Natting from local server to remote server

[mohammed asif suleman]

Hi all,

Please Can any one help me understand this concept...

Let me show you the scenario

one MPLS connection from ISP coming to my router and from my router to DMZ servers

i have to connect to the Remote server to my DMZ server

The ISP gave me the details of BGP to configure

now what i have to do to Route my private network to the remote servers...

They gave me source and destination ip address to NAT

                               now i am confused to which ip should i nat as inside to outside  and outside to inside

The ip 10.16.21.206 is their test server IP address, I spoke to them but they are reluctent to create tunnels...

Source IP Address	Destination IP Address	Service	Action
10.11.19.43	10.16.21.206	5775/tcp	allow

my server IP : 10.10.10.28

my inside global ip : 172.18.4.130

my outside global ip is 172.18.4.129

the network diagram is as follows

                                      

please help me to configure this

[Raju Sekharan · Accepted solution]

Hi Asif,

Are thye providing you MPLS L3 VPN Circuit?

If that is the case you need to just run BGP with provider and advertise your local subnets via BGP. There is no need of NAT

Thanks

Raju

[mohammed asif suleman]

Thank you Raj

yah i configured BGP and advertizing my network but the remote network also running on 10. 10.10.0/8 network and my DMZ also configured as 10.10.10.0/24 then how can i forward my routes out on that interface.....

and  i am not able to ping to isp ip

my BGP configuration is

router bgp 65412

bgp log-neighbor-changes

network 10.10.10.0 mask 255.255.255.128

neighbor 172.18.4.129 remote-as 65000

!

[Raju Sekharan]

Hi Asif,

Are you using same IP range at both sites?

As per your diagram one side is 10.16.X.X and other side is 10.10.10.X

Thanks

Raju

[mohammed asif suleman]

  Thanks Raj,

i am very sorry the information i got was not correct, 

the actual scenario is   

we are hosting the server 10.10.10.28 and the remote org will forward their traffic to our server on the ip 10.16.21.206 and we have to nat that and forward the traffice to our server i.e 10.10.10.28

my outside global ip : 172.18.4.129

my inside global ip : 172.18.4.130 255.255.255.252

remote server ip 10.11.19.51

natted adress : 10.16.21.206 to 10.10.10.28(outside to inside)

my local server ip : 10.10.10.28

                                     r,

it's like 10.11.19.51-------------------------->10.16.21.206-----(NAT)--------------------------->10.10.10.28

thaks in advance

[Raju Sekharan · Accepted solution]

ok. For this you need a static NAT. If you want to allow only port 5775 . Here is the Nat statement

ip nat inside source static tcp 10.16.21.206 10.10.10.28 5775

You need to put "Ip nat outside" on interface towards ISP and "IP nat inside" on the Interface towards your server

Also your routing should be working fine

Thanks

Raju

[mohammed asif suleman]

i configured only BGP and without NAT and internal routing can i connect my dmz server to isp

i tried to ping from my 10.10.10.28 server to ISP 172.18.4.130 and 172.18.4.129 but its not successful

how can connect my internal server to the outside network

i am advertising my 10.10.10.0 network in bgp , do i have to advertise the 10.10.10.0 network or 10.16.21.206 ip in BGP

[Raju Sekharan · Accepted solution]

Hi

Is the server gatway pointing to 10.10.10.100?

If you trace from server (10.10.10.28)to 172.18.4.130, is it showing the 1st hop as 10.10.10.100?

Thanks

Raju

[mohammed asif suleman]

my server is not pointing to the 10.10.10.100 gateway i will configure that now

i am not able to find the route i configured  i.e 10.16.21.206 in my routing table....

the command you have given is

ip nat inside source static tcp 10.16.21.206 10.10.10.28 5775

my server ip is 10.10.10.28 and i have to nat the 10.16.21.206 to 10.10.10.28

ip nat inside source static tcp 10.10.10.28 5775 10.16.21.206 5775 ......is it correct

[Raju Sekharan · Accepted solution]

Yes.

