Migrating the configuration

[haa]

hi everyone, 

I m changing a PFSense router with a Cisco. And I m bit stuck with the configuration ( the NAT rules ).

In the attachements you'll find the Pfsense NAT configuration table with the ACL used for that.

Please help me translate it to CISCO ios, at least one rule.

(especially how to translate a range of ports using NAT to another range )

Thank you ! 

[Spooster IT Services]

Hi,

Please try the following examples as per your requirement:

For specific port redirection you can use the following command,

ip nat inside source static tcp 192.168.0.240 80 <WAN IP> 80 extendable

For range of port redirection you can use the following example:

ip nat pool POOL1 192.168.0.240 192.168.0.240 netmask 255.255.255.0 type rotary
!
access-list 101 permit tcp any <WAN IP> range 4505 4530
!
ip nat inside destination list 101 pool POOL1
!

interface <WAN>
 ip nat outside
!
interface <LAN>
 ip nat inside
!

If this was helpful, please give it a thumbs up

[haa]

Thank you for ur support and help, so here s what sh running-config shows: 

ip name-server 195.238
ip name-server 195.238
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
license udi pid C881-K9
!
interface FastEthernet0
switchport access vlan 200
no ip address
no cdp enable
!
interface FastEthernet1
switchport access vlan 300
no ip address
no cdp enable
!
interface FastEthernet2
no ip address
shutdown
no cdp enable
!
interface FastEthernet3
no ip address
shutdown
no cdp enable
!
interface FastEthernet4
description WAN
ip address 172.16.1.254 255.255.255.0
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
no cdp enable
!
interface Vlan1
ip address 192.168.1.1 255.255.255.0
!
interface Vlan200
description LAN
ip address 192.168.0.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Vlan300
description VOIP
ip address 10.10.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip nat pool POOL1 192.168.0.240 192.168.0.240 netmask 255.255.255.0 type rotary
ip nat pool POOL2 10.10.10.200 10.10.10.200 netmask 255.255.255.0 type rotary
ip nat inside source static tcp 192.168.0.240 80 172.16.1.254 80 extendable
ip nat inside source static tcp 192.168.0.2 3389 172.16.1.254 3390 extendable
ip nat inside source static tcp 192.168.0.3 3389 172.16.1.254 3392 extendable
ip nat inside source static tcp 192.168.0.5 3389 172.16.1.254 3399 extendable
ip nat inside destination list 101 pool POOL1
ip nat inside destination list 102 pool POOL2
ip nat inside destination list 103 pool POOL2
!
no service-routing capabilities-manager
no cdp run
!
access-list 101 permit tcp any 172.10.1.0 0.0.0.255 range 4505 4530
access-list 102 permit tcp any 172.10.1.0 0.0.0.255 range 5060 5061
access-list 102 permit udp any 172.10.1.0 0.0.0.255 range 5060 5061
access-list 103 permit udp any 172.10.1.0 0.0.0.255 range 10000 10100
!
control-plane
!
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
line con 0
exec-timeout 0 0
no modem enable
line aux 0
line vty 0 4
password 
login
transport input all
!
scheduler allocate 20000 1000
!
end

the BIZARRE thing that i get is when i type SHOW IP ROUTE i only got one route configured and not the other :

CMA#sh ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
a - application route
+ - replicated route, % - next hop override

Gateway of last resort is not set

192.168.0.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.0.0/24 is directly connected, Vlan200
L 192.168.0.254/32 is directly connected, Vlan200

[Spooster IT Services]

Hi,

How many cables have you connected on the router and on which port of the router?

Also there is no default route existing on the router pointing towards internet.

Can you please send me the output of the following commands:

show vlan-switch

show ip int brief

[haa]

How can i add a default  route ?

CMA#sh vlan-switch

VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa2, Fa3
200 VLAN0200 active Fa0
300 VLAN0300 active Fa1
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1 enet 100001 1500 - - - - - 1002 1003
200 enet 100200 1500 - - - - - 0 0
300 enet 100300 1500 - - - - - 0 0
1002 fddi 101002 1500 - - - - - 1 1003
1003 tr 101003 1500 1005 0 - - srb 1 1002
1004 fdnet 101004 1500 - - 1 ibm - 0 0
1005 trnet 101005 1500 - - 1 ibm - 0 0
CMA#sh ip int brief
Any interface listed with OK? value "NO" does not have a valid configuration

Interface IP-Address OK? Method Status Protocol
FastEthernet0 unassigned YES unset up up
FastEthernet1 unassigned YES unset up down
FastEthernet2 unassigned YES unset administratively down down
FastEthernet3 unassigned YES unset administratively down down
FastEthernet4 172.16.1.254 YES NVRAM down down
NVI0 unassigned NO unset up up
Vlan1 192.168.1.1 YES NVRAM down down
Vlan200 192.168.0.254 YES manual up up
Vlan300 10.10.10.1 YES manual down down

[Spooster IT Services]

Hi,

FastEthernet1 unassigned YES unset up down 

Please check the cable connected to port 1

Other two ports Port 2 and Port 3 are administratively down.

Do the following steps

conf t

Interface FastEthernet2
no shutdown

interface FastEthernet3
no shutdown

[haa]

Thanks a lot !

please what about the default routing ? 

[Spooster IT Services · Accepted solution]

You WAN link is also in down state 

FastEthernet4 172.16.1.254 YES NVRAM down down

Check the cable connected to that port also.

and Default route will be something like that

conf t

ip route 0.0.0.0 0.0.0.0 172.16.1.x <ISP end router IP>