Link to home
Start Free TrialLog in
Avatar of David Blair
David BlairFlag for United States of America

asked on

Cisco 4000 NAT

I’ve looked through numerous NAT topics posted on EE.  According to the other articles, it appears I’ve got the configuration correct.  Still not working for me though.  Here’s the situation:

Cisco 4000
E0 is on Comcast
E2 is my internal network.
A FTP server resides at 192.168.3.18:21

Please refer to the pruned config below. I added a static NAT line for the server, but I can’t access the FTP from outside.  The translation also doesn’t appear when I do SH IP NET STAT.

FYI: S0 is a serial link to a 2500 and is for testing purposes only.  It shouldn’t be part of the problem, but I included it anyway.

Ideas?

-----------------------------------

Detroit#sh ru

ip subnet-zero
no ip domain-lookup
ip dhcp excluded-address 192.168.3.1 192.168.3.99
!
ip dhcp pool local
   network 192.168.3.0 255.255.255.0
   dns-server 68.87.64.196 68.42.244.5
   default-router 192.168.3.2
!
interface Ethernet0
 ip address dhcp
 ip nat outside
 media-type 10BaseT
!
interface Ethernet2
 ip address 192.168.3.2 255.255.255.0
 ip nat inside
 media-type 10BaseT
!
interface Serial0
 ip address 172.16.32.1 255.255.224.0
 ip nat inside
 clockrate 500000
!
router eigrp 1
 network 172.16.0.0
 network 192.168.3.0
 auto-summary
!
ip nat inside source list 1 interface Ethernet0 overload
ip nat inside source static tcp 192.168.3.18 21 interface Ethernet0 21
ip classless
ip forward-protocol spanning-tree
no ip http server
!
access-list 1 permit 192.168.3.0 0.0.0.255
!
end

-----------------------------------

Detroit#sh ip nat stat
Total active translations: 21 (0 static, 21 dynamic; 21 extended)
Outside interfaces:
  Ethernet0
Inside interfaces:
  Ethernet2, Serial0
Hits: 6  Misses: 3
Expired translations: 3
Dynamic mappings:
-- Inside Source
[Id: 1] access-list 1 interface Ethernet0 refcount 20
Detroit#
Avatar of Les Moore
Les Moore
Flag of United States of America image

It looks like you have all the right pieces, at least for outbound nat. Any problems with surfing the net or anything?

For FTP you also need port 20 for ftp-data..

Try adding this:
ip nat inside source static tcp 192.168.3.18 20 interface Ethernet0 20

And, you must attempt the ftp access from outside the network. You can't access the ftp server from inside host using public IP address..
Avatar of David Blair

ASKER

Net, aim and all are working fine.  I added the line you suggested and I still can't get FTP to work.

The 4000 is a replacement for a tired old Linksys router.  I simply had the FTP set as the DMZ and everything worked great.  Not sure if that helps.

Also, my FTP spftware is generating "cannot send reply" errors.  (??)

Why can't I use the public IP internally?  Is this a split horizon thing or what?
>Why can't I use the public IP internally?  Is this a split horizon thing or what?
Because it's a router and you must have separate subnets on each interface of the router.
Your inside LAN is 192.168.3.x
Your FTP server must be 192.168.3.18
Your FTP server default gateway must point to the router 192.168.3.2
Well I certainly understand that, but there's no reason I couldn't (for testing purposes only) connect to my FTP server using its public IP address.  If the port address translation is in place, I should be able to communicate with the serve.  All traffic would have to go through the ISP's default gateway, and the connection certainly wouldn't be LAN speed, the router shouldn't prevent this.

I still have this problem.  There must be something I'm missing, as the static NATs I've entered are not displayed when I issue a "show IP NAT trans"

Your thoughts?
ASKER CERTIFIED SOLUTION
Avatar of Les Moore
Les Moore
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial