need help on NAT

[catalystexpress]

Hi All,

Below is my senario

Internet ----fa0/1 (1841) fa0/0----- Intranet

Currently am doing overload NAT for the Intranet users and its working as expected, now i want to host a server in my Intranet which can be reached from Internet.

am planning to do a static NAT in this case, but am not sure how can this be done any help would be appreciated

I believe the below command should do the job     ""ip nat inside source static 10.6.1.82  203.126.x.x""

interface 0/1

ip address 115.x.x.x.x 255.255.255.252

ip nat inside

interface 0/0

ip address 10.6.1.90 255.255.0.0

ip nat outside

ip nat pool NAT-pool 203.x.x.x 203.x.x.x netmask 255.255.255.240

ip nat inside source list 1 pool NAT-pool overload

!

access-list 1 remark xxxxx

access-list 1 permit 10.6.0.0 0.0.255.255

Many Thanks for the help......

cheers....

[cadet alain · Accepted solution]

Hi,

ip nat inside source static 10.6.1.82  203.126.x.x will nat all ports on the server so if you only want this server to be accessible from outside for certain services you should do static PAT:

ip nat inside source static tcp/udp 10.6.1.82 203.126.x.x

You should inverse your nat outside and inside for your interfaces.

Regards.

Alain.

[Marwan ALshawi · Accepted solution]

as Alan mentioned you need somthing called Static PAT

see the bellow example

http://www.cisco.com/en/US/tech/tk175/tk15/technologies_configuration_example09186a0080093e51.shtml

HTH

if helpful Rate

[JohnTylerPearce · Accepted solution]

It looks like you have the inside/outside nat statements reversed in your config. The config will work in theory as

long as it's not connected to the Internet     But I think this is really what you are looking for

-----------------------------------------------------------------------------------------------------

int 0/1

ip address 115.x.x.x 255.255.255.252

ip nat outside

int 0/0

ip address 10.6.1.90 255.255.0.0

ip nat inside

ip nat pool NAT-pool 203.x.x.x 203.x.x.x netmask 255.255.255.240

ip nat inside source list 1 pool NAT-pool overload

access-list 1 remark xxxxx

access-list 1 permit 10.6.0.0 0.0.255.255

------------------------------------------------------------------------------------------------------

I do have a question though. It looks as if you are using 14 usable addresses for

Dynamic PAT. How many users are you going to be NAT'ng? If you have less than

65,535 you only need one address for PAT. This will leave your other public addresses

up for any use that you see fit. Again this is just question....

If you want to static NAT you can static nat based on all ports to a specific address or to specific

ports on a specific addresses. I always try to make the most restrictive statements that I can.

ip nat inside source static 10.6.1.82 203.126.x.x will nat all your ports to a specific IP address

ip nat inside source static tcp/udp 10.6.1.82 203.126.x.x

This will make the server port (inside server port) to an (outside port for Inet users)

I hope this helped some. Have a good one!

[catalystexpress]

Many Thanks to all of you, the information provided by each one was very helpful for me to understand the concept....thanks again

@ Alain -- I think, we need not inverse the ip nat inside and outside, because currently we have our users going internet and it working properly

@marwanshawi -- Your link was extremely helpful which gives the exact solution

@John -- exactly thats what we are doing using only one global IP for overload for users going internet, and the rest is used for other purpose, but i think my inside and outside statement is correct, according to the link provided by marwanshawi the inside/outside statement looks good to me.

thank you very much

cheers....

[catalystexpress]

am sorry guys....

@ Alain & John,

Sorry it was typo mistake in my earlier pasted config...actaully

LAN Interface -- ip nat inside

WAN Interface -- ip nat outside

Thank you again ...... with regard to my pasted config yes you guys are correct....thanks again

cheers....