David Blair
asked on
Cisco 4000 NAT
I’ve looked through numerous NAT topics posted on EE. According to the other articles, it appears I’ve got the configuration correct. Still not working for me though. Here’s the situation:
Cisco 4000
E0 is on Comcast
E2 is my internal network.
A FTP server resides at 192.168.3.18:21
Please refer to the pruned config below. I added a static NAT line for the server, but I can’t access the FTP from outside. The translation also doesn’t appear when I do SH IP NET STAT.
FYI: S0 is a serial link to a 2500 and is for testing purposes only. It shouldn’t be part of the problem, but I included it anyway.
Ideas?
-------------------------- ---------
Detroit#sh ru
ip subnet-zero
no ip domain-lookup
ip dhcp excluded-address 192.168.3.1 192.168.3.99
!
ip dhcp pool local
network 192.168.3.0 255.255.255.0
dns-server 68.87.64.196 68.42.244.5
default-router 192.168.3.2
!
interface Ethernet0
ip address dhcp
ip nat outside
media-type 10BaseT
!
interface Ethernet2
ip address 192.168.3.2 255.255.255.0
ip nat inside
media-type 10BaseT
!
interface Serial0
ip address 172.16.32.1 255.255.224.0
ip nat inside
clockrate 500000
!
router eigrp 1
network 172.16.0.0
network 192.168.3.0
auto-summary
!
ip nat inside source list 1 interface Ethernet0 overload
ip nat inside source static tcp 192.168.3.18 21 interface Ethernet0 21
ip classless
ip forward-protocol spanning-tree
no ip http server
!
access-list 1 permit 192.168.3.0 0.0.0.255
!
end
-------------------------- ---------
Detroit#sh ip nat stat
Total active translations: 21 (0 static, 21 dynamic; 21 extended)
Outside interfaces:
Ethernet0
Inside interfaces:
Ethernet2, Serial0
Hits: 6 Misses: 3
Expired translations: 3
Dynamic mappings:
-- Inside Source
[Id: 1] access-list 1 interface Ethernet0 refcount 20
Detroit#
Cisco 4000
E0 is on Comcast
E2 is my internal network.
A FTP server resides at 192.168.3.18:21
Please refer to the pruned config below. I added a static NAT line for the server, but I can’t access the FTP from outside. The translation also doesn’t appear when I do SH IP NET STAT.
FYI: S0 is a serial link to a 2500 and is for testing purposes only. It shouldn’t be part of the problem, but I included it anyway.
Ideas?
--------------------------
Detroit#sh ru
ip subnet-zero
no ip domain-lookup
ip dhcp excluded-address 192.168.3.1 192.168.3.99
!
ip dhcp pool local
network 192.168.3.0 255.255.255.0
dns-server 68.87.64.196 68.42.244.5
default-router 192.168.3.2
!
interface Ethernet0
ip address dhcp
ip nat outside
media-type 10BaseT
!
interface Ethernet2
ip address 192.168.3.2 255.255.255.0
ip nat inside
media-type 10BaseT
!
interface Serial0
ip address 172.16.32.1 255.255.224.0
ip nat inside
clockrate 500000
!
router eigrp 1
network 172.16.0.0
network 192.168.3.0
auto-summary
!
ip nat inside source list 1 interface Ethernet0 overload
ip nat inside source static tcp 192.168.3.18 21 interface Ethernet0 21
ip classless
ip forward-protocol spanning-tree
no ip http server
!
access-list 1 permit 192.168.3.0 0.0.0.255
!
end
--------------------------
Detroit#sh ip nat stat
Total active translations: 21 (0 static, 21 dynamic; 21 extended)
Outside interfaces:
Ethernet0
Inside interfaces:
Ethernet2, Serial0
Hits: 6 Misses: 3
Expired translations: 3
Dynamic mappings:
-- Inside Source
[Id: 1] access-list 1 interface Ethernet0 refcount 20
Detroit#
ASKER
Net, aim and all are working fine. I added the line you suggested and I still can't get FTP to work.
The 4000 is a replacement for a tired old Linksys router. I simply had the FTP set as the DMZ and everything worked great. Not sure if that helps.
Also, my FTP spftware is generating "cannot send reply" errors. (??)
Why can't I use the public IP internally? Is this a split horizon thing or what?
The 4000 is a replacement for a tired old Linksys router. I simply had the FTP set as the DMZ and everything worked great. Not sure if that helps.
Also, my FTP spftware is generating "cannot send reply" errors. (??)
Why can't I use the public IP internally? Is this a split horizon thing or what?
>Why can't I use the public IP internally? Is this a split horizon thing or what?
Because it's a router and you must have separate subnets on each interface of the router.
Your inside LAN is 192.168.3.x
Your FTP server must be 192.168.3.18
Your FTP server default gateway must point to the router 192.168.3.2
Because it's a router and you must have separate subnets on each interface of the router.
Your inside LAN is 192.168.3.x
Your FTP server must be 192.168.3.18
Your FTP server default gateway must point to the router 192.168.3.2
ASKER
Well I certainly understand that, but there's no reason I couldn't (for testing purposes only) connect to my FTP server using its public IP address. If the port address translation is in place, I should be able to communicate with the serve. All traffic would have to go through the ISP's default gateway, and the connection certainly wouldn't be LAN speed, the router shouldn't prevent this.
I still have this problem. There must be something I'm missing, as the static NATs I've entered are not displayed when I issue a "show IP NAT trans"
Your thoughts?
I still have this problem. There must be something I'm missing, as the static NATs I've entered are not displayed when I issue a "show IP NAT trans"
Your thoughts?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
For FTP you also need port 20 for ftp-data..
Try adding this:
ip nat inside source static tcp 192.168.3.18 20 interface Ethernet0 20
And, you must attempt the ftp access from outside the network. You can't access the ftp server from inside host using public IP address..