Solved

route-map nonat permit 10 ?

Posted on 2003-12-01
4
3,071 Views
Last Modified: 2007-12-19
What is this command doing?

route-map nonat permit 10
0
Comment
Question by:gateguard
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 57

Expert Comment

by:Pete Long
ID: 9850672
Hi gateguard,
See Irmoores comments here http://oldlook.experts-exchange.com/Hardware/Routers/Q_20705266.html

PeteL
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 9850687
gateguard,
! *  Use a route map to define which traffic from the private

! *  network should be included in the NAT process:

 

route-map nonat permit 10

 match ip address 150

http://www.siliconvalleyccie.com/cisco-hn/vpn-cisco.htm
PL
0
 
LVL 7

Accepted Solution

by:
Robing66066 earned 300 total points
ID: 9852664
That looks like a line in a VPN router config.  If so, there should be a corresponding line that says something like '
ip nat inside source route-map nonat interface Ethernet0 overload '

Basically, it differentiates VPN 'interesting traffic' from traffic bound for the Internet. As Pete shows, it should be followed by a match ip address line that you can line up with an access list line (such as 'access-list 150 permit ip 10.10.130.0 0.0.0.255 10.10.0.0 0.0.255.255').  Whatever is in the access list is enacted on the traffic heading to the Internet.

So, if you had this in your config:

ip nat inside source route-map nonat interface Ethernet0 overload
route-map nonat permit 10
   match ip address 150

access-list 150 deny   ip 10.10.130.0 0.0.0.255 10.10.0.0 0.0.255.255
access-list 150 permit ip 10.10.130.0 0.0.0.255 any

All traffic from 10.10.130.0 destined for 10.10.0.0 would be denied access to the Internet.
All traffic from 10.10.130.0 destined for anywhere else would be allowed out to the Internet.  (And NATted.)

I *believe* that the 10 reference speaks to the number you used for your crypto isakmp policy, but I'm not sure.
 

0
 
LVL 7

Expert Comment

by:Robing66066
ID: 9852667
That looks like a line in a VPN router config.  If so, there should be a corresponding line that says something like '
ip nat inside source route-map nonat interface Ethernet0 overload '

Basically, it differentiates VPN 'interesting traffic' from traffic bound for the Internet. As Pete shows, it should be followed by a match ip address line that you can line up with an access list line (such as 'access-list 150 permit ip 10.10.130.0 0.0.0.255 10.10.0.0 0.0.255.255').  Whatever is in the access list is enacted on the traffic heading to the Internet.

So, if you had this in your config:

ip nat inside source route-map nonat interface Ethernet0 overload
route-map nonat permit 10
   match ip address 150

access-list 150 deny   ip 10.10.130.0 0.0.0.255 10.10.0.0 0.0.255.255
access-list 150 permit ip 10.10.130.0 0.0.0.255 any

All traffic from 10.10.130.0 destined for 10.10.0.0 would be denied access to the Internet.
All traffic from 10.10.130.0 destined for anywhere else would be allowed out to the Internet.  (And NATted.)

I *believe* that the 10 reference speaks to the number you used for your crypto isakmp policy, but I'm not sure.
 

0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
can't ssh to external IP 9 63
Internet testing device? 5 50
How to transfer long file names 5 62
Exchange 2013 will not send or receive 9 21
#Citrix #Citrix Netscaler #HTTP Compression #Load Balance
Meet the world's only “Transparent Cloud™” from Superb Internet Corporation. Now, you can experience firsthand a cloud platform that consistently outperforms Amazon Web Services (AWS), IBM’s Softlayer, and Microsoft’s Azure when it comes to CPU and …
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question