Re: Need to configure NAT on c3745 router - Page 3

double-happiness · ‎05-13-2022

Topology: https://i.imgur.com/a1azOy0.jpg

R1#show run
Building configuration...

Current configuration : 1269 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
ip name-server 8.8.8.8
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
archive
log config
hidekeys
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
interface FastEthernet0/0
ip address 192.168.0.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 172.16.0.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet1/0
ip address 192.168.1.121 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 192.168.1.1
!
!
no ip http server
no ip http secure-server
ip nat inside source list 10 interface FastEthernet1/0 overload
!
access-list 10 permit 0.0.0.0
no cdp log mismatch duplex
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
!
!
end

Network config for the VM:

network:
version: 2
renderer: networkd
ethernets:
enp0s3:
addresses:
- 192.168.0.3/24
gateway4: 192.168.0.1
nameservers:
search: [mydomain, otherdomain]
addresses: [8.8.8.8, 8.8.4.4]

Wireshark capture: https://i.imgur.com/7zruy6a.jpg

Someone told me this on another forum yesterday:

> Does the "cloud" have a route back to 192.168.0.0/24? [...] If you didn't put it there, the answer is no. So that's your problem. The return traffic has no route to your VM.

I was reading https://networklessons.com/cisco/ccie-routing-switching/ip-nat-inside-source-vs-ip-nat-outside-source and wonder if I need to do...

R1(config)#ip nat inside source static 192.168.0.1 192.168.1.121
R1(config)#ip nat inside source static 172.16.0.1 192.168.1.121

Is that correct?

double-happiness · ‎05-14-2022

OK, well I added them back:

But I still have no luck with pings. If and only if I set the static route on the virtual router to 192.168.1.1, then the virtual router can get pings back from 8.8.8.8 and even google.com. But whatever I try, my VMs can never get any further than their respective default gateways. Firewall on or off, static route set to .1 or .11, it makes no difference. Traceroute never gets further than the VM's respective default gateway.

Flavio Miranda · ‎05-14-2022

Right.

I see three options.

1- add routes on 192.168.1.1 , probably not possible but, if possible fix the problem. Yoiu need to add the same static route you add on Windows machine.

2- Make sure you Windows machine is able to forward packets. Theres an option on the Config Register of Windows where you can enable routing.

3- use GNS3 virtual machine to run the cloud. Try to follow this vídeo

https://youtu.be/6TYk6NvjyL0

I will try to build the same lab, but not today. Tomorrow probably.

Dont give up. I did this in the past, can be done.

double-happiness · ‎05-14-2022

> 3- use GNS3 virtual machine to run the cloud.

Yes, I already do use the GNS3 virtual machine to run the cloud.

I found I had to do it that way, as that was the only way to get the `eth2` interface selectable. I'm not sure if I have a screenshot, but when you run it from the local machine you get totally different options like 'Ethernet 2', and doing it that way didn't work for me.

Flavio Miranda · ‎05-14-2022

I believe you are almost there. If i undertood right the gns3 vm, you are to get dhcp from you home router on the interface of the lab router. The vm act like a bridge

Instead put an IP address on the interface of lab router, keep it as dhcp.

Must be an option like

Interface gx

ip add dhcp

If that work, I can not see any reason to not work everything. Because then, you are getting everything from the home router. You do not rely on Windows machine anymore.

But, then you are going to need NAT.

Because, if the PC 172.16.x.x send a packet to home router, the home router does not know how to replay back. It does not know nothing inside you lab.

You need NAT to leave the LAB router with IP address 192.168.x.x

And now I understand your first question. Sorry for took so long.

On the interface inside the lab, you run:

ip nat inside

On the interface outside the lab(with dhcp)

ip nat outside

Then :

conf t

Router(config)#

ip nat inside source static 172.16.1.x 192.168.x.x

You need to use the same IP on the router outside interface.

After you get the ip address from home router dhcp, you can see it with

show ip int br

This NAT will allow only one lab machine access the internet, but we can improve that later

Sorry, I am using my cellphone, so lots of type errors.

Flavio Miranda · ‎05-16-2022

Hi there!

My Lab is up and running.

PC1> ping www.google.com
www.google.com resolved to 142.250.218.196
84 bytes from 142.250.218.196 icmp_seq=1 ttl=127 time=30.502 ms
84 bytes from 142.250.218.196 icmp_seq=2 ttl=127 time=32.565 ms
84 bytes from 142.250.218.196 icmp_seq=3 ttl=127 time=30.828 ms
84 bytes from 142.250.218.196 icmp_seq=4 ttl=127 time=25.879 ms
84 bytes from 142.250.218.196 icmp_seq=5 ttl=127 time=32.264 ms

PC1>

It was much more simple then what all we discussed. Let me know when you want to get back to it.

double-happiness · ‎05-17-2022

Hi Flavio,

great, thanks! I had to take a bit of time for other things, but I can come back to it when you are ready.

cheers

Flavio Miranda · ‎05-17-2022

Lets to this man!

