I cannot ping after NAT Configuration

[HeroVax]

Hello, I have issues about NAT configuration that does not allow my KL Router's PCs ping to Penang Router's PCs.

Initially, my plan was to create NAT for Server Farm client.

15.0.6.2 translates to 130.10.0.2

I have configured my KL Router as follows:

interface GigabitEthernet0/0/0.80

ip nat inside

interface Serial 0/1/0

ip nat outside

ip nat pool NATPOOL 130.10.0.3 130.10.255.254 netmask 255.255.0.0
ip nat inside source list 1 pool NATPOOL
ip nat inside source static 15.0.6.3 130.10.0.3
ip nat inside source static 15.0.6.4 130.10.0.4
ip nat inside source static 15.0.6.5 130.10.0.5
ip nat inside source static 15.0.6.2 130.10.0.2

access-list 1 permit 15.0.6.0 0.0.0.7

Penang Router's PC Security: 

KL Router's PC Server Farm:

 

Results: Penang Router's PC can ping to KL Router's Server Farm (15.0.6.2), and it successfully translates to 130.10.0.2. However, Server Farm cannot ping to other PCs outside of KL Router as a result. I honestly do not know what's the issue with my configurations. I have attached my pkt file below for reference.

Thanks.

[Flavio Miranda]

Hi

 Your file does not allow to see the config...neither change. So it is useless to attach the file.

But, if you are doing NAT from 15.0.0.0 to  130.10.0.0 then you need add route on the router for this network.

On router Penang you need to add this:

ip route 130.0.0.0 255.0.0.0.0 15.0.6.9

[HeroVax]

Hello @Flavio Miranda ,

The file attached is a pkt file (inside a zip file). I already tested it, and you can open it via Cisco Packet Tracer. Also, I have done all the OSPF Configurations so if I didn't configure the NAT, all PCs can ping to each other.

I noticed that, once I configure the interface serial 0/1/0 as "ip nat outside", then the Server Farm will not able to ping anymore.

[Flavio Miranda · Accepted solution]

Must be some bug or different version. I can not see the config. But, it is ok.

When you configure "ip nat outside" you are changing the PCs IP address from 15.x.x.x to 130.x.x.x.  Which means, the IP address that will arrive to the outiside is different and your routers, need to know to to reply.

For example. If you run:

show ip route 130.0.0.0 on router Penang or ISP, do they have this route? They probably not. So, you need to tell then how can they reach the network 130.0.0.0, otherwise, they will drop the packet.

[HeroVax]

Hello @Flavio Miranda ,

Oh my goodness, thank you so much for your help. I'm still learning about NAT and very glad I learned something new today. It makes sense now. The translated IP wasn't advertised. I thought, the router would automatically know the translated IP from their old 15.0.6.0 address. But I guess not.

So, I have configure the static route and it works well now. I always wanted to use OSPF configuration to be able to capture 130.10.0.0 but it doesn't work. Anyways, I'll just stick with static route.

[Flavio Miranda]

You are doing great.  It is possible to advertise the Natted ip address to other routers. You just need to search a little bit more. Here in the community you can find a solution:

Examle:

https://community.cisco.com/t5/routing/how-to-advertise-a-nat-pool-into-ospf/td-p/484531