Question:
I have the following on Cisco Catalyst 3560 an 1841.
PPPoE on Fast0/0 works fine and picks up ISP address.
I have assigned on the /29 address to fast0/1.2 and and created a LAN on fast0/1.1 using the native VLAN.
I can ping the /29 address from the internet and also ping the internal address from the LAN.
I added a NAT statement (inside and outside to each sub interface).
I cannot connect from the 192.168.199.0/24 network out via NAT. Is this possible with subinterfaces?
vpdn enable
!
interface FastEthernet0/0
description PPPOE WAN
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
no ip mroute-cache
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
no cdp enable
!
interface FastEthernet0/1
no ip address
duplex auto
speed auto
!
interface FastEthernet0/1.1
encapsulation dot1Q 1 native
ip address 192.168.199.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
interface FastEthernet0/1.2
encapsulation dot1Q 2
ip address 81.143.105.77 255.255.255.248
ip nat outside
ip virtual-reassembly
!
!
interface Dialer1
ip address negotiated
no ip unreachables
ip mtu 1492
encapsulation ppp
ip tcp adjust-mss 1452
no ip mroute-cache
dialer pool 1
dialer-group 1
no cdp enable
ppp chap hostname ******
ppp chap password 0 *****
!
ip route 0.0.0 .0 0.0.0.0 Dialer1 2
ip nat inside source list 10 interface FastEthernet0/1.2 overload
!
access-list 10 permit 192.168.199.0 0.0.0 .255
dialer-list 1 protocol ip permit
Answer:
I have the following:
I think this is what you want to do? Anything from inside - Client_Inside will be translated to 2.2.2 .1 when I try to ping R2 which has a loopback of 1.1.1.1.
So all packets that are generated from the inside will be translated with a source address of 2.2.2 .1. I have added a route of 2.2.2.1 back to R1 where the loopback exists.
here are the configs:
CLIENT_INSDIE#show run
Building configuration...
Current configuration : 827 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname CLIENT_INSDIE
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
no ip domain lookup
ip domain name lab.local
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
interface FastEthernet0/0
ip address dhcp
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
!
control-plane
!
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
!
!
end
CLIENT_INSDIE#
CLIENT_INSDIE#show ip int brie
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 20.0.0 .101 YES DHCP up up
FastEthernet0/1 unassigned YES unset administratively down down
=======================================================================
R1#show run
Building configuration...
*Mar 1 00:41:27.515: %SYS-5-CONFIG_I: Configured from console by console
Current configuration : 1323 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 20.0.0 .0 20.0.0.100
!
ip dhcp pool 1
network 20.0.0 .0 255.255.255.0
default-router 20.0.0 .1
!
!
no ip domain lookup
ip domain name lab.local
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
!
interface Loopback0
ip address 2.2.2 .1 255.255.255.255
!
interface FastEthernet0/0
ip address 10.0.0 .1 255.255.255.252
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 20.0.0 .1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
ip forward-protocol nd
ip route 0.0.0 .0 0.0.0.0 10.0.0.2
!
!
no ip http server
no ip http secure-server
ip nat pool test 2.2.2 .1 2.2.2.1 netmask 255.255.255.252
ip nat inside source list 100 pool test overload
!
access-list 100 permit ip 20.0.0 .0 0.0.0.255 any
!
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
!
!
end
R1#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 10.0.0 .2 to network 0.0.0.0
C 2.2.2 .1 is directly connected, Loopback0
C 20.0.0 .0 is directly connected, FastEthernet0/1
C 10.0.0 .0 is directly connected, FastEthernet0/0
S* 0.0.0 .0/0 [1/0] via 10.0.0 .2
=======================================================================
R2#show run
Building configuration...
Current configuration : 934 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
no ip domain lookup
ip domain name lab.local
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
!
interface Loopback1
ip address 1.1.1 .1 255.255.255.0
!
interface FastEthernet0/0
ip address 10.0.0 .2 255.255.255.252
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
ip forward-protocol nd
ip route 2.2.2 .1 255.255.255.255 10.0.0.1
!
!
no ip http server
no ip http secure-server
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
!
