port forwarding on a Cisco 2951

[roncro]

Hello,

I am doing port forwarding on two ports, used to have a Cisco 2911 and have a Cisco 2951 now.

I wonder if I forgot to configure something, it used to be working (and of course the dynamic IP changed when switching routers.)

What I remember doing was this:

ip nat inside source static tcp 192.168.2.8 80 interface GigabitEthernet0/0 80

ip nat inside source static tcp 192.168.2.8 22 interface GigabitEthernet0/0 22

to forward ports 80 and 22.

Is there a setting that I forgot?  (I thought these two rules were enough for port forwarding?)

thanks,

Ron

[Georg Pauwen]

Hello,

what is not working ? The translation rules you have should be sufficient. Otherwise, try domain-less NAT. Instead of 'ip nat inside' and 'ip nat outside' use 'ip nat enable' on both inside and outside interfaces, and change the static NAT entries to:

ip nat source static tcp 192.168.2.8 80 interface GigabitEthernet0/0 80

ip nat source static tcp 192.168.2.8 22 interface GigabitEthernet0/0 22

[roncro]

Hello Georg,

I just tried to remove that original line like so:

Charon-2951#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Charon-2951(config)#no ip nat inside source static tcp 192.168.2.8 80 interface GigabitEthernet0/0 80
%Static entry in use, cannot remove

same for port forwarding on port 22

Ron

Ron

[roncro]

Hello Georg,

I finally managed to  change what you suggested, but that didn't seem to work.

So I switched back from the 2951 to the 2911 router.  and there it works. However what is a little disturbing is that when I  used the 2911 router again,  I did get my ld IP address back. With the Cisco 2951 router, the IP address I get with DHCP is completely different.

(They are both comcast addresses, but I have no id why different routers, using the same cable modem, would do that.)

I am using the original port forwarding addresses on the 2911 ..  and those work.

Ron

[balaji.bandi]

Since NAT in use you can not remove entry

try below steps :

config t

!

#do clear ip nat translation *

#no  ip nat inside source static tcp 192.168.2.8 80 interface GigabitEthernet0/0 80

if not working you need to other option : (make sure you have access to device, not from NAT IP - console)

-  Remove the ip nat inside/ip nat outside command from the interface. Removing either one of them will do the trick.

- Now issue the command clear ip nat translation *

-  command no ip nat inside source static tcp 192.168.2.8 80 interface GigabitEthernet0/0 80

[roncro]

that worked, but was not able to resolve the problem.

Ron

[Georg Pauwen]

Hello,

odd, as in theory, it should not make a difference whether you use a different router. Can you post the full running configs of both routers ?

[roncro]

Hello Georg,

yes, very odd indeed.  I figured, since the modem (a Cisco DPC3008) is used in both situations, I'd assume the IP address would stay the same. Actually,  That IP address was even the same when I switched from a small business router to the 2911 a good while ago.

Below is the running config for the Cisco 2951, and the one of the 2911 following that.

Charon-2951#show run
Building configuration...

