[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 578
  • Last Modified:

Cisco Router single wan Dual IP NAT not working

We have a cisco 851W working as the office router.

We have several NATs configured pointing to some internal machines accessed from outside by some users.

Our ISP is going to replace the internet circuit with a new one, changing our IP address. They have already delivered their end point to the office.

Our plan was add this new IP address as secondary IP at router's wan, change DNS records, wait for worldwide refresh time swith which IP is primary and which is secondary and once we have confirmed the new circuit is stable disconnect the old one and  remove it's ip address.

I had added the secondary IP address

interface FastEthernet4
 ip address new_IP 255.255.255.248 secondary
 ip address OLD_IP 255.255.255.0
 ip access-group 101 in

but I discovered that none of the incoming nats is working.

Checked nats and they are configured used fastethernet4 and not the main IP address.

Checked the ACL and there it was configured by IP, added several entries at the ACL but it still not working.

access-list 101 permit tcp any host old_ip eq 6901
access-list 101 permit tcp any host new_ip eq 6901

Also I am not able to "duplicate" port forward from the new IP address to one of the already existing

something like

ip nat inside source static tcp 192.168.6.30 5900 interface fastethernet4 6904
ip nat inside source static tcp 192.168.6.30 5900 interface new_ip 6904

or

ip nat inside source static tcp 192.168.6.30 5900 interface fastethernet4 6904
ip nat inside source static tcp 192.168.6.30 5900 interface new_ip 6904 extendable


Is there a way to perform this?

Any further question please let me know.
0
Daniel Cardozo
Asked:
Daniel Cardozo
1 Solution
 
lrmooreCommented:
You have discovered the "feature" where you cannot have more than one outside ip/port natted to the same internal ip/port.
As soon as the switchover is made, just create new statics at that time and delete the old ones. Doesn't take 30 seconds if you have a script prepared. Also make sure acl 101 that is applied to the interface allows those ports to the new IP address.
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now