Simple virtual NAT question

Simple virtual NAT question

NewsGroups | Search | Tools
 comp.dcom.sys.cisco  Post an article  get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content  add this group's latest topics to your Google content  YahooMyWeb Yahoo!  Google Google  Windows Live Favorites Windows Live  del.icio.us del.icio.us  digg digg  Add to Netscape Netscape
Subject Author Date
Simple virtual NAT question sphealey 11-08-2006
Posted by sphealey on November 8, 2006, 5:58 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
2691
IOS 12.3(14)T6
SP Services

I am working on setting up a simple dynamic NAT connection to an ADSL
ISP. The ISP's device is very simple and there is basically nothing I
can do to fix that.

My setup is:


---------
== 172.20.10.0 ==| | -------
| 2691 | | |
== 172.20.20.0 ==| 0/4|= 2.2.2.2 === 2.2.2.1=| ISP |== 3.3.3.3
| | | box |
== 172.20.30.0 ==| | -------
---------

where 2.2.2.1 and 2.2.2.2 are valid IP addresses provided by the ISP.
There are about 30 hosts (PCs) per private network. The ISP box will
not NAT multiple connections.

Is this as simple as doing a

conf t
int FE 0/4
ip nat enable
exit
exit

or is there more to it than that? I am suspicious because the Cisco
document (Configuring NAT for IP Address Conservaton) appears too
simple!

Thanks.

sPh


Posted by Mike Rahl on November 8, 2006, 9:49 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
You have to do a few things here.

First you have to define what you are natting to (be it an interface,
or an IP address; you can do both). Then you have to indicate what
traffic you are NATting. Because you have only 1 IP address on the
public side, you will need to do a NAT overload

A basic configuration would be something like this:

access-list 101 permit ip 172.20.0.0 0.0.31.255 any
ip nat inside source list 101 interface dialer1 overload

interface fastethernet0/0 !(or whatever your LAN interface is)
ip nat inside

interface dialer1 !(the interface that is configured with your WAN IP
address)
ip nat outside

I usually indicate the WAN interface that has the IP address
configured, as it's the easiest way I know

Hope that helps!

sphealey wrote:
> 2691
> IOS 12.3(14)T6
> SP Services
>
> I am working on setting up a simple dynamic NAT connection to an ADSL
> ISP. The ISP's device is very simple and there is basically nothing I
> can do to fix that.
>
> My setup is:
>
>
> ---------
> == 172.20.10.0 ==| | -------
> | 2691 | | |
> == 172.20.20.0 ==| 0/4|= 2.2.2.2 === 2.2.2.1=| ISP |== 3.3.3.3
> | | | box |
> == 172.20.30.0 ==| | -------
> ---------
>
> where 2.2.2.1 and 2.2.2.2 are valid IP addresses provided by the ISP.
> There are about 30 hosts (PCs) per private network. The ISP box will
> not NAT multiple connections.
>
> Is this as simple as doing a
>
> conf t
> int FE 0/4
> ip nat enable
> exit
> exit
>
> or is there more to it than that? I am suspicious because the Cisco
> document (Configuring NAT for IP Address Conservaton) appears too
> simple!
>
> Thanks.
>
> sPh


Posted by sphealey on November 9, 2006, 9:40 am
If you were  Registered and logged in, you could reply and use other advanced thread options
> Mike Rahl wrote:
> You have to do a few things here.
>
> First you have to define what you are natting to (be it an interface,
> or an IP address; you can do both). Then you have to indicate what
> traffic you are NATting. Because you have only 1 IP address on the
> public side, you will need to do a NAT overload
>
> A basic configuration would be something like this:
>
> access-list 101 permit ip 172.20.0.0 0.0.31.255 any
> ip nat inside source list 101 interface dialer1 overload

I am looking at the "NAT virtual interface" option though which seems
to remove the requirement for defining outside and insider interfaces
per the above-mentioned document.

sPh


Posted by CK on November 9, 2006, 11:04 am
If you were  Registered and logged in, you could reply and use other advanced thread options


> I am looking at the "NAT virtual interface" option though which seems
> to remove the requirement for defining outside and insider interfaces
> per the above-mentioned document.
>

Why to go with virtual interface when every thing can by NATTING
outside interface..

Config should be as simple to understand.


CK


Posted by sphealey on November 9, 2006, 1:26 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
> CK wrote:
> > I am looking at the "NAT virtual interface" option though which seems
> > to remove the requirement for defining outside and insider interfaces
> > per the above-mentioned document.
> >
>
> Why to go with virtual interface when every thing can by NATTING
> outside interface..
>
> Config should be as simple to understand.

The Virtual NAT option just seemed like a very clean way to connect to
the ISP without having to worry about affecting any other interface or
function of the router (some of which are not under my jurisdiction).
I am just having trouble grasping exactly what the options do,
particularly how the access list comes into play when I simply want to
allow full access from any connected network. Also the defintion of
vrf is unclear.

sPh


Similar ThreadsPosted
virtual template and virtual access for ADSL circuits April 28, 2005, 3:22 pm
cisco VPN ipsec tunnel virtual interface operation detail question July 28, 2006, 2:57 pm
Simple question August 7, 2004, 7:31 pm
simple question December 10, 2004, 8:35 am
Simple question June 30, 2005, 11:59 am
Simple Pix VPN question April 28, 2006, 3:25 pm
Simple ip question July 3, 2006, 7:09 pm
simple question...maybe September 10, 2006, 2:20 pm
Simple(?) QoS question January 25, 2007, 3:22 pm
A simple question June 9, 2008, 5:40 am

other useful resources:
The Federal Communications Commission (FCC)
Telecommunications Industry Association
Electronic and Software Security Products and Services
International Telecommunication Union

Custom CGI Perl and PHP programming by 1-Script.com

Contact Us | Privacy Policy
The site map in XML format XML site map