Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 3227
  • Last Modified:

route-map nonat permit 10 ?

What is this command doing?

route-map nonat permit 10
0
gateguard
Asked:
gateguard
  • 2
  • 2
1 Solution
 
Pete LongTechnical ConsultantCommented:
Hi gateguard,
See Irmoores comments here http://oldlook.experts-exchange.com/Hardware/Routers/Q_20705266.html

PeteL
0
 
Pete LongTechnical ConsultantCommented:
gateguard,
! *  Use a route map to define which traffic from the private

! *  network should be included in the NAT process:

 

route-map nonat permit 10

 match ip address 150

http://www.siliconvalleyccie.com/cisco-hn/vpn-cisco.htm
PL
0
 
Robing66066Commented:
That looks like a line in a VPN router config.  If so, there should be a corresponding line that says something like '
ip nat inside source route-map nonat interface Ethernet0 overload '

Basically, it differentiates VPN 'interesting traffic' from traffic bound for the Internet. As Pete shows, it should be followed by a match ip address line that you can line up with an access list line (such as 'access-list 150 permit ip 10.10.130.0 0.0.0.255 10.10.0.0 0.0.255.255').  Whatever is in the access list is enacted on the traffic heading to the Internet.

So, if you had this in your config:

ip nat inside source route-map nonat interface Ethernet0 overload
route-map nonat permit 10
   match ip address 150

access-list 150 deny   ip 10.10.130.0 0.0.0.255 10.10.0.0 0.0.255.255
access-list 150 permit ip 10.10.130.0 0.0.0.255 any

All traffic from 10.10.130.0 destined for 10.10.0.0 would be denied access to the Internet.
All traffic from 10.10.130.0 destined for anywhere else would be allowed out to the Internet.  (And NATted.)

I *believe* that the 10 reference speaks to the number you used for your crypto isakmp policy, but I'm not sure.
 

0
 
Robing66066Commented:
That looks like a line in a VPN router config.  If so, there should be a corresponding line that says something like '
ip nat inside source route-map nonat interface Ethernet0 overload '

Basically, it differentiates VPN 'interesting traffic' from traffic bound for the Internet. As Pete shows, it should be followed by a match ip address line that you can line up with an access list line (such as 'access-list 150 permit ip 10.10.130.0 0.0.0.255 10.10.0.0 0.0.255.255').  Whatever is in the access list is enacted on the traffic heading to the Internet.

So, if you had this in your config:

ip nat inside source route-map nonat interface Ethernet0 overload
route-map nonat permit 10
   match ip address 150

access-list 150 deny   ip 10.10.130.0 0.0.0.255 10.10.0.0 0.0.255.255
access-list 150 permit ip 10.10.130.0 0.0.0.255 any

All traffic from 10.10.130.0 destined for 10.10.0.0 would be denied access to the Internet.
All traffic from 10.10.130.0 destined for anywhere else would be allowed out to the Internet.  (And NATted.)

I *believe* that the 10 reference speaks to the number you used for your crypto isakmp policy, but I'm not sure.
 

0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now