nakoz69
asked on
Cisco 1800 and 3560 NAT Configuration
Equipment:
1 - Cisco 1800 Router
3 - Cisco 3560 switches
1 - Cisco 3750 8 pt gig L3 switch
Physical Connection:
Cisco 3750 (8pt) advanced IOS services (10.11.50.245)
|
Cisco 3560 (10.11.50.246)
| (outside)
Cisco 1800 Router (10.11.51.250)
| (inside) | (?)
Cisco 3560 (192.168.1.254) Cisco 3560 (192.168.1.253)
A few more details:
The 3750 is running an adv IOS to support L3 routing.
The 3560 is just a normal L2 switch with a single vlan
The Cisco 1800 Router is new out of the box with no special configuration except for the F0 port (192.168.1.250) and F1 port (10.11.51.250).
The bottom two Cisco 3560 are actually redundant switches. Only one is really communicating data while the other is in standby mode.
My questions are:
1. How do I static NAT from the 192.168.1.X network to the 10.11.51.X network so that the rest of the network can it?
- I imagine its something similar to:
ip nat inside source static 192.168.1.254 10.11.51.254
ip nat inside source static 192.168.1.253 10.11.51.253
2. Since I am using two switches for redundancy can I just plug them into one of the interfaces (fa2-9), or would I just be able to run 1 switch because I have to use the fa0 interface? If I can use the other 8 interfaces (fa2-9) how do they need to be configured.
This config has been KILLING me so any help is greatly appreciated.
1 - Cisco 1800 Router
3 - Cisco 3560 switches
1 - Cisco 3750 8 pt gig L3 switch
Physical Connection:
Cisco 3750 (8pt) advanced IOS services (10.11.50.245)
|
Cisco 3560 (10.11.50.246)
| (outside)
Cisco 1800 Router (10.11.51.250)
| (inside) | (?)
Cisco 3560 (192.168.1.254) Cisco 3560 (192.168.1.253)
A few more details:
The 3750 is running an adv IOS to support L3 routing.
The 3560 is just a normal L2 switch with a single vlan
The Cisco 1800 Router is new out of the box with no special configuration except for the F0 port (192.168.1.250) and F1 port (10.11.51.250).
The bottom two Cisco 3560 are actually redundant switches. Only one is really communicating data while the other is in standby mode.
My questions are:
1. How do I static NAT from the 192.168.1.X network to the 10.11.51.X network so that the rest of the network can it?
- I imagine its something similar to:
ip nat inside source static 192.168.1.254 10.11.51.254
ip nat inside source static 192.168.1.253 10.11.51.253
2. Since I am using two switches for redundancy can I just plug them into one of the interfaces (fa2-9), or would I just be able to run 1 switch because I have to use the fa0 interface? If I can use the other 8 interfaces (fa2-9) how do they need to be configured.
This config has been KILLING me so any help is greatly appreciated.
ASKER
Here is the config:
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname cisco1800
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
!
no aaa new-model
!
resource policy
!
!
!
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.1.254
!
ip dhcp pool sdm-pool
import all
network 192.168.1.0 255.255.255.0
default-router 192.168.1.254
lease 0 2
!
!
no ip domain lookup
!
!
enrollment selfsigned
revocation-check none
!
!
!
!
interface FastEthernet0
ip address 192.168.1.250 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet1
ip address 10.11.50.250 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
!
interface FastEthernet5
!
interface FastEthernet6
!
interface FastEthernet7
!
interface FastEthernet8
!
interface FastEthernet9
!
interface Vlan1
no ip address
ip tcp adjust-mss 1452
!
interface Vlan50
no ip address
!
interface Async1
no ip address
encapsulation slip
!
!
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source static 192.168.1.253 10.11.51.253
ip nat inside source static 192.168.1.254 10.11.51.254
!
!
control-plane
!
!
line con 0
login local
line 1
modem InOut
stopbits 1
speed 115200
flowcontrol hardware
!
!
!
no inservice
!
end
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname cisco1800
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
!
no aaa new-model
!
resource policy
!
!
!
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.1.254
!
ip dhcp pool sdm-pool
import all
network 192.168.1.0 255.255.255.0
default-router 192.168.1.254
lease 0 2
!
!
no ip domain lookup
!
!
enrollment selfsigned
revocation-check none
!
!
!
!
interface FastEthernet0
ip address 192.168.1.250 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet1
ip address 10.11.50.250 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
!
interface FastEthernet5
!
interface FastEthernet6
!
interface FastEthernet7
!
interface FastEthernet8
!
interface FastEthernet9
!
interface Vlan1
no ip address
ip tcp adjust-mss 1452
!
interface Vlan50
no ip address
!
interface Async1
no ip address
encapsulation slip
!
!
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source static 192.168.1.253 10.11.51.253
ip nat inside source static 192.168.1.254 10.11.51.254
!
!
control-plane
!
!
line con 0
login local
line 1
modem InOut
stopbits 1
speed 115200
flowcontrol hardware
!
!
!
no inservice
!
end
then the NAT configuration will be
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface fa1 overload
Do you need the outside host to reach the switches or the hosts inside?
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface fa1 overload
Do you need the outside host to reach the switches or the hosts inside?
ASKER
Yes the outside host will need to reach the inside hosts. However, do I need to setup 2 inside interfaces, since we have redundant switches on the inside, or can the fa2-9 ports even be used specifically as inside ports for NATing?
BTW thanks for all the help.
BTW thanks for all the help.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
What you need to do is something like this.
If the fa0/1 is outside
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface fa0/1 overload
This way all the internal host will be natted to the fa0/1 ip adrress,
Relating to the second point, assuming youre having only vlan 1,
you could run HSRP for redundancy, or GLBP to load balance between the two switches,
It doesn't matter what port you use to connect to the router, as long as that port is in the same vlan, and that vlan has an ip address of 192.168.1.x
can you post the 1800 config?