overload
ip nat inside source static 172.16.1.59 66.8.29.80
ip nat inside source static 172.16.1.82 66.8.29.82
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0.302 66.8.29.241
ip route 172.16.3.0 255.255.255.0 172.16.1.199
ip route 172.16.5.0 255.255.255.0 172.16.1.199
!
logging esm config
access-list 10 permit any
access-list 15 permit any
access-list 20 permit any
The loopback interfaces I only used for testing purposes.
I made sure our server at 172.16.1.59 is using 172.16.1.120 as a default gateway.
I am still unable to ping 66.8.29.80 from the public side.
Any help or advice will truely be appreciated.
Thanks
Andre
04-15-2013 07:43 AM
Hi Andre,
Please create an ACL as shown below.
access-list 101 permit ip any host 66.8.29.80
access-list 101 permit ip any host 66.8.29.82
interface GigabitEthernet0/0.302
no ip access-group 15 in
ip access-group 101 in
Let me know, this helps.
thanks
Rizwan Rafeek
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide