Question:
I have the
following on Cisco Catalyst 3560 an 1841.
PPPoE on
Fast0/0 works fine and picks up ISP address.
I have assigned
on the /29 address to fast0/1.2 and and created a LAN on fast0/1.1 using the
native VLAN.
I can ping the
/29 address from the internet and also ping the internal address from the LAN.
I added a NAT
statement (inside and outside to each sub interface).
I cannot
connect from the 192.168.199.0/24 network out via NAT. Is this possible with subinterfaces?
vpdn enable
!
interface
FastEthernet0/0
description
PPPOE WAN
no ip address
no ip redirects
no ip
unreachables
no ip proxy-arp
no ip
mroute-cache
duplex auto
speed auto
pppoe enable
group global
pppoe-client
dial-pool-number 1
no cdp enable
!
interface
FastEthernet0/1
no ip address
duplex auto
speed auto
!
interface
FastEthernet0/1.1
encapsulation
dot1Q 1 native
ip address
192.168.199.1 255.255.255.0
ip nat inside
ip
virtual-reassembly
!
interface
FastEthernet0/1.2
encapsulation
dot1Q 2
ip address
81.143.105.77 255.255.255.248
ip nat outside
ip
virtual-reassembly
!
!
interface
Dialer1
ip address
negotiated
no ip
unreachables
ip mtu 1492
encapsulation
ppp
ip tcp
adjust-mss 1452
no ip
mroute-cache
dialer pool 1
dialer-group 1
no cdp enable
ppp chap
hostname ******
ppp chap
password 0 *****
!
ip route 0.0.0 .0
0.0.0.0 Dialer1 2
ip nat inside
source list 10 interface FastEthernet0/1.2 overload
!
access-list 10
permit 192.168.199.0 0.0.0 .255
dialer-list 1
protocol ip permit
Answer:
I have the
following:
I think this is
what you want to do? Anything from inside - Client_Inside will be translated to
2.2.2 .1 when I try to ping R2 which has a
loopback of 1.1.1.1.
So all packets
that are generated from the inside will be translated with a source address of 2.2.2 .1.
I have added a route of 2.2.2.1 back to R1 where the loopback exists.
here are the
configs:
CLIENT_INSDIE#show
run
Building
configuration...
Current
configuration : 827 bytes
!
version 12.4
service
timestamps debug datetime msec
service
timestamps log datetime msec
no service
password-encryption
!
hostname
CLIENT_INSDIE
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size
iomem 5
ip cef
!
no ip domain
lookup
ip domain name
lab.local
ip auth-proxy
max-nodata-conns 3
ip admission
max-nodata-conns 3
!
interface
FastEthernet0/0
ip address dhcp
duplex auto
speed auto
!
interface
FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
ip
forward-protocol nd
!
!
no ip http
server
no ip http
secure-server
!
!
control-plane
!
!
!
line con 0
exec-timeout 0
0
privilege level
15
logging
synchronous
line aux 0
exec-timeout 0
0
privilege level
15
logging
synchronous
line vty 0 4
login
!
!
end
CLIENT_INSDIE#
CLIENT_INSDIE#show
ip int brie
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 20.0.0 .101 YES DHCP
up up
FastEthernet0/1 unassigned YES unset
administratively down down
=======================================================================
R1#show run
Building
configuration...
*Mar 1 00:41:27.515: %SYS-5-CONFIG_I: Configured
from console by console
Current
configuration : 1323 bytes
!
version 12.4
service
timestamps debug datetime msec
service
timestamps log datetime msec
no service
password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa
new-model
memory-size iomem
5
ip cef
!
!
no ip dhcp use
vrf connected
ip dhcp
excluded-address 20.0.0 .0 20.0.0.100
!
ip dhcp pool 1
network 20.0.0 .0
255.255.255.0
default-router 20.0.0 .1
!
!
no ip domain
lookup
ip domain name
lab.local
ip auth-proxy
max-nodata-conns 3
ip admission
max-nodata-conns 3
!