We went through a lot here trying to make it works. I just want to recall what are exatly your goal. Is it to have a PC on the GNS3 connecting to the internet, that´s correct?

Well, if that´s the case, you actually need only a router a PC and instead Cloud you can use NAT node.

I will atach my project here so that you can try to use as example. I made it pretty simple just to make sure it works.

I have Vmware workstation installed on my machine and the VMnet8 is used by the NAT node in order to communicate with PC and Internet. No explicity NAT is necessary neither static routes.

double-happiness · ‎05-17-2022

> I just want to recall what are exatly your goal. Is it to have a PC on the GNS3 connecting to the internet, that´s correct?

Yes, exactly. Right now I can't even update or upgrade my GNS3 PCs, because they can't reach the web.

Actually, this is my coursework:

But as you can imagine, I can't even install a web server because `apt get install apache2' fails due to not reaching the web.

I just tried to open your file, but I got...

> The image c7200-adventerprisek9-mz.124-24.T5.image is missing

Edit: OK, I found an image for the router on the web. Proceeding to start things up and run some tests now.

Edit2: I realised I can't run that VM, because it doesn't exist in my environment. So I'm going to add a switch and a VM.

Edit3: I have a VM connected to my network and running now. I can ping 8.8.8.8 from the router just fine, but not by domain name, if that matters (possibly not).

Edit4: tried some pings from my VM now, but it seems there's still some problem, even with the firewall off.

Flavio Miranda · ‎05-17-2022

You can add the command "ip name-server 8.8.8.8" on router. Well, I recommend you to add to your topology a GNS3 VPC just to make sure everything is ok.

You can not add your machine on the router directly?

Did you add the router interface as gateway on machine?

can you share the command "route -n" or "netstat -r" on linux machine?

double-happiness · ‎05-17-2022

> You can add the command "ip name-server 8.8.8.8" on router.

Ah, right, TY.

> Well, I recommend you to add to your topology a GNS3 VPC just to make sure everything is ok.

I'm not really sure what you mean by that.

> You can not add your machine on the router directly?

Well, I guess I could, but surely that's only going to give me 5 connections? I honestly never do this. It's always [PC]---[switch]---[router]. Surely that's what my coursework asks, anyway? Aren't those two switches on either side of the router?

> Did you add the router interface as gateway on machine?

Yes.

> can you share the command "route -n" or "netstat -r" on linux machine?

double-happiness · ‎05-17-2022

2/ Do I need to remove these 172.16.0.0 & 192.168.0.0 routes that I added earlier? Edit: I removed them.

double-happiness · ‎05-17-2022

One thing that's very puzzling to me is that the GNS3 router can ping both 192.168.1.1 (my physical router) and 8.8.8.8, but that's all. It's like the GNS3 router is making direct contact with my physical router, and bypassing my machine, somehow.

Edit: this is also puzzling to me - I tried setting the static route 192.168.1.11 (my host machine) on my GNS3 router. I wasn't able to ping that IP, but I was still able to ping both 192.168.1.1 and 8.8.8.8. I'm surprised because judging by past experience I thought that might break the connection to 8.8.8.8.

Edit2: I'm really not clear what IP I am supposed to set the default gateway to? Is it the 'near-side' of the router 172.16.1.1, or the 'far side' 192.168.122.213? I think it's actually the 'far side', right?

Edit3: correction, I see I was right first time, it's the near side

> The default gateway is the IP address of the router interface to which the switch connects

https://www.ciscopress.com/articles/article.asp?p=2181836&seqNum=4

Edit4: an observation -

Whether I have the default gateway of the GNS3 router set to 192.168.1.1 OR 192.168.1.11 make no difference; I can never ping 192.168.1.11 from the GNS3 router.

Edit5: another observation - turning the firewall off means I can ping the physical machine, so I put that back to default gateway.

Flavio Miranda · ‎05-17-2022

But, with this new approach with NAT note, I can ping both my gateway, my physical machine and google as well from my GNS3 router.Which means, I have full connectivity from my lab with the rest of the world.

You problem seems to me now with you VM.

As per the "route -n" command, seems to me that the router is OK as gateway. Did you try to add a GNS3 VPC just to make sure all is OK?

double-happiness · ‎05-17-2022

> Did you try to add a GNS3 VPC just to make sure all is OK?

I didn't understand what you meant by that before because I'm not familiar with that. I added one now, but all I know so far is it can't ping 8.8.8.8. Any ideas what I could try with it?

Edit: I'm trying to set its IP and default gateway, but not sure how to do it so far.

Edit2: OK, IP and DFG set, but no 8888 pings coming back

Flavio Miranda · ‎05-17-2022

"One thing that's very puzzling to me is that the GNS3 router can ping both 192.168.1.1 (my physical router) and 8.8.8.8, but that's all. It's like the GNS3 router is making direct contact with my physical router, and bypassing my machine, somehow."

But that´s the idea with NAT node. My GNS3 router do the same.

In this new scenario, your GNS3 router have access to everything. So, the chanllenge here is make you VM communicate as well.

Did you add a GNS3 VPC on the router, just like me, just to make sure it communicate?