One to One NAT setup, ping works but any other traffic doesn't

I am trying to setup a one to one NAT for various IP's on other private networks that connect to our company network via point to point links. I have a test setup that I'm using to get things working and below are the cisco routers configs for the test lab scenerio. There are 3 routers and two PC's connected to this test network. One PC is on R1's E0 interface with ip 192.168.1.1 and the other PC is connected to R3's E0 interface with an IP of 10.210.102.1.

R1

interface Ethernet0/0
 ip address 192.168.1.254 255.255.255.0
 half-duplex
!
interface Serial0/0
 ip address 172.16.2.2 255.255.255.252
!
router eigrp 10
 network 10.0.0.0
 network 172.16.0.0
 network 192.168.1.0
 auto-summary

---------------------------------------------------------

R2

interface Ethernet0/0
 ip address 10.210.101.254 255.255.255.0
 ip nat inside
 half-duplex
!
interface Serial0/0
 ip address 172.16.1.1 255.255.255.252
!
interface Serial0/1
 ip address 172.16.2.1 255.255.255.252
 ip nat outside
!
router eigrp 10
 network 10.0.0.0
 network 172.16.0.0
 network 192.168.1.0
 auto-summary
 eigrp log-neighbor-changes
!
ip nat inside source static 192.168.1.1 10.210.101.50
ip classless
ip route 10.210.102.0 255.255.255.0 Serial0/0

-------------------------------------------------------

R3

interface Ethernet0/0
 ip address 10.210.102.254 255.255.255.0
 no ip directed-broadcast
!
interface Serial0/0
 ip address 172.16.1.2 255.255.255.252
 no ip directed-broadcast
!
router eigrp 10
 network 10.0.0.0
 network 172.16.0.0
 network 192.168.1.0
!

-------------------------------------------------------

With the above setup I can ping 10.210.101.50 from the PC at 10.210.102.1 without a problem and the PC at 192.168.1.1 can ping 10.210.102.1 as well. The issue now is that other than ping, I can't do anything else. I want to remote desktop for example and when I try remote desktop from 10.210.102.1 to the NAT address of 10.210.101.50 (which points to 192.168.1.1) nothing happens. Of course I can remote using 192.168.1.1, but the point is to do this using the NAT address.

So, what am I doing wrong? What do I need to add in order for ALL ports to work to the NAT address of 10.210.101.50 throughout the entire network?
acaveAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JFrederick29Commented:
Add "ip nat inside" to the Serial0/0 interface on R2.

interface Serial0/0
 ip address 172.16.1.1 255.255.255.252
 ip nat inside

0
mikebernhardtCommented:
On R2: Try

interface Serial0/0
 ip address 172.16.1.1 255.255.255.252
 ip nat outside
!
interface Serial0/1
 ip address 172.16.2.1 255.255.255.252
 ip nat intside

Also in EIGRP on all routers, you need to add the command
no auto-summary

This is because EIGRP automatically summarizes classfully on network boundaries, and your serial links are classful network boundaries. Fix this and you can remove the static route. (Also in EIGRP, FYI you don't need to add network statements for every network, only the ones that are actually on local interfaces.)

Ping sometimes works because the router may be answering for the NAT address, not the actual host.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
mikebernhardtCommented:
Oh- and take out ip nat inside on the Ethernet interface on R2.
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

acaveAuthor Commented:
Thanks for the replies so far.

I added "ip nat inside" on R2 serial 0/0 and removed "ip nat inside" on the E 0/0 interface of R2, but that hasn't fixed the problem yet.

I also add "no auto-summary" to each router and removed the static routes and now EIGRP is showing all the routes in the routing table correctly now, thanks for that. However, that still didn't fix the NAT issue.

I can ping the 192.168.1.1 address from the 10.210.102.1 PC, so even if the router is responding to my ping from 10.210.102.1 to the NAT IP of 10.210.101.50, at least I know the connectivity is actually there for communication to work.

There must be something else I have to do, but I'm stuck.
0
mikebernhardtCommented:
I think you need "ip nat outside" on serial 0/0, not "ip nat inside". Was your reply a typo?
0
acaveAuthor Commented:
Actually, I used "ip nat inside" on s 0/0 because JFredrick29 said to do so above, but maybe his answer was a typo.

I switched the interfaces so R2 s 0/0 is "ip nat outside" and R2 s 0/1 is "ip nat inside" and now I can ping AND remote desktop so it appears to be working, but with a new problem though. I shared resources (the c: drive) on the PC at 192.168.1.1 (nat address 10.210.101.50) but I can't see the shares from the PC at 10.210.102.1 when I run the command \\10.210.101.50. This seems very strange since I can ping and remote desktop to the 192.168.1.1 machine using the NAT address 10.210.101.50.

I really appreciate the responses and I will surely give Mike the points for the correct answer to my original question, but I'm now at a loss on this new dilemma. Anyone know what's causing this?
0
acaveAuthor Commented:
Umm, hold the phones, I think I know why. The PC at 10.210.102.1 ain't on the same subnet, so duuhhh, it should not see the local shares I guess. That's right isn't it?
0
mikebernhardtCommented:
I'm only a middling Windows guy, so I'm not going to venture a guess on that one. You might want to post your question to one of the Windows boards here at EE. Maybe it's some issue with NAT and Windows file sharing? Maybe just some sharing permissions issue? Dunno.
0
mikebernhardtCommented:
Crossed posts...

If they're in the same workgroup or domain and you access it by ip address I don't think it should be an issue. But like I said I'm not a Windows expert.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Routers

From novice to tech pro — start learning today.