!
interface
Loopback0
ip address 2.2.2 .1
255.255.255.255
!
interface
FastEthernet0/0
ip address 10.0.0 .1
255.255.255.252
ip nat outside
ip
virtual-reassembly
duplex auto
speed auto
!
interface
FastEthernet0/1
ip address 20.0.0 .1
255.255.255.0
ip nat inside
ip
virtual-reassembly
duplex auto
speed auto
!
ip
forward-protocol nd
ip route 0.0.0 .0
0.0.0.0 10.0.0.2
!
!
no ip http
server
no ip http
secure-server
ip nat pool
test 2.2.2 .1 2.2.2.1 netmask 255.255.255.252
ip nat inside
source list 100 pool test overload
!
access-list 100
permit ip 20.0.0 .0 0.0.0.255 any
!
!
!
line con 0
exec-timeout 0
0
privilege level
15
logging
synchronous
line aux 0
exec-timeout 0
0
privilege level
15
logging
synchronous
line vty 0 4
login
!
!
end
R1#show ip
route
Codes: C -
connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O -
OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 -
OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF
external type 2
i - IS-IS, su - IS-IS summary, L1 -
IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate
default, U - per-user static route
o - ODR, P - periodic downloaded static
route
Gateway of last
resort is 10.0.0 .2 to network 0.0.0.0
C 2.2.2 .1
is directly connected, Loopback0
C 20.0.0 .0
is directly connected, FastEthernet0/1
C 10.0.0 .0
is directly connected, FastEthernet0/0
S* 0.0.0 .0/0
[1/0] via 10.0.0 .2
=======================================================================
R2#show run
Building
configuration...
Current
configuration : 934 bytes
!
version 12.4
service
timestamps debug datetime msec
service
timestamps log datetime msec
no service
password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa
new-model
memory-size
iomem 5
ip cef
!
!
no ip domain
lookup
ip domain name
lab.local
ip auth-proxy
max-nodata-conns 3
ip admission
max-nodata-conns 3
!
!
interface
Loopback1
ip address 1.1.1 .1
255.255.255.0
!
interface
FastEthernet0/0
ip address 10.0.0 .2
255.255.255.252
duplex auto
speed auto
!
interface
FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
ip
forward-protocol nd
ip route 2.2.2 .1
255.255.255.255 10.0.0.1
!
!
no ip http
server
no ip http
secure-server
!
!
line con 0
exec-timeout 0
0
privilege level
15
logging
synchronous
line aux 0
exec-timeout 0
0
privilege level
15
logging
synchronous
line vty 0 4
login
!
!
end
Now I will ping
1.1.1 .1 from client router:
CLIENT_INSDIE#ping
1.1.1 .1
Type escape
sequence to abort.
Sending 5,
100-byte ICMP Echos to 1.1.1 .1, timeout is 2
seconds:
!!!!!
Success rate is
100 percent (5/5), round-trip min/avg/max = 40/48/64 ms
=======================================================
R1#
*Mar 1 00:45:51.783: NAT*: s=20.0.0 .101->2.2.2.1,
d=1.1.1.1 [75]
*Mar 1 00:45:51.811: NAT*: s=1.1.1 .1,
d=2.2.2.1->20.0.0.101 [75]
*Mar 1 00:45:51.847: NAT*: s=20.0.0 .101->2.2.2.1,