!
end
Now I will ping 1.1.1 .1 from client router:
CLIENT_INSDIE#ping 1.1.1 .1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1 .1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 40/48/64 ms
=======================================================
R1#
*Mar 1 00:45:51.783: NAT*: s=20.0.0 .101->2.2.2.1, d=1.1.1.1 [75]
*Mar 1 00:45:51.811: NAT*: s=1.1.1 .1, d=2.2.2.1->20.0.0.101 [75]
*Mar 1 00:45:51.847: NAT*: s=20.0.0 .101->2.2.2.1, d=1.1.1.1 [76]
*Mar 1 00:45:51.867: NAT*: s=1.1.1 .1, d=2.2.2.1->20.0.0.101 [76]
*Mar 1 00:45:51.887: NAT*: s=20.0.0 .101->2.2.2.1, d=1.1.1.1 [77]
*Mar 1 00:45:51.911: NAT*: s=1.1.1 .1, d=2.2.2.1->20.0.0.101 [77]
*Mar 1 00:45:51.931: NAT*: s=20.0.0 .101->2.2.2.1, d=1.1.1.1 [78]
*Mar 1 00:45:51.947: NAT*: s=1.1.1 .1, d=2.2.2.1->20.0.0.101 [78]
*Mar 1 00:45:51.975: NAT*: s=20.0.0 .101->2.2.2.1, d=1.1.1.1 [79]
*Mar 1 00:45:51.995: NAT*: s=1.1.1 .1, d=2.2.2.1->20.0.0.101 [79]
R1#
*Mar 1 00:46:19.939: NAT: expiring 2.2.2 .1 (20.0.0.101) icmp 14 (14)
R1#show ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp 2.2.2 .1:13 20.0.0 .101:13 1.1.1 .1:13 1.1.1 .1:13
=======================================================
R2#
*Mar 1 00:45:24.731: IP: tableid=0, s=2.2.2 .1 (FastEthernet0/0), d=1.1.1.1 (Loopback1), routed via RIB
*Mar 1 00:45:24.735: IP: s=2.2.2 .1 (FastEthernet0/0), d=1.1.1.1, len 100, rcvd 4
*Mar 1 00:45:24.735: IP: tableid=0, s=1.1.1 .1 (local), d=2.2.2.1 (FastEthernet0/0), routed via FIB
*Mar 1 00:45:24.735: IP: s=1.1.1 .1 (local), d=2.2.2.1 (FastEthernet0/0), len 100, sending
*Mar 1 00:45:24.799: IP: tableid=0, s=2.2.2 .1 (FastEthernet0/0), d=1.1.1.1 (Loopback1), routed via RIB
*Mar 1 00:45:24.799: IP: s=2.2.2 .1 (FastEthernet0/0), d=1.1.1.1, len 100, rcvd 4
*Mar 1 00:45:24.799: IP: tableid=0, s=1.1.1 .1 (local), d=2.2.2.1 (FastEthernet0/0), routed via FIB
*Mar 1 00:45:24.799: IP: s=1.1.1 .1 (local), d=2.2.2.1 (FastEthernet0/0), len 100, sending
*Mar 1 00:45:24.855: IP: tableid=0, s=2.2.2 .1 (FastEthernet0/0), d=1.1.1.1 (Loopback1), routed via RIB
*Mar 1 00:45:24.855: IP: s=2.2.2 .1 (FastEthernet0/0), d=1.1.1.1, len 100, rcvd 4
*Mar 1 00:45:24.855: IP: tableid=0, s=1.1.1 .1 (local), d=2.2.2.1 (FastEthernet0/0), routed via FIB
*Mar 1 00:45:24.855: IP: s=1.1.1 .1 (local), d=2.2.2.1 (FastEthernet0/0), len 100, sending
*Mar 1 00:45:24.895: IP: tableid=0, s=2.2.2 .1 (FastEthernet0/0), d=1.1.1.1 (Loopback1), routed via RIB
*Mar 1 00:45:24.895: IP: s=2.2.2 .1 (FastEthernet0/0), d=1.1.1.1, len 100, rcvd 4
*Mar 1 00:45:24.895: IP: tableid=0, s=1.1.1 .1 (local), d=2.2.2.1 (FastEthernet0/0), routed via FIB
*Mar 1 00:45:24.895: IP: s=1.1.1 .1 (local), d=2.2.2.1 (FastEthernet0/0), len 100, sending
*Mar 1 00:45:24.939: IP: tableid=0, s=2.2.2 .1 (FastEthernet0/0), d=1.1.1.1 (Loopback1), routed via RIB
*Mar 1 00:45:24.939: IP: s=2.2.2 .1 (FastEthernet0/0), d=1.1.1.1, len 100, rcvd 4
*Mar 1 00:45:24.939: IP: tableid=0, s=1.1.1 .1 (local), d=2.2.2.1 (FastEthernet0/0), routed via FIB
*Mar 1 00:45:24.939: IP: s=1.1.1 .1 (local), d=2.2.2.1 (FastEthernet0/0), len 100, sending
So we are NATing the source to 2.2.2 .1 which is not on the physical interface. You can also do this for sub interface.
Is this what you was trying Cisco 3560 Switch to do?
没有评论:
发表评论