0

Has anyone use Cisco 891-K9 to forward 443/SSL to a SSL VPN appliance?

(I've never encountered this situation before because either the public facing router terminated VPN directly or we had multiple public IPs to assign the VPN appliance directly a public IP).

With "ip nat inside source static tcp 44.55.66.255 443 10.10.10.150 443 extendable" it's supposed to forward the SSL request to the SSL VPN appliance at 10.10.10.150 to have VPN requests be terminated there.

But failed miserably becaues 891-K9 created a virtual ARP entry for 10.10.10.150. So two MACs with same IP.

So 443 requests were beings sent to its interface. Upon the NAT statement, I can't ssh into the SSL-VPN appliance, but the moment the statemet is gone, I can ssh and ARP dupliacte warning goes away.

*Nov 1 19:22:46.871: %IP-4-DUPADDR: Duplicate address 10.10.10.150 on Vlan10, sourced by aaaa.bbbb.cccc
*Nov 1 19:23:18.083: %IP-4-DUPADDR: Duplicate address 10.10.10.150 on Vlan10, sourced by aaaa.bbbb.cccc
*Nov 1 19:23:48.295: %IP-4-DUPADDR: Duplicate address 10.10.10.150 on Vlan10, sourced by aaaa.bbbb.cccc
rtr#sh clock
*19:24:26.487 UTC Sun Nov 1 2015
rtr#sh ip arp 10.10.10.150
Protocol Address Age (min) Hardware Addr Type Interface
Internet 10.10.10.150 - e02f.6d96.8dd0 ARPA Vlan10
rtr#sh ip arp 10.10.10.150
Protocol Address Age (min) Hardware Addr Type Interface
Internet 10.10.10.150 - e02f.6d96.8dd0 ARPA Vlan10
rtr#sh sh ip route 10.10.10.150

Cisco TAC is trying to reproduce this problem at the moment to report to dev.

Has anyone else had this problem or a workaround?

Thanks.

0

Silly mistake.

Since the SSL VPN appliance is the one being "nat inside," we have to do it other way around.

as in "ip nat inside source static tcp 10.10.10.150 43 44.55.66.255 43"

Basically excluding the appliance from translation and not create another arp entry.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.