Current configuration : 7983 bytes
!
! Last configuration change at 14:00:16 MDT Tue Oct 20 2020 by admin
! NVRAM config last updated at 14:04:58 MDT Tue Oct 20 2020 by admin
! NVRAM config last updated at 14:04:58 MDT Tue Oct 20 2020 by admin
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Charon-2951
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
!
no aaa new-model
clock timezone MST -7 0
clock summer-time MDT recurring
!
no ipv6 cef
ip source-route
ip cef
!
!
!
no ip dhcp conflict logging
ip dhcp excluded-address 192.168.1.1 192.168.1.10
ip dhcp excluded-address 192.168.2.1 192.168.2.10
ip dhcp excluded-address 192.168.4.1 192.168.4.10
ip dhcp excluded-address 192.168.5.1 192.168.5.10
ip dhcp excluded-address 192.168.6.1 192.168.6.10
ip dhcp excluded-address 192.168.7.1 192.168.7.10
ip dhcp excluded-address 192.168.3.1 192.168.3.10
ip dhcp excluded-address 192.168.8.1 192.168.8.10
ip dhcp ping timeout 600
!
ip dhcp pool VLAN1-POOL
import all
origin file tftp://192.168.2.8/dhcp/static-bindings-hw-1
default-router 192.168.1.1
dns-server 192.168.1.1
domain-name localdomain
option 42 ip 192.168.1.1
!
ip dhcp pool VLAN4-DCH-S150
import all
origin file tftp://192.168.2.8/dhcp/static-bindings-hw-4
dns-server 192.168.1.1
domain-name localdomain
default-router 192.168.4.1
option 42 ip 192.168.1.1
!
ip dhcp pool VLAN5-WEMO-POOL
import all
origin file tftp://192.168.2.8/dhcp/static-bindings-hw-5
dns-server 192.168.1.1
domain-name localdomain
default-router 192.168.5.1
option 42 ip 192.168.1.1
!
ip dhcp pool VLAN6-TONTON-POOL
import all
origin file tftp://192.168.2.8/dhcp/static-bindings-hw-6
dns-server 192.168.1.1
domain-name localdomain
default-router 192.168.6.1
option 42 ip 192.168.1.1
!
ip dhcp pool VLAN2-SERVERS
import all
origin file tftp://192.168.2.8/dhcp/static-bindings-hw-2
default-router 192.168.2.1
dns-server 192.168.1.1
domain-name localdomain
option 42 ip 192.168.1.1
!
ip dhcp pool VLAN3-DEVICES-POOL
import all
origin file tftp://192.168.2.8/dhcp/static-bindings-hw-3
default-router 192.168.3.1
dns-server 192.168.1.1
domain-name localdomain
option 42 ip 192.168.1.1
!
ip dhcp pool VLAN7-THE-MATRIX-POOL
import all
origin file tftp://192.168.2.8/dhcp/static-bindings-hw-7
dns-server 192.168.1.1
domain-name localdomain
default-router 192.168.7.1
option 42 ip 192.168.1.1
!
ip dhcp pool VLAN8-SEISMO
import all
origin file tftp://192.168.2.8/dhcp/static-bindings-hw-8
dns-server 192.168.1.1
domain-name localdomain
default-router 192.168.8.1
option 42 ip 192.168.1.1
!
!
ip domain name localdomain
ip host trotter68.localdomain 192.168.1.110
ip host seismo.localdomain 192.168.8.84
ip host zoneminder.localdomain 192.168.2.8
ip host f007th.localdomain 192.168.3.163
ip host charon.localdomain 192.168.1.1
ip host trotter67.localdomain 192.168.1.109
ip host cuda.localdomain 192.168.2.116
ip host AP-TM-W-F7C033.localdomain 192.168.1.5
ip host C2960s-north.localdomain 192.168.1.2
ip host C2960s-south.localdomain 192.168.1.3
ip host waves.localdomain 192.168.2.117
ip host wemo.localdomain 192.168.7.37
ip host picoscope.localdomain 192.168.2.37
ip host cisco-ap2.localdomain 192.168.37.12
ip host wintrotter.localdomain 192.168.1.106
ip host picopod.localdomain 192.168.1.107
ip host cisco-ap7.localdomain 192.168.37.17
ip host cisco-ap8.localdomain 192.168.37.18
ip host north.localdomain 192.168.1.2
ip host cisco-ap1.localdomain 192.168.37.11
ip host cisco-ap9.localdomain 192.168.37.19
ip host cisco-ap5.localdomain 192.168.37.15
ip host south.localdomain 192.168.1.3
ip host cisco-ap6.localdomain 192.168.37.16
ip host cnc.localdomain 192.168.2.115
ip host cisco-ap-seismo.localdomain 192.168.37.20
ip name-server 75.75.75.75
ip name-server 75.75.76.76
multilink bundle-name authenticated
