Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We recently dug out an old Cisco 1841 to solve a need and have been in the process of trying to configure it appropriately. Admittedly, this is my first escapade into the land of Cisco Routing. I've been trying to piece together the correct NAT rules, but something just isn't right.

To give you a lay of the land, we have Outside Internet connection going into fa0/1. Then we have a Cisco Firewall going to fa0/0. Now, before I get too far, I know for a fact that the Cisco firewall is configured appropriately. The original router that was in place before we swapped it with the 1841 worked just fine. For those wondering, we were using an Edgemark router through a PBX provider that we no longer want to use. To fill the need for a router, we replaced the Edgemark router with this Cisco router.

Internet -> Cisco 1841 FA0/1 -> Cisco 1841 FA0/0 -> Cisco ASA 5520 Firewall -> Core Internal Switch

interface FastEthernet0/0
description $ETH-LAN$
ip address 67.xxx.xxx.177 255.255.255.240
ip nat inside
ip virtual-reassembly
no ip route-cache
duplex auto
speed auto
!
interface FastEthernet0/1
description $ETH-WAN$
ip address 65.yyy.yyy.150 255.255.255.252
no ip proxy-arp
ip nat outside
ip virtual-reassembly
no ip route-cache
speed 10
full-duplex
!
ip classless
ip route 0.0.0.0 0.0.0.0 65.yyy.yyy.149
!
no ip http server
no ip http secure-server
ip nat pool Net67 67.xxx.xxx.176 67.xxx.xxx.191 netmask 255.255.255.240
ip nat pool ovrld 67.xxx.xxx.178 67.xxx.xxx.178 prefix-length 24
ip nat inside source list 101 pool ovrld overload
ip nat outside source list 101 pool Net67 add-route
!
access-list 101 permit ip 67.xxx.xxx.176 0.0.0.15 any

Now, the nat rules that I have here are rules that I had pieced together off of sites such as ServerFault, Cisco Community, and other sources. I think something is wrong though.

Here are the issues:

  • Devices on the inside can't see the internet.
    • Though the router CAN ping 8.8.8.8 from itself.
  • Traffic on the outside going to the inside public IP's can't get through.

Any help would be appreciated.

Thanks!

EDIT: A Previous config that I also tried, which also did not work was this.

interface FastEthernet0/0
 description $ETH-LAN$
 ip address 67.xxx.xxx.177 255.255.255.240
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface FastEthernet0/1
 description $ETH-WAN$
 ip address 65.yyy.yyy.150 255.255.255.252
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
 no ip route-cache
 speed 10
 full-duplex
!
ip route 0.0.0.0 0.0.0.0 65.yyy.yyy.149
!
no ip http server
no ip http secure-server
ip nat inside source route-map nonat interface FastEthernet0/1 overload
!
access-list 101 permit ip 67.xxx.xxx.176 255.255.255.240 any
route-map nonat permit 10 
match ip address 101
share|improve this question
2  
Why are you NAT'ing one set of public IP's to another set? Is there some specific reason for that? Also, your description of the network is unclear. Does it go Internet->FA0/1->FA0/2->Firewall->internal network? In this case I would NAT on the firewall, not the router. in addition, if you are managing NAT with source-lists, we need to see the access lists that you are using as well as the rest of the config. –  smithian Oct 16 '12 at 16:11
    
Would there be any issue sourcing your traffic from the WAN Ethernet (i.e. 65.yyy.yyy.150)? The easiest setup would be to overload based on that outbound address - so "ip nat inside source list 101 interface fa0/1 overload" would get you outbound. This obviously doesn't apply if you're trying to do inbound NAT for a web server, but that wasn't indicated in your question. –  rnxrx Oct 16 '12 at 16:14
    
There is a ton of natting that is going on with the firewall, so smithian, you may be right that I don't need to do NATing. Honestly, I just need simple routing here, and not sure what the config should be. It goes Internet -> FA0/1 -> FA0/0 -> Firewall -> Core Network. The config above is after approximately two days of trying to get this to work. Blankly, we have a block of IP's (noted as 67.xxx.xxx.176/28) that are public IP's that need to be pushed out to the firewall (which has all of the nating and ACL's setup). And all devices on the inside need to access the public internet. –  Pete Oct 16 '12 at 16:33
    
To rnxrx's point, I need public internet traffic to appear as though it's coming from 67.xxx.xxx.178, and not the 65.yyy.yyy.149 address. –  Pete Oct 16 '12 at 16:35
    
And yes, there are webservers that sit on the inside that are addressed using 67.xxx.xxx.### IP's if that clears up what we're trying to do. Though the Cisco ASA 5520 Firewall is taking care of that NATing. –  Pete Oct 16 '12 at 16:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.