Solved: NAT Issue

Vikrant Ambhore · ‎12-23-2010

Hello All Experts,

We have Cisco 877 w router, I plugged Polycom video Conferencing unit into Cisco, & gave Static IP 10.10.10.2, I am able to access this unit on browser by http://10.10.10.2, we have Public Ip address 203.X.X.X as soon someone dial that IP using their VC unit it should rich our internal IP address 10.10.10.2 also should we be able to get to that when we type203.X.X.X,
from out of office, I think issue is in NAT, but I can't understand

Can anyone help me ?

Regards

vikrant

comteam#sh run
Building configuration...

Current configuration : 7986 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname comteam
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
!
no aaa new-model
!
crypto pki trustpoint TP-self-signed-814900924
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-814900924
 revocation-check none
 rsakeypair TP-self-signed-814900924
!
!
crypto pki certificate chain TP-self-signed-814900924
 certificate self-signed 01
  3082024C 308201B5 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
  30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274
  69666963 6174652D 38313439 30303932 34301E17 0D313031 32313230 38323934
  395A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F
  532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3831 34393030
  39323430 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
  E9EF51C3 C77CA2DA 2C06B1DD 4099F308 CBBAA8CB 963E1531 E74C5260 DD9ED17E
  7C1FF7F7 624D3C8A 75894902 BBF2B7CF BE3D8386 B8655693 DCA7E7CB C282D672
  8FC4360C EE032BA2 B685627D DE4DFC39 F39F8D65 23EE720D F5BE2297 96BBF6E4
  65F8947A FFBCDEC9 17772266 0105B4D5 1A81796C 10836ADC F6272826 271C29E3
  02030100 01A37630 74300F06 03551D13 0101FF04 05300301 01FF3021 0603551D
  11041A30 18821663 6F6D7465 616D2E79 6F757264 6F6D6169 6E2E636F 6D301F06
  03551D23 04183016 8014F899 77021298 0AD7AB9E 668987B0 2D2810EF BC93301D
  0603551D 0E041604 14F89977 0212980A D7AB9E66 8987B02D 2810EFBC 93300D06
  092A8648 86F70D01 01040500 03818100 2006DF1D 4379C8C3 9A36A316 79A98E01
  B4474F4F 435A0BE2 3B7014D8 6E78176C 2FC623D0 8AD528B3 193ED349 6CC844DD
  DD82F74C D60A0E6B FF7CCA37 DBE7E8FA 32385098 3A94F2B2 BBA04F6C C3AFCA2C
  38CA6741 7E2690D5 BCD31E58 1D7B8638 0007545E 9F11EB3B 72AE0044 A26AC50E
  8D2DF0D3 35EE4C48 B18533C9 3A643261
        quit
dot11 syslog
!
dot11 ssid comteam
   vlan 1
   authentication open
   authentication key-management wpa
   guest-mode
   wpa-psk ascii 7 XXXXXXXXX
!
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 10.10.10.1 10.10.10.2
!
ip dhcp pool sdm-pool
   import all
   network 10.10.10.0 255.255.255.0
   default-router 10.10.10.1
   dns-server 10.10.10.1
   lease 0 2
!
!
ip domain name yourdomain.com
ip name-server 203.0.178.191
ip name-server 203.215.29.191
!
!
!
username XXXXXXXXX privilege 15 password XXXXXXXXX
!
!
archive
 log config
  hidekeys
!
!
!
class-map match-all Streaming-Video
 match access-group 103
class-map match-all video-conf
 match access-group 102
class-map match-all Video-Conf
 match access-group 102
!
!
policy-map qos-policy
 class video-conf
  bandwidth 512
 class class-default
  fair-queue
!
!
bridge irb
!
!
interface ATM0
 no ip address
 no atm ilmi-keepalive
 dsl operating-mode auto
!
interface ATM0.1 point-to-point
 pvc 8/35
  pppoe-client dial-pool-number 1
 !
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Dot11Radio0
 no ip address
 ip nat inside
 ip virtual-reassembly
 !
 encryption vlan 1 mode ciphers tkip
 !
 ssid comteam
 !
 speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0
 54.0
 station-role root
!
interface Dot11Radio0.1
 encapsulation dot1Q 1 native
 no cdp enable
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Vlan1
 no ip address
 ip nat inside
 ip virtual-reassembly
 ip tcp adjust-mss 1412
 bridge-group 1
 bridge-group 1 spanning-disabled
!
interface Dialer0
 mtu 1454
 ip address negotiated
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 ip route-cache flow
 ip tcp adjust-mss 1360
 dialer pool 1
 dialer-group 1
 no cdp enable
 ppp authentication pap callin
 ppp chap refuse
 ppp pap sent-username computerteam password 7 030E71051F0B74696F18
!
interface BVI1
 ip address 10.10.10.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
ip route 0.0.0.0 0.0.0.0 ATM0
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip dns server
ip nat inside source list ToNAT interface Dialer0 overload
ip nat inside source static tcp 10.10.10.2 80 interface Dialer0 80
ip nat inside source static tcp 10.10.10.2 389 interface Dialer0 389
ip nat inside source static tcp 10.10.10.2 1503 interface Dialer0 1503
ip nat inside source static tcp 10.10.10.2 1720 interface Dialer0 1720
ip nat inside source static udp 10.10.10.2 80 interface Dialer0 80
ip nat inside source static udp 10.10.10.2 389 interface Dialer0 389
ip nat inside source static udp 10.10.10.2 1503 interface Dialer0 1503
ip nat inside source static udp 10.10.10.2 1720 interface Dialer0 1720
ip nat inside source static tcp 10.10.10.2 3230 interface Dialer0 3230
ip nat inside source static tcp 10.10.10.2 3231 interface Dialer0 3231
ip nat inside source static tcp 10.10.10.2 3232 interface Dialer0 3232
ip nat inside source static tcp 10.10.10.2 3233 interface Dialer0 3233
ip nat inside source static tcp 10.10.10.2 3234 interface Dialer0 3234
ip nat inside source static tcp 10.10.10.2 3235 interface Dialer0 3235
ip nat inside source static udp 10.10.10.2 3230 interface Dialer0 3230
ip nat inside source static udp 10.10.10.2 3231 interface Dialer0 3231
ip nat inside source static udp 10.10.10.2 3232 interface Dialer0 3232
ip nat inside source static udp 10.10.10.2 3233 interface Dialer0 3233
ip nat inside source static udp 10.10.10.2 3234 interface Dialer0 3234
ip nat inside source static udp 10.10.10.2 3235 interface Dialer0 3235
!
ip access-list extended ToNAT
 permit ip 10.10.10.0 0.0.0.255 any
!
no cdp run
!
!
!
control-plane
!
bridge 1 route ip

!
line con 0
 password 7 011009094B1E120A33584B08145346445A
 login local
 no modem enable
line aux 0
 password 7 011009094B1E120A33584B08145346445A
 login local
line vty 0 4
 access-class 23 in
 privilege level 15
 password 7 011009094B1E120A33584B08145346445A
 login local
 transport input telnet ssh
!
scheduler max-task-time 5000
end

Nikita Singh · ‎12-27-2010

from inside your LAN , you have to use the 10.10.10.2 ip address. If you use the public ip from inside the LAN it will go to the Cisco router page because it is being natted twice then.

Now from outside you should be able to use ur public ip. The config is fine. I'm not sure why it it not working. please send "show ip nat trans" and what ports are your polycom device using.

View solution in original post

Nikita Singh · ‎12-27-2010

there is no trans for port 80..are u sure default gateway on polycom is 10.10.10.1...

do this for troubleshooting:

ip access-list ex 123

10 permit tcp any host <203.x.x.x> eq 80

20 permit tcp any any any eq 80

30 permit ip any any

Then again try accessing port 80 from outside. do a "show access-list 123 " again and see if there are hits for seq 10.Send that output. (you can add similarly other ports as well, but dont forget to add " permit ip any any " in the last line )

View solution in original post

Nikita Singh · ‎12-28-2010

forgot to mention, u need to apply the access-list to dia0 interface. ..Makes no sense otherwise.

int dia0

ip access-group 123 in

now try access port 80 and see if there are hits on the access-list

View solution in original post

Ganesh Hariharan · ‎12-23-2010

ip nat inside source list ToNAT interface Dialer0 overload
ip nat inside source static tcp 10.10.10.2 80 interface Dialer0 80
ip nat inside source static tcp 10.10.10.2 389 interface Dialer0 389
ip nat inside source static tcp 10.10.10.2 1503 interface Dialer0 1503
ip nat inside source static tcp 10.10.10.2 1720 interface Dialer0 1720
ip nat inside source static udp 10.10.10.2 80 interface Dialer0 80
ip nat inside source static udp 10.10.10.2 389 interface Dialer0 389
ip nat inside source static udp 10.10.10.2 1503 interface Dialer0 1503

Hi,

Try changing to actual public ip address and the try from outside, I mean configure the public ip address in place of interface dialer0 .

Hope to Help !!

Ganesh.H

Vikrant Ambhore · ‎12-23-2010

Same Issue Yet

johnlloyd_13 · ‎12-24-2010

try to do and test below.

int dial0
no ip nat out

no ip nat inside source list ToNAT interface Dialer0 overload
ip nat inside source list ToNAT interface atm0 overload

int atm0
ip nat out

do post your show ip nat translation output and try to ping/telnet from outside WAN (public router).

Vikrant Ambhore · ‎12-24-2010

@johnlloyd_13

Internet was Lost by your suggestion

Regards

VIkrant

johnlloyd_13 · ‎12-24-2010

sorry to hear that. kindly revert to your original config.you might want to schedule a network downtime for this kind of changes/testing.

jgraafmans · ‎12-24-2010

You don't need the static default route to your ATM interface. You only need one to your dialer 0. Except for that your config looks fine

Are you sure the Polycom video Conferencing unit has the right default gateway?

Vikrant Ambhore · ‎12-25-2010

Yep,

I am unable to Ping device

jgraafmans · ‎12-25-2010

Can you replace the unit with a laptop, give the laptop the same IP address, run some webserver like xammp on it and test if your static works. This is the easiest way to verify if the NAT config is correct. If you can't afford downtime of the unit you can also give a laptop another IP address and change the NAT rules to that IP address

Nikita Singh · ‎12-25-2010

1. Please check the default gateway on Polycom video Conferencing unit. It should be 10.10.10.1.

2. When you are doing http://10.10.10.2, you are trying to access it through port 80. Try the same http://203.xx.xx.xx from outside and let me know if this works.

3. Any specipic port being used for this ?

4. Please send "show ip nat trans"

Also try adding a static nat

ip nat inside source static 10.10.10.2

Also, another suggestion,please add the keyword "extendable" to all port forwarding nat statements,

for example,

ip nat inside source static tcp 10.10.10.2 80 interface Dialer0 80 extendable
ip nat inside source static tcp 10.10.10.2 389 interface Dialer0 389 extendable

Vikrant Ambhore · ‎12-26-2010

Hi Nikita,

Can you look on my running config, I think it's correct, Now i am able to access polycom unit through http://10.10.10.2 in LAN, but can't access through static IP from Outside but when i tried tto open through http://203.xx.xx.xx in LAN i am getting Cisco router page, It should be open Polycom unit instead of Cisco. please look on my running config also please find attached sh ip nat trans outpt & suggest me if i'm wrong

comteam#sh run
Building configuration...

Current configuration : 7986 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname comteam
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
!
no aaa new-model
!
crypto pki trustpoint TP-self-signed-814900924
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-814900924
revocation-check none
rsakeypair TP-self-signed-814900924
!
!
crypto pki certificate chain TP-self-signed-814900924
certificate self-signed 01
3082024C 308201B5 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 38313439 30303932 34301E17 0D313031 32313230 38323934
395A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F
532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3831 34393030
39323430 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
E9EF51C3 C77CA2DA 2C06B1DD 4099F308 CBBAA8CB 963E1531 E74C5260 DD9ED17E
7C1FF7F7 624D3C8A 75894902 BBF2B7CF BE3D8386 B8655693 DCA7E7CB C282D672
8FC4360C EE032BA2 B685627D DE4DFC39 F39F8D65 23EE720D F5BE2297 96BBF6E4
65F8947A FFBCDEC9 17772266 0105B4D5 1A81796C 10836ADC F6272826 271C29E3
02030100 01A37630 74300F06 03551D13 0101FF04 05300301 01FF3021 0603551D
11041A30 18821663 6F6D7465 616D2E79 6F757264 6F6D6169 6E2E636F 6D301F06
03551D23 04183016 8014F899 77021298 0AD7AB9E 668987B0 2D2810EF BC93301D
0603551D 0E041604 14F89977 0212980A D7AB9E66 8987B02D 2810EFBC 93300D06
092A8648 86F70D01 01040500 03818100 2006DF1D 4379C8C3 9A36A316 79A98E01
B4474F4F 435A0BE2 3B7014D8 6E78176C 2FC623D0 8AD528B3 193ED349 6CC844DD
DD82F74C D60A0E6B FF7CCA37 DBE7E8FA 32385098 3A94F2B2 BBA04F6C C3AFCA2C
38CA6741 7E2690D5 BCD31E58 1D7B8638 0007545E 9F11EB3B 72AE0044 A26AC50E
8D2DF0D3 35EE4C48 B18533C9 3A643261
        quit
dot11 syslog
!
dot11 ssid comteam
   vlan 1
   authentication open
   authentication key-management wpa
   guest-mode
   wpa-psk ascii 7 XXXXXXXXX
!
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 10.10.10.1 10.10.10.2
!
ip dhcp pool sdm-pool
   import all
   network 10.10.10.0 255.255.255.0
   default-router 10.10.10.1
   dns-server 10.10.10.1
   lease 0 2
!
!
ip domain name yourdomain.com
ip name-server 203.0.178.191
ip name-server 203.215.29.191
!
!
!
username XXXXXXXXX privilege 15 password XXXXXXXXX
!
!
archive
log config
hidekeys
!
!
!
class-map match-all Streaming-Video
match access-group 103
class-map match-all video-conf
match access-group 102
class-map match-all Video-Conf
match access-group 102
!
!
policy-map qos-policy
class video-conf
bandwidth 512
class class-default
fair-queue
!
!
bridge irb
!
!
interface ATM0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
!
interface ATM0.1 point-to-point
pvc 8/35
pppoe-client dial-pool-number 1
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Dot11Radio0
no ip address
ip nat inside
ip virtual-reassembly
!
encryption vlan 1 mode ciphers tkip
!
ssid comteam
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0
54.0
station-role root
!
interface Dot11Radio0.1
encapsulation dot1Q 1 native
no cdp enable
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Vlan1
no ip address
ip virtual-reassembly
bridge-group 1
bridge-group 1 spanning-disabled
!
interface Dialer0
mtu 1454
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
ip route-cache flow
ip tcp adjust-mss 1360
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication pap callin
ppp chap refuse
ppp pap sent-username computerteam password 7 030E71051F0B74696F18
!
interface BVI1
ip address 10.10.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip dns server
ip nat inside source list ToNAT interface Dialer0 overload
ip nat inside source static tcp 10.10.10.2 80 interface Dialer0 80
ip nat inside source static tcp 10.10.10.2 389 interface Dialer0 389
ip nat inside source static tcp 10.10.10.2 1503 interface Dialer0 1503
ip nat inside source static tcp 10.10.10.2 1720 interface Dialer0 1720
ip nat inside source static udp 10.10.10.2 80 interface Dialer0 80
ip nat inside source static udp 10.10.10.2 389 interface Dialer0 389
ip nat inside source static udp 10.10.10.2 1503 interface Dialer0 1503
ip nat inside source static udp 10.10.10.2 1720 interface Dialer0 1720
ip nat inside source static tcp 10.10.10.2 3230 interface Dialer0 3230
ip nat inside source static tcp 10.10.10.2 3231 interface Dialer0 3231
ip nat inside source static tcp 10.10.10.2 3232 interface Dialer0 3232
ip nat inside source static tcp 10.10.10.2 3233 interface Dialer0 3233
ip nat inside source static tcp 10.10.10.2 3234 interface Dialer0 3234
ip nat inside source static tcp 10.10.10.2 3235 interface Dialer0 3235
ip nat inside source static udp 10.10.10.2 3230 interface Dialer0 3230
ip nat inside source static udp 10.10.10.2 3231 interface Dialer0 3231
ip nat inside source static udp 10.10.10.2 3232 interface Dialer0 3232
ip nat inside source static udp 10.10.10.2 3233 interface Dialer0 3233
ip nat inside source static udp 10.10.10.2 3234 interface Dialer0 3234
ip nat inside source static udp 10.10.10.2 3235 interface Dialer0 3235
!
ip access-list extended ToNAT
permit ip 10.10.10.0 0.0.0.255 any
!
no cdp run
!
!
!
control-plane
!
bridge 1 route ip

!
line con 0
password 7 011009094B1E120A33584B08145346445A
login local
no modem enable
line aux 0
password 7 011009094B1E120A33584B08145346445A
login local
line vty 0 4
access-class 23 in
privilege level 15
password 7 011009094B1E120A33584B08145346445A
login local
transport input telnet ssh
!
scheduler max-task-time 5000
end

comteam#

Latchum Naidu · ‎12-27-2010

Hi,

In your case the config needs to be like below...

And as per better practices, nating with public IP is better idea instead of interface.

ip nat pool ToNAT "start_public-ip end_public-ip netmask MASK (example ip nat pool NAT 175.2.2.1 175.2.2.5 netmask 255.255.255.240)

ip nat inside source static 10.10.10.2 3234 175.2.2.2 3234 extendable

ip access-list extended ToNAT
permit ip 10.10.10.0 0.0.0.255 any

please rate if this helps you....

Regards,

Naidu.

Vikrant Ambhore · ‎12-27-2010

ip nat pool ToNAT "start_public-ip end_public-ip netmask MASK (example ip nat pool NAT 175.2.2.1 175.2.2.5 netmask 255.255.255.240)

ip nat inside source static 10.10.10.2 3234 175.2.2.2 3234 extendable

I'm Sorry, I amunable to getting you on above statement

It's my details

Polycom LAN IP : 10.10.10.2 255.255.255.0

My Static IP : 203.X.X.X Subnet don't know

Pls suggest

Nikita Singh · ‎12-27-2010

from inside your LAN , you have to use the 10.10.10.2 ip address. If you use the public ip from inside the LAN it will go to the Cisco router page because it is being natted twice then.

Now from outside you should be able to use ur public ip. The config is fine. I'm not sure why it it not working. please send "show ip nat trans" and what ports are your polycom device using.

Vikrant Ambhore · ‎12-27-2010

Hi Nikita,

Thanks for your reply, I am able to access polycom unit through http://10.10.10.2 in LAN, I am sure Iam using Port 80 for polycom unit

Please look on output of sh ip nat translations

comteam#sh ip nat trans
comteam#sh ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
tcp 203.X.X.X:80 10.10.10.2:80      ---                ---
udp 203.X.X.X:80 10.10.10.2:80      ---                ---
tcp 203.X.X.X:389 10.10.10.2:389    ---                ---
udp 203.X.X.X:389 10.10.10.2:389    ---                ---
tcp 203.X.X.X:1503 10.10.10.2:1503 ---                ---
udp 203.X.X.X:1503 10.10.10.2:1503 ---                ---
tcp 203.X.X.X:1720 10.10.10.2:1720 ---                ---
udp 203.X.X.X:1720 10.10.10.2:1720 ---                ---
tcp 203.X.X.X:3230 10.10.10.2:3230 ---                ---
udp 203.X.X.X:3230 10.10.10.2:3230 ---                ---
tcp 203.X.X.X:3231 10.10.10.2:3231 ---                ---
udp 203.X.X.X:3231 10.10.10.2:3231 ---                ---
tcp 203.X.X.X:3232 10.10.10.2:3232 ---                ---
udp 203.X.X.X:3232 10.10.10.2:3232 ---                ---
tcp 203.X.X.X:3233 10.10.10.2:3233 ---                ---
udp 203.X.X.X:3233 10.10.10.2:3233 ---                ---
tcp 203.X.X.X:3234 10.10.10.2:3234 ---                ---
udp 203.X.X.X:3234 10.10.10.2:3234 ---                ---
tcp 203.X.X.X:3235 10.10.10.2:3235 ---                ---
udp 203.X.X.X:3235 10.10.10.2:3235 ---                ---
tcp 203.X.X.X:7666 10.10.10.2:7666 172.22.142.36:3601 172.22.142.36:3601
comteam#