!
!
!
!
!
crypto pki token default removal timeout 0
!
!
voice-card 0
!
!
!
!
!
!
!
license udi pid CISCO2951/K9 sn FCZ1622702R
hw-module pvdm 0/0
!
hw-module pvdm 0/1
!
!
!
username admin privilege 15 password 7 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
!
redundancy
!
!
!
!
!
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
description WAN
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface GigabitEthernet0/1
description LAN
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/1.1
encapsulation dot1Q 1 native
ip address 192.168.1.1 255.255.255.0
ip helper-address 192.168.2.255
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/1.2
encapsulation dot1Q 2
ip address 192.168.2.1 255.255.255.0
ip helper-address 192.168.1.1
ip directed-broadcast
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/1.3
encapsulation dot1Q 3
ip address 192.168.3.1 255.255.255.0
ip helper-address 192.168.1.1
ip directed-broadcast
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/1.4
encapsulation dot1Q 4
ip address 192.168.4.1 255.255.255.0
ip helper-address 192.168.1.1
ip directed-broadcast
!
interface GigabitEthernet0/1.5
encapsulation dot1Q 5
ip address 192.168.5.1 255.255.255.0
ip helper-address 192.168.1.1
ip directed-broadcast
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/1.6
encapsulation dot1Q 6
ip address 192.168.6.1 255.255.255.0
ip helper-address 192.168.1.1
ip directed-broadcast
!
interface GigabitEthernet0/1.7
encapsulation dot1Q 7
ip address 192.168.7.1 255.255.255.0
ip helper-address 192.168.1.1
ip directed-broadcast
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/1.8
encapsulation dot1Q 8
ip address 192.168.8.1 255.255.255.0
ip helper-address 192.168.1.1
ip directed-broadcast
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/1.37
encapsulation dot1Q 37
ip address 192.168.37.1 255.255.255.0
!
interface GigabitEthernet0/1.66
encapsulation dot1Q 66
ip address 192.168.66.131 255.255.255.128
!
interface GigabitEthernet0/2
no ip address
shutdown
duplex auto
speed auto
!
ip forward-protocol nd
ip forward-protocol udp discard
!
ip http server
ip http authentication local
ip http secure-server
!
ip dns view default
domain list localdomain
ip dns server
ip nat inside source list 101 interface GigabitEthernet0/0 overload
ip nat inside source list 102 interface GigabitEthernet0/0 overload
ip nat inside source list 103 interface GigabitEthernet0/0 overload
ip nat inside source list 105 interface GigabitEthernet0/0 overload
ip nat inside source list 107 interface GigabitEthernet0/0 overload
ip nat inside source list 108 interface GigabitEthernet0/0 overload
ip nat inside source static tcp 192.168.2.8 22 interface GigabitEthernet0/0 22
ip nat inside source static tcp 192.168.2.8 80 interface GigabitEthernet0/0 80
ip route 192.168.66.0 255.255.255.128 192.168.1.110
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 dhcp
!
access-list 101 permit ip 192.168.1.0 0.0.0.255 any
access-list 102 permit ip 192.168.2.0 0.0.0.255 any
access-list 103 permit ip host 192.168.3.164 any
access-list 105 permit ip host 192.168.5.237 any
access-list 107 permit ip 192.168.7.0 0.0.0.255 any
access-list 108 permit ip 192.168.8.0 0.0.0.255 any
!
nls resp-timeout 1
cpd cr-id 1
!
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
!
gatekeeper
shutdown
!
!
!
line con 0
transport preferred none
line aux 0
transport preferred none
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
password 7 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
login local
transport preferred none
transport input ssh
line vty 5 15
login local
transport preferred none
transport input ssh
!
scheduler allocate 20000 1000
ntp master
ntp update-calendar
ntp server time.nist.gov
end

Cisco 2911:

Charon#show run
Building configuration...

Current configuration : 7940 bytes
!
! No configuration change since last restart
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Charon
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
!
no aaa new-model
clock timezone MST -7 0
clock summer-time MDT recurring
!
!
!
!
!
!
!
!
!
!
!
no ip dhcp conflict logging
ip dhcp excluded-address 192.168.1.1 192.168.1.10
ip dhcp excluded-address 192.168.2.1 192.168.2.10
ip dhcp excluded-address 192.168.4.1 192.168.4.10
ip dhcp excluded-address 192.168.5.1 192.168.5.10
ip dhcp excluded-address 192.168.6.1 192.168.6.10
ip dhcp excluded-address 192.168.7.1 192.168.7.10
ip dhcp excluded-address 192.168.3.1 192.168.3.10
ip dhcp excluded-address 192.168.8.1 192.168.8.10
ip dhcp ping timeout 600
!
ip dhcp pool VLAN1-POOL
import all
origin file tftp://192.168.2.8/dhcp/static-bindings-hw-1
default-router 192.168.1.1
dns-server 192.168.1.1
domain-name localdomain
option 42 ip 192.168.1.1
!
ip dhcp pool VLAN4-DCH-S150
import all
origin file tftp://192.168.2.8/dhcp/static-bindings-hw-4
dns-server 192.168.1.1
domain-name localdomain
default-router 192.168.4.1
option 42 ip 192.168.1.1
!
ip dhcp pool VLAN5-WEMO-POOL
import all
origin file tftp://192.168.2.8/dhcp/static-bindings-hw-5
dns-server 192.168.1.1
domain-name localdomain
default-router 192.168.5.1
option 42 ip 192.168.1.1
!
ip dhcp pool VLAN6-TONTON-POOL
import all
origin file tftp://192.168.2.8/dhcp/static-bindings-hw-6
dns-server 192.168.1.1
domain-name localdomain
default-router 192.168.6.1
option 42 ip 192.168.1.1
!
ip dhcp pool VLAN2-SERVERS
import all
origin file tftp://192.168.2.8/dhcp/static-bindings-hw-2
default-router 192.168.2.1
dns-server 192.168.1.1
domain-name localdomain
option 42 ip 192.168.1.1
!
ip dhcp pool VLAN3-DEVICES-POOL
import all
origin file tftp://192.168.2.8/dhcp/static-bindings-hw-3
default-router 192.168.3.1
dns-server 192.168.1.1
domain-name localdomain
option 42 ip 192.168.1.1
!
ip dhcp pool VLAN7-THE-MATRIX-POOL
import all
origin file tftp://192.168.2.8/dhcp/static-bindings-hw-7
dns-server 192.168.1.1
domain-name localdomain
default-router 192.168.7.1
option 42 ip 192.168.1.1
!
ip dhcp pool VLAN8-SEISMO
import all
origin file tftp://192.168.2.8/dhcp/static-bindings-hw-8
dns-server 192.168.1.1
domain-name localdomain
default-router 192.168.8.1
option 42 ip 192.168.1.1
!
!
!
ip domain name localdomain
ip host trotter68.localdomain 192.168.1.110
ip host seismo.localdomain 192.168.8.84
ip host zoneminder.localdomain 192.168.2.8
ip host f007th.localdomain 192.168.3.163
ip host charon.localdomain 192.168.1.1
ip host trotter67.localdomain 192.168.1.109
ip host cuda.localdomain 192.168.2.116
ip host AP-TM-W-F7C033.localdomain 192.168.1.5
ip host C2960s-north.localdomain 192.168.1.2
ip host C2960s-south.localdomain 192.168.1.3
ip host waves.localdomain 192.168.2.117
ip host wemo.localdomain 192.168.7.37
ip host Samsung-HDTV.localdomain 192.168.3.3
ip host picoscope.localdomain 192.168.2.37
ip host cisco-ap2.localdomain 192.168.37.12
ip host wintrotter.localdomain 192.168.1.106
ip host picopod.localdomain 192.168.1.107
ip host cisco-ap7.localdomain 192.168.37.17
ip host cisco-ap8.localdomain 192.168.37.18
ip host north.localdomain 192.168.1.2
ip host cisco-ap1.localdomain 192.168.37.11
ip host cisco-ap9.localdomain 192.168.37.19
ip host cisco-ap5.localdomain 192.168.37.15
ip host south.localdomain 192.168.1.3
ip host cisco-ap6.localdomain 192.168.37.16
ip host cnc.localdomain 192.168.2.115
ip host cisco-ap-seismo.localdomain 192.168.37.20
ip host cisco-ap4.localdomain 192.168.37.14
ip name-server 75.75.75.75
ip name-server 75.75.76.76
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
cts logging verbose
!
!
license udi pid CISCO2911/K9 sn FCZ192771UU
!
!
username admin privilege 15 password 7 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
username wwwadmin privilege 15 password 7 XXXXXXXXXXXXXXXXXXXXXXXXXX
!
redundancy
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
description WAN
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface GigabitEthernet0/1
description LAN
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/1.1
encapsulation dot1Q 1 native
ip address 192.168.1.1 255.255.255.0
ip helper-address 192.168.2.255
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/1.2
encapsulation dot1Q 2
ip address 192.168.2.1 255.255.255.0
ip helper-address 192.168.1.1
ip directed-broadcast
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/1.3
encapsulation dot1Q 3
ip address 192.168.3.1 255.255.255.0
ip helper-address 192.168.1.1
ip directed-broadcast
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/1.4
encapsulation dot1Q 4
ip address 192.168.4.1 255.255.255.0
ip helper-address 192.168.1.1
ip directed-broadcast
!
interface GigabitEthernet0/1.5
encapsulation dot1Q 5
ip address 192.168.5.1 255.255.255.0
ip helper-address 192.168.1.1
ip directed-broadcast
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/1.6
encapsulation dot1Q 6
ip address 192.168.6.1 255.255.255.0
ip helper-address 192.168.1.1
ip directed-broadcast
!
interface GigabitEthernet0/1.7
encapsulation dot1Q 7
ip address 192.168.7.1 255.255.255.0
ip helper-address 192.168.1.1
ip directed-broadcast
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/1.8
encapsulation dot1Q 8
ip address 192.168.8.1 255.255.255.0
ip helper-address 192.168.1.1
ip directed-broadcast
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/1.37
encapsulation dot1Q 37
ip address 192.168.37.1 255.255.255.0
!
interface GigabitEthernet0/1.66
encapsulation dot1Q 66
ip address 192.168.66.131 255.255.255.128
!
interface GigabitEthernet0/2
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0/1/0
no ip address
!
interface GigabitEthernet0/1/1
no ip address
!
interface GigabitEthernet0/1/2
no ip address
!
interface GigabitEthernet0/1/3
no ip address
!
interface Vlan1
no ip address
!
ip forward-protocol nd
ip forward-protocol udp discard
!
ip http server
ip http authentication local
ip http secure-server
!
ip dns view default
domain list localdomain
ip dns server
ip nat inside source list 101 interface GigabitEthernet0/0 overload
ip nat inside source list 102 interface GigabitEthernet0/0 overload
ip nat inside source list 103 interface GigabitEthernet0/0 overload
ip nat inside source list 105 interface GigabitEthernet0/0 overload
ip nat inside source list 107 interface GigabitEthernet0/0 overload
ip nat inside source static tcp 192.168.2.8 80 interface GigabitEthernet0/0 80
ip nat inside source list 108 interface GigabitEthernet0/0 overload
ip nat inside source static tcp 192.168.2.8 22 interface GigabitEthernet0/0 22
ip route 192.168.66.0 255.255.255.128 192.168.1.110
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 dhcp
!
!
!
access-list 101 permit ip 192.168.1.0 0.0.0.255 any
access-list 102 permit ip 192.168.2.0 0.0.0.255 any
access-list 103 permit ip host 192.168.3.164 any
access-list 105 permit ip host 192.168.5.237 any
access-list 107 permit ip 192.168.7.0 0.0.0.255 any
access-list 108 permit ip 192.168.8.0 0.0.0.255 any
!
control-plane
!
!
!
line con 0
logging synchronous
login local
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
password 7 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
login local
transport input ssh
line vty 5 392
password 7 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
login local
transport input ssh
!
scheduler allocate 20000 1000
ntp master
ntp update-calendar
ntp server time.nist.gov
!
end