"ip nat inside source static tcp 10.10.10.28 5775 10.16.21.206 5775" is the right statement for your NAT requirement

Thanks

Raju

[mohammed asif suleman]

thankyou very much raj

i am able to ping the ISP gateway..i.,172.18.4.130 and 172.18.4.129

but i am not able to ping 10.16.21.206 or 10.11.19.51 niether from my router or server...

10.16.21.206 is logical ip which is not assigned to any device so can i test the ping to that

[Raju Sekharan · Accepted solution]

Hi

To ping 10.11.19.51,

1. does your router has the route for 10.11.19.51 on your router

2. Does 10.11.19.51 has the return route

If both of them are there, do a trace from the server to 10.11.19.51 and paste it here

To ping 10.16.21.206, you can configure a loopback interface on the router and advertise it

Thanks

Raju

[mohammed asif suleman]

thanks Raju

if i configure loop back how will be the route configuration.

router bgp 65412

bgp log-neighbor-changes

network 10.16.21.206

neighbor 172.18.4.129 remote-as 65000

tracert to 10.11.19.51 from my server 10.10.10.28

The loop back ip configuration

interface Loopback10

ip address 10.16.21.206 255.255.255.255

[mohammed asif suleman]

hi

after configuring loop back

10.11.19.51------->172.18.4.129------>172.18.4.130----->10.16.21.206--------->10.10.10.28

10.11.19.51---------- remote server

172.18.4.129-------- outside global

172.18.4.130-------- inside global

10.16.21.206-------- loopback on router

10.10.10.28---------- ocal server

now the remote server will send the traffic to 10.16.21.206  and  from 10.16.21.206 natted to 10.10.10.28

1)how can i know that the traffic from 10.11.19.51 is comming to my loopback interface 10.16.21.206

2)how can i know that the traffic is natted and forwarded to my server 10.10.10.28

3) how can i perform network handshake with remote server 10.11.19.51

the tracert from my server 10.10.10.28 is

               

ASIC-SADAD#sh ip nat translations

Pro Inside global      Inside local       Outside local      Outside global

tcp 10.16.21.206:5775  10.10.10.28:5775   ---                ---

[Raju Sekharan · Accepted solution]

172.18.4.129 are 172.18.4.130 are your interface IP and MPLS provider IP respectively. So calling them inside Local and outside Global is not correct because you  are not doiing any NAT for those IPs

1)how can i know that the traffic from 10.11.19.51 is comming to my loopback interface 10.16.21.206

Put an acl on the interface connecting to ISP and check the hit count. ACl will be like this

access-list 111 permit ip host 10.11.19.51 host 10.16.21.206

access-list 111 permit ip any any

2)how can i know that the traffic is natted and forwarded to my server 10.10.10.28

If there is a natted traffic flowing you should see that traffic in your translation table something like this

R2#sh ip nat trans

Pro Inside global      Inside local       Outside local      Outside global

tcp 10.61.21.206:5775       10.10.10.28:5775       10.11.19.51:38880 10.11.19.51:38880

tcp 10.16.21.206:5775         tcp 10.10.10.28:5775         ---                ---

3) how can i perform network handshake with remote server 10.11.19.51

I didn't understand this question. However if you are looking for checking the network reachability test, I would suggest to modify the TCP translation like this for testing which will allow all kind of traffic between these 2 IPS. So you can initiate a ling from 10.10.10.28 to 10.11.19.51 and check

ip nat inside source static 10.10.10.28 10.16.21.206

Further stesp

=======

1. Your bgp statement for advertising the network should be like below( Assuming that you have /32 mask)

router bgp 65412

network 10.16.21.206 mask 255.255.255.255

2. To confirm if we are advertising the route to the neighbor check the below command

Show ip bgp nei 172.18.4.129 advertised-routes

3. After this try ping and trace to 10.11.19.51 from the server. Make sure to change the NAT statement removing tcp during this test

Thanks

Raju