?
Solved

Cisco IOS Destination NAT

Posted on 2009-04-29
12
Medium Priority
?
1,787 Views
Last Modified: 2012-05-06
Can someone please tell me how to configure destination NAT on Cisco IOS? I have a web/mail server in the router's DMZ that resolves to the router's public IP (whatever.com = router's outside IP address) and users on the inside network need to be able to access it. Thanks!
0
Comment
Question by:Pugglewuggle
  • 7
  • 4
12 Comments
 
LVL 12

Accepted Solution

by:
Faruk Onder Yerli earned 1500 total points
ID: 24264612
if DMZ network is in same router with LAN, Cisco IOS can not make nat between that two interface. NAT logic in Cisco, you need to define interface direction. DMZ is inside, LAN is also inside. You cannot make inside-inside NAT. if one oft hem will be outside, this time public network ca not access to outside-outside network.

I know this sound is not comfortable but real. you have just a solution, you need to use different equipment (cisco, pix or other NAT capable router), you will redirect DMZ range to this router by PBR.

0
 
LVL 12

Author Comment

by:Pugglewuggle
ID: 24264671
Okay, so I do this with ASAs all the time. Are you sure IOS can't do this?
0
 
LVL 12

Author Comment

by:Pugglewuggle
ID: 24264687
Hmm... well can't I just apply a PBR policy to the inside interface on the router telling it to route traffic to the DMZ?
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 12

Expert Comment

by:Faruk Onder Yerli
ID: 24264695
yes i am sure. i told it is not working because interface direction definition. Even PIX 6.3 cannot do it. I think they have solved in ASA. I didin't try yet.
0
 
LVL 12

Author Comment

by:Pugglewuggle
ID: 24264702
Yes, it does work on ASAs... What about the PBR setup I mentioned? By traffic I meant all traffic destined for the IP of the outside interface.
0
 
LVL 12

Expert Comment

by:Faruk Onder Yerli
ID: 24264711
no PBR will redirect traffic to second NAT equipment. I have used enough long time this solution. I used 2 firewall. one them powerfull and make nAT to global access. Other of it just pix501 and it was working for DMZ NAT.
0
 
LVL 12

Expert Comment

by:Faruk Onder Yerli
ID: 24264742
you will apply destination rule to LAN interface that its ACL base  next hop will be other NAT router gateway.
0
 
LVL 12

Author Comment

by:Pugglewuggle
ID: 24264764
What a pain! I would have thought Cisco would have a solution for this common scenario. I guess they figure they can sell more stuff!
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 24265520
Not possible with IOS. Easy with ASA.
Best option is local DNS server that resolve site to local IP address instead of public IP address.
nat-on-a-stick is supposed to work, but it is not TAC supported and I've never been able to make it work
0
 
LVL 12

Author Comment

by:Pugglewuggle
ID: 24265561
Well, since neither of those are an option (no ASA or DNS server) and they have a 1720 too I guess I'll create a bridge-group on the 1720 and create a true DMZ using one of the interfaces attached to a switch and then send the other interface over to the 1721 to do the LAN. Geez.
0
 
LVL 12

Author Comment

by:Pugglewuggle
ID: 24268382
Okay, so I got the 1721 setup as the edge performint NAT/PAT at this location. The server is between the 1721 and the 1720. 1720 is not doing any NAT, so DNAT is not an option. For some reason I can't seem to get PBR configured to redirect requests from the 1720's other networks that are destined for the outside IP of the 1720. So here's a quick map with a description and I appreciate any help!
Map.jpg
0
 
LVL 12

Author Closing Comment

by:Pugglewuggle
ID: 31576076
This got me started on a solution, but didn't provide a direct answer.
0

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the hope of saving someone else's sanity... About a year ago we bought a Cisco 1921 router with two ADSL/VDSL EHWIC cards to load balance local network traffic over the two broadband lines we have, but we couldn't get the routing to work consi…
How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question