[paul driver]

Hello
yes, very odd indeed.  I figured, since the modem (a Cisco DPC3008) is used in both situations, I'd assume the IP address would stay the same. Actually,  That IP address was even the same when I switched from a small business router to the 2911 a good while ago.

If you think about it it isn't that odd, The rtrs have different interface mac-addresses as such the comcast see's the 2951 as a different device which it is.

Try spoofing the comcast by giving the 2951 the 2911 mac-address then such it should receive its old wan ip from the comcast.

[roncro]

Hi Paul,

I think that would be true if the router was directly connected, but there's a modem inbetween with it's own mac addr? and I didn't change thr modem.   Unless the modem is forwarding the DHCP request from the router to comcast equipment.

Would be fun to try though,  (How can I set the MAC addr for the GigabitEthernet0/0 interface?).  Also, since I want to keep the 2911 as a spare, might be convenient to both of them have the same MAC for GigabitEthernet0/0.

After I checked both configs,  I connected the 2951 again and yet got anothe IP address, and that one just seemed to work with the port forwarding. I wonder now, if maybe I was assigned the wrong IP fr some reason (the first new IP that dddn't work, is still out there and alive).

thanks,

Ron

[roncro]

Hi Paul,

I figured out how to change the MAC address on the 2951 so it is the same as on the 2911, and that indeed resulted in the "old" IP address being assigned again.

thanks,

Ron

[paul driver · Accepted solution]

Hello
Glad it worked for you -
ISPs can tie down your internet connection to the mac-address of your rtr/switch/host etc, so if it recognizes the mac address it would in most case reassign the same ip address - as you have discovered.

[roncro]

Hi Paul,

I was just surprised that it isn't the modem's MAC address that get's the IP address, but actually the router behind it..

Also, the port forarding  seemed to be just working, I think there was an issue with the 2nd IP address I received with DHCP.

again thanks,

Ron