SRP527 multiple LAN subnets routing

[simonw_cisco]

Hello.

I have a SRP527 (V03/1.01.26) that is connected to a class C network on Port 4, LAN interface (192.168.1.8/24) (see network representation below).  1 hop away through router A is a subnet (172.17.0.0/24) where the clients reside. 

Problem: Client A cannot reach Internet.

Observations:

• Client A has default route to Router A (172.17.0.1). 
• Router A has default route to SRP527 (192.168.1.8).
• Client A can ping Client B & SRP527
• Client B can ping Internet hosts OK
• Client A cannot ping Internet hosts
• SRP527 has static route to 172.18.0.0/24 - which is obviously working as Client A can ping SRP527.

It feels like the NAT policy rule is not matching inbound traffic from remote subnet on trusted LAN port 4.  Whatever it is, the result is that Clients on the 172.17.0.0/24 network have no internet access.

I don't want to connect the SRP527 directly to the 172.17.0.0/24 network.

I would appreciate any suggestions or help.

Client A

    |  172.17.0.10/24

    |

----+---- 172.17.0.0/24 ----+

                              |

                              |  172.17.0.1/24

                    ROUTER A 

                              | 192.168.1.1/24

                              |

          Client B -------+

         192.168.1.10  |

                              +--------- 192.168.1.0/24 ------+

                                                                       |

                                                                       |  192.168.1.8/24

                                                                 SRP527

                                                                       |

                                                                { Internet }

[Xiaojing Li]

There is one possibility that your NAT is not done for 172.17.0.0/24.

Solution: 1. you add NAT at router A which means 172.17.0.0/24 will translate to 192.168.1.1

              2. add NAT sourse range 172.17.0.0/24 into SRP527.

Hope it helps

[simonw_cisco]

Thanks for your reply.

Router A doesn't provide NAT.

I don't see how to add a NAT source range to the SRP527.  I'm assuming that the SRP527 is only allowing a NAT source range of the defined LAN subnet which is local to it's LAN interface (in my case 192.168.1.0/24)

[Matto-FNQ]

Hi there,

We have the exact same network layout, and I'm experiencing the exact same issue with the 527 we have here. I've been through the web admin interface, but can find no way to add an additional NAT source range.

We are unable to have our Router A perform NAT. It's not something we would want to do even if we could.

Simon - did you ever get a resolution for this?

Xiaojing Li - can you elaborate on how I can add an additional NAT source range on a 527 please?

Thanks for your help,

Matto

[simonw_cisco]

Hi Matt,

Sorry - we haven't received any feedback through this forum that would be helpful.  I am waiting on our reseller to come back with something and will return the unit if no resolution.  I class this problem as a bug that unfortunately renders the unit inoperable in an SMB situation.

Sorry I can't help.

[Matto-FNQ]

Hi Simon,

Thanks for writing back.

That's a shame. Looks like we might end up having to upgrade to a "proper" cisco router then. I didn't want to have to do that, since we'll be deploying over 30 of them - every dollar saved helps. Still, if the 527 won't do what we want, then it won't do what we want!

Cheers!

Matto