Advertisement

05.09.2008 at 09:41AM PDT, ID: 23390062 | Points: 500
[x]
Attachment Details

Dynamic translation before static translation when using Static with route-maps

Asked by wanstor in Virtual Private Networking (VPN), Network Routers, Networking Hardware Firewalls

Tags: , , ,

Hi,
I have a problem in that I want to have an entire network PAT'd out to 1 IP address (interface address is fine) and one host to be statically NAT'd out.  There is a VPN configured too, and the static NAT'd machine still needs to access resources accross the VPN.
I have configured this, but when I set the static address and use the route-map (to allow this host to traverse the VPN), the host that should be statically mapped appears in the nat translation table as PATing to the interface IP, not the global static.  Plus, whatismyip.com confirms this is the case too.  However, when i open up ports on the global static address, i can see the machine behind it just fine (therefore outbound -> inside works fine, but inside -> outside gets NATd to the wrong address).

overview:
inside lan - 192.168.1.1/24
Remote network - 172.30.7.0/24
PAT address - xxx.xxx.xxx.113
Global Static - xxx.xxx.xxx.115

If i take out the route-map from the static, it works as expected, but then the host cannot communicate accross the VPN

Here is the relevant parts of my config:Start Free Trial
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
interface Vlan1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 
interface Dialer0
 ip address xxx.xxx.xxx.113 255.255.255.248
 ip nat outside
 
ip nat inside source route-map noNATdynamic1 int Dialer0 overload
ip nat inside source static 192.168.1.10 xxx.xxx.xxx.115 route-map noNATstatic1
 
access-list 105 deny   ip 192.168.1.0 0.0.0.255 172.30.7.0 0.0.0.255
access-list 105 permit ip 192.168.1.0 0.0.0.255 any
access-list 114 deny   ip host 192.168.1.10 172.30.7.0 0.0.0.255
access-list 114 permit   ip host 192.168.1.10 any
route-map noNATdynamic1 permit 1
 match ip address 105
route-map noNATstatic1 permit 10
 match ip address 114
[+][-]05.12.2008 at 08:17AM PDT, ID: 21547704

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]05.12.2008 at 06:28PM PDT, ID: 21551647

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]05.13.2008 at 02:21AM PDT, ID: 21553333

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]05.13.2008 at 05:05AM PDT, ID: 21554151

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]05.28.2008 at 04:46AM PDT, ID: 21659487

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06.24.2008 at 01:32AM PDT, ID: 21853407

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
 
Loading Advertisement...
20080716-EE-VQP-32 / EE_QW_2_20070628