d=1.1.1.1 [76]
*Mar 1 00:45:51.867: NAT*: s=1.1.1 .1,
d=2.2.2.1->20.0.0.101 [76]
*Mar 1 00:45:51.887: NAT*: s=20.0.0 .101->2.2.2.1,
d=1.1.1.1 [77]
*Mar 1 00:45:51.911: NAT*: s=1.1.1 .1,
d=2.2.2.1->20.0.0.101 [77]
*Mar 1 00:45:51.931: NAT*: s=20.0.0 .101->2.2.2.1,
d=1.1.1.1 [78]
*Mar 1 00:45:51.947: NAT*: s=1.1.1 .1,
d=2.2.2.1->20.0.0.101 [78]
*Mar 1 00:45:51.975: NAT*: s=20.0.0 .101->2.2.2.1,
d=1.1.1.1 [79]
*Mar 1 00:45:51.995: NAT*: s=1.1.1 .1,
d=2.2.2.1->20.0.0.101 [79]
R1#
*Mar 1 00:46:19.939: NAT: expiring 2.2.2 .1
(20.0.0.101) icmp 14 (14)
R1#show ip nat
translations
Pro Inside
global Inside local Outside local Outside global
icmp
2.2.2 .1:13 20.0.0 .101:13 1.1.1 .1:13 1.1.1 .1:13
=======================================================
R2#
*Mar 1 00:45:24.731: IP: tableid=0, s=2.2.2 .1
(FastEthernet0/0), d=1.1.1.1 (Loopback1), routed via RIB
*Mar 1 00:45:24.735: IP: s=2.2.2 .1
(FastEthernet0/0), d=1.1.1.1, len 100, rcvd 4
*Mar 1 00:45:24.735: IP: tableid=0, s=1.1.1 .1
(local), d=2.2.2.1 (FastEthernet0/0), routed via FIB
*Mar 1 00:45:24.735: IP: s=1.1.1 .1
(local), d=2.2.2.1 (FastEthernet0/0), len 100, sending
*Mar 1 00:45:24.799: IP: tableid=0, s=2.2.2 .1
(FastEthernet0/0), d=1.1.1.1 (Loopback1), routed via RIB
*Mar 1 00:45:24.799: IP: s=2.2.2 .1
(FastEthernet0/0), d=1.1.1.1, len 100, rcvd 4
*Mar 1 00:45:24.799: IP: tableid=0, s=1.1.1 .1
(local), d=2.2.2.1 (FastEthernet0/0), routed via FIB
*Mar 1 00:45:24.799: IP: s=1.1.1 .1
(local), d=2.2.2.1 (FastEthernet0/0), len 100, sending
*Mar 1 00:45:24.855: IP: tableid=0, s=2.2.2 .1
(FastEthernet0/0), d=1.1.1.1 (Loopback1), routed via RIB
*Mar 1 00:45:24.855: IP: s=2.2.2 .1
(FastEthernet0/0), d=1.1.1.1, len 100, rcvd 4
*Mar 1 00:45:24.855: IP: tableid=0, s=1.1.1 .1
(local), d=2.2.2.1 (FastEthernet0/0), routed via FIB
*Mar 1 00:45:24.855: IP: s=1.1.1 .1
(local), d=2.2.2.1 (FastEthernet0/0), len 100, sending
*Mar 1 00:45:24.895: IP: tableid=0, s=2.2.2 .1
(FastEthernet0/0), d=1.1.1.1 (Loopback1), routed via RIB
*Mar 1 00:45:24.895: IP: s=2.2.2 .1
(FastEthernet0/0), d=1.1.1.1, len 100, rcvd 4
*Mar 1 00:45:24.895: IP: tableid=0, s=1.1.1 .1
(local), d=2.2.2.1 (FastEthernet0/0), routed via FIB
*Mar 1 00:45:24.895: IP: s=1.1.1 .1
(local), d=2.2.2.1 (FastEthernet0/0), len 100, sending
*Mar 1 00:45:24.939: IP: tableid=0, s=2.2.2 .1
(FastEthernet0/0), d=1.1.1.1 (Loopback1), routed via RIB
*Mar 1 00:45:24.939: IP: s=2.2.2 .1
(FastEthernet0/0), d=1.1.1.1, len 100, rcvd 4
*Mar 1 00:45:24.939: IP: tableid=0, s=1.1.1 .1
(local), d=2.2.2.1 (FastEthernet0/0), routed via FIB
*Mar 1 00:45:24.939: IP: s=1.1.1 .1
(local), d=2.2.2.1 (FastEthernet0/0), len 100, sending
So we are
NATing the source to 2.2.2 .1 which is not on the
physical interface. You can also do this for sub interface.
Is this what
you was trying Cisco 3560 Switch to do?
没有评论:
发表评论