?
Solved

Cisco IOS Policy Based NAT

Posted on 2010-01-11
2
Medium Priority
?
909 Views
Last Modified: 2012-05-08
We have a new policy not to route any Internet addresses on our internal network and now we need to NAT our customer's Internet addresses to a 10.x.x.x address.  I only want to NAT the destination when traffic is sourced from a specific host, for testing purposes.

We are already translating 10.206.0.139 to 10.207.0.139 due to customer requirements.
ip nat inside source static 10.206.0.139 10.207.0.139

Source: 10.206.0.139
Destination: 63.76.164.134
Source NAT: 10.207.0.139
Destination NAT: 10.41.16.75

The source NAT is working with the static NAT statement, but the destination NAT is not.

I have setup a NAT pool...
ip nat pool vp-63.76.164.134 10.41.16.75 10.41.16.75 prefix-length 29

I have setup an access list...
Extended IP access list nat-vp-63.76.164.134
    10 permit ip host 63.76.164.134 host 10.206.0.139
    11 permit ip host 10.206.0.139 host 63.76.164.134
    12 permit ip host 63.76.164.134 host 10.207.0.139
    13 permit ip host 10.207.0.139 host 63.76.164.134

I have added this NAT statement...
ip nat outside source list nat-vp-63.76.164.134 pool vp-63.76.164.134

Am I on the right track?  What might I be missing?
ip nat pool vp-63.76.164.134 10.41.16.75 10.41.16.75 prefix-length 29

ip nat outside source list nat-vp-63.76.164.134 pool vp-63.76.164.134

Extended IP access list nat-vp-63.76.164.134
    10 permit ip host 63.76.164.134 host 10.206.0.139
    12 permit ip host 10.206.0.139 host 63.76.164.134
    15 permit ip host 63.76.164.134 host 10.207.0.139

Open in new window

0
Comment
Question by:surfn008
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 22

Accepted Solution

by:
Jody Lemoine earned 2000 total points
ID: 26289754
The destination NAT can be accomplished with the following statement:

ip nat outside source static 63.76.164.134 10.41.16.75 add-route

Unfortunately, the "ip nat outside source static" command doesn't take route maps to allow for policy, so it's going to affect traffic globally.
0
 
LVL 20

Expert Comment

by:MightySW
ID: 26296038
Hi Jody, can you give me advice on how to get more involved with Cisco gear?  I am like you and I have been doing this for years.  I have my CCNA, but as you know that is just a stepping stone.  Is there one piece of literature or whitepage out there that you can specifically say helped you in one area or another?  More specifically switching, routing, advanced switching and advanced routing?

Let me know.  You can hit me up on my profile via email if you want.

Thanks Jody.

Steve
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this tutorial I will show you with short command examples how to obtain a packet footprint of all traffic flowing thru your Juniper device running ScreenOS. I do not know the exact firmware requirement, but I think the fprofile command is availab…
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question