ā05-20-2005 08:14 AM - edited ā02-21-2020 01:47 PM
IOS router with a static configured PAT from public to private and nat for internet use
!
interface FastEthernet0
description # LAN connection
ip address 172.16.189.254 255.255.255.0
ip nat inside
!
interface Dialer0
description # internet connection
ip address negotiated
ip nat outside
crypto map ipsec
!
ip nat inside source list 199 interface Dialer0 overload
ip nat inside source static tcp 172.16.189.1 3389 interface Dialer0 3389
!
and on the same router an IPSEC tunnel between 172.16.189.0/24 to 10.10.10.0/24 configured with the following acl
!
access-list 199 remark #
access-list 199 remark # "nat Dialer0 overload with vpn split tunneling"
access-list 199 remark #
access-list 199 deny ip 172.16.189.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 199 permit ip 172.16.189.0 0.0.0.255 any
access-list 199 deny ip any any log
!
when i try to connect from host 10.10.10.1 to the 172.16.189.1 all ports are ok
but
if i try to connect on the port 3389 the nat start. How can i modify this NAT order of Operation within this configuration ?
Thanks in advance.
ā05-26-2005 11:25 AM
Please refer to the document http://www.cisco.com/warp/public/556/5.html on the order of operation.
ā05-27-2005 01:37 AM
Your problem is that the static NAT always takes precedence over the access-list based NAT.
I had exactly the same problem when using some static NATs with some Cisco VPN clients connecting to the same router.
You need to do this:
(1) Create a loopback interface, and give it any spare address. The subnet mask is unimportant.
(2) Create an access-list like this:
ip access-list extended no-nat-3389
permit tcp host 172.16.189.1 eq 3389 10.10.10.0 0.0.0.255
(3) Create a route-map, so that packets from 172.16.189.1/3389 are directed to the new loopback interface:
route-map port3389-to-loopback permit 10
match ip address no-nat-3389
set ip interface loopback0
(4) Apply the route-map to the interface:
interface FastEthernet0
ip route-cache policy
ip policy route-map port3389-to-loopback
DO NOT apply "ip nat inside" to the loopback interface.
The way this works is that the route-map directs packets from 172.16.189.1/3389 to the loopback interface. The loopback interface is not marked as a NAT-inside interface, and so NAT is not applied.
I had some trouble getting this to work. You may need to ensure that the loopback interface is included in the ACL for the VPN tunnel.
HTH
Chris
ā05-27-2005 02:21 AM
I SEND THE THE CONFIGURATION AGAIN WITH YOUR INPUT (I've NOT changed the configuration on the HUB router):
*** SPOKE ROUTER
!
interface Loopback123
description # for overrides the problem PAT-NAT VPN problem
ip address 10.123.123.1 255.255.255.0
!
int FastEthernet0
ip address 172.24.64.254 255.255.255.0
ip nat inside
ip route-cache policy
ip route-cache flow
ip policy route-map nonat-fe0
!
interface Dialer0
ip address negotiated
ip nat outside
!
ip nat inside source static tcp 172.24.64.2 3389 interface Dialer0 3389
!
access-list 123 remark #
access-list 123 remark # route map for overrides the problem PAT-NAT VPN problem
access-list 123 remark #
access-list 123 permit ip host 172.24.64.2 172.16.188.0 0.0.0.255
access-list 123 permit ip host 172.24.64.2 172.16.189.0 0.0.0.255
!
access-list 167 remark #
access-list 167 remark # crypto map for L2L ip
access-list 167 remark #
access-list 167 permit ip 172.24.64.0 0.0.0.255 172.16.188.0 0.0.0.255
access-list 167 permit ip 172.24.64.0 0.0.0.255 172.16.189.0 0.0.0.255
access-list 167 permit ip 10.0.0.0 0.0.0.255 172.16.188.0 0.0.0.255
access-list 167 permit ip 10.0.0.0 0.0.0.255 172.16.189.0 0.0.0.255
!
route-map nonat-fe0 permit 10
match ip address 123
set ip next-hop 10.123.123.2
!
*** HUB ROUTER
!
int FastEthernet0.188
ip address 172.16.188.254 255.255.255.0
!
int FastEthernet0.189
ip address 172.16.189.254 255.255.255.0
!
access-list 167 remark #
access-list 167 remark # crypto map for L2L ip
access-list 167 remark #
access-list 167 permit ip 172.16.188.0 0.0.0.255 172.24.64.0 0.0.0.255
access-list 167 permit ip 172.16.189.0 0.0.0.255 172.24.64.0 0.0.0.255
!
BUT now i can't ping fromt the HUB LAN to the SPOKE LAN !!!
- ping from 172.24.64.2 vs 172.16.189.2 OK
- ping from 172.16.189.2 vs 172.24.64.2 DOESN'T WORK
If i remove the policy map on the spoke ALL is OK again !
ā07-03-2012 11:44 PM
Very old thread but I see that it doesn't look to have been answered. I'll leave this guide here for future reference. Here's how you do this guys.
interface FastEthernet0
description # LAN connection
ip address 172.16.189.254 255.255.255.0
ip nat inside
!
interface Dialer0
description # internet connection
ip address negotiated
ip nat outside
crypto map ipsec
!
ip nat inside source list 199 interface Dialer0 overload
ip nat inside source static tcp 172.16.189.1 3389 interface Dialer0 3389 route-map NO-NAT
!
route-map NO-NAT permit 10
match ip address 199
!
!
access-list 199 remark #
access-list 199 remark # "nat Dialer0 overload with vpn split tunneling"
access-list 199 remark #
access-list 199 deny ip 172.16.189.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 199 permit ip 172.16.189.0 0.0.0.255 any
access-list 199 deny ip any any log
!
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide