Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to create a DMZ type environment between two internal networks using Cisco NAT. The below configuration is working to permit the two 'nat outside' interfaces to access the dmz 'nat inside' server via the 10.0.0.50 & 172.26.100.50 hide nat IP addresses. However the server (192.168.1.2) is not being nat'd when it accesses the other two devices.

I need this to bi-directionally nat in order to hide the 'nat inside' network. For instance, 10.0.0.2 is able to ping/telnet to 10.0.0.50 and access the 192.168.1.2 device and is successfully translated. However, when 192.168.1.2 telnets to 10.0.0.2 the traffic shows up with the original ip address and not the desired 10.0.0.50 address.

!
interface GigabitEthernet0/0
 description insidetrusted
 ip address 172.26.100.10 255.255.255.0
 ip nat outside
!
interface GigabitEthernet0/1
 description dmz
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/2
 description outside
 ip address 10.0.0.1 255.255.255.0
 ip nat outside
!
!
ip nat inside source static 192.168.1.2 10.0.0.50 route-map netoutside
ip nat inside source static 192.168.1.2 172.26.100.50 route-map netinside

!
route-map netoutside permit 10
 match ip address 101
 match interface GigabitEthernet0/2
!
route-map netinside permit 10
 match ip address 100
 match interface GigabitEthernet0/0
!

Resources I've used in my research:

share|improve this question

1 Answer 1

up vote 1 down vote accepted

The source of the problem was the 'log' keyword at the end of my ACL's.

access-list 100 permit ip host 192.168.1.2 172.26.100.0 0.0.0.255 **log**
access-list 101 permit ip host 192.168.1.2 10.0.0.0 0.0.0.255 **log**

According to Cisco, you should never use 'log' with NAT ACLs. The observed behavior was that the traffic would be properly NAT'd in one direction, but in the other the NAT would not be applied.

The corrected ACL's are:

access-list 100 permit ip host 192.168.1.2 172.26.100.0 0.0.0.255
access-list 101 permit ip host 192.168.1.2 10.0.0.0 0.0.0.255
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.