Link to home
Start Free TrialLog in
Avatar of nakoz69
nakoz69

asked on

Cisco 1800 and 3560 NAT Configuration

Equipment:
1 - Cisco 1800 Router
3 - Cisco 3560 switches
1 - Cisco 3750 8 pt gig L3 switch
Physical Connection:
                                                       Cisco 3750 (8pt) advanced IOS services (10.11.50.245)
                                                                                   |
                                                               Cisco 3560 (10.11.50.246)
                                                                                    | (outside)
                                                          Cisco 1800 Router (10.11.51.250)
                                                                    |  (inside)                       | (?)
                                         Cisco 3560 (192.168.1.254)        Cisco 3560 (192.168.1.253)

A few more details:  
The 3750 is running an adv IOS to support L3 routing.
The 3560 is just a normal L2 switch with a single vlan  
The Cisco 1800 Router is new out of the box with no special configuration except for the F0 port (192.168.1.250) and F1 port (10.11.51.250).
The bottom two Cisco 3560 are actually redundant switches.  Only one is really communicating data while the other is in standby mode.  

My questions are:
1. How do I static NAT from the 192.168.1.X network to the 10.11.51.X network so that the rest of the network can it?
- I imagine its something similar to:
      ip nat inside source static 192.168.1.254 10.11.51.254
      ip nat inside source static 192.168.1.253 10.11.51.253
2. Since I am using two switches for redundancy can I just plug them into one of the interfaces (fa2-9), or would I just be able to run 1 switch because I have to use the fa0 interface?  If I can use the other 8 interfaces (fa2-9) how do they need to be configured.

This config has been KILLING me so any help is greatly appreciated.
Avatar of cyoncon
cyoncon
Flag of Ecuador image

ok, on the router 1800 which interface is facing the outside, and which the inside, ?
What you need to do is something like this.

If the fa0/1 is outside

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface fa0/1 overload

This way all the internal host will be natted to the fa0/1 ip adrress,

Relating to the second point, assuming youre having only vlan 1,
you could run HSRP for redundancy, or GLBP to load balance between the two switches,
It doesn't matter what port you use to connect to the router, as long as that port is in the same vlan, and that vlan has an ip address of 192.168.1.x

can you post the 1800 config?
Avatar of nakoz69
nakoz69

ASKER

Here is the config:

service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname cisco1800
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
!
no aaa new-model
!
resource policy
!
!
!
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.1.254
!
ip dhcp pool sdm-pool
   import all
   network 192.168.1.0 255.255.255.0
   default-router 192.168.1.254
   lease 0 2
!
!
no ip domain lookup
!
!
 enrollment selfsigned
 revocation-check none
!
!
!
!
interface FastEthernet0
 ip address 192.168.1.250 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface FastEthernet1
 ip address 10.11.50.250 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
!
interface FastEthernet5
!
interface FastEthernet6
!
interface FastEthernet7
!
interface FastEthernet8
!
interface FastEthernet9
!
interface Vlan1
 no ip address
 ip tcp adjust-mss 1452
!
interface Vlan50
 no ip address
!
interface Async1
 no ip address
 encapsulation slip
!
!
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source static 192.168.1.253 10.11.51.253
ip nat inside source static 192.168.1.254 10.11.51.254
!
!
control-plane
!
!
line con 0
 login local
line 1
 modem InOut
 stopbits 1
 speed 115200
 flowcontrol hardware
!
!
 !
 no inservice
!
end
then the NAT configuration will be

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface fa1 overload

Do you need the outside host to reach the switches or the hosts inside?
Avatar of nakoz69

ASKER

Yes the outside host will need to reach the inside hosts.  However, do I need to setup 2 inside interfaces, since we have redundant switches on the inside, or can the fa2-9 ports even be used specifically as inside ports for NATing?

BTW thanks for all the help.
ASKER CERTIFIED SOLUTION
Avatar of cyoncon
cyoncon
Flag of Ecuador image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial