• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 922
  • Last Modified:

Cisco IOS Policy Based NAT

We have a new policy not to route any Internet addresses on our internal network and now we need to NAT our customer's Internet addresses to a 10.x.x.x address.  I only want to NAT the destination when traffic is sourced from a specific host, for testing purposes.

We are already translating 10.206.0.139 to 10.207.0.139 due to customer requirements.
ip nat inside source static 10.206.0.139 10.207.0.139

Source: 10.206.0.139
Destination: 63.76.164.134
Source NAT: 10.207.0.139
Destination NAT: 10.41.16.75

The source NAT is working with the static NAT statement, but the destination NAT is not.

I have setup a NAT pool...
ip nat pool vp-63.76.164.134 10.41.16.75 10.41.16.75 prefix-length 29

I have setup an access list...
Extended IP access list nat-vp-63.76.164.134
    10 permit ip host 63.76.164.134 host 10.206.0.139
    11 permit ip host 10.206.0.139 host 63.76.164.134
    12 permit ip host 63.76.164.134 host 10.207.0.139
    13 permit ip host 10.207.0.139 host 63.76.164.134

I have added this NAT statement...
ip nat outside source list nat-vp-63.76.164.134 pool vp-63.76.164.134

Am I on the right track?  What might I be missing?
ip nat pool vp-63.76.164.134 10.41.16.75 10.41.16.75 prefix-length 29

ip nat outside source list nat-vp-63.76.164.134 pool vp-63.76.164.134

Extended IP access list nat-vp-63.76.164.134
    10 permit ip host 63.76.164.134 host 10.206.0.139
    12 permit ip host 10.206.0.139 host 63.76.164.134
    15 permit ip host 63.76.164.134 host 10.207.0.139

Open in new window

0
surfn008
Asked:
surfn008
1 Solution
 
Jody LemoineNetwork ArchitectCommented:
The destination NAT can be accomplished with the following statement:

ip nat outside source static 63.76.164.134 10.41.16.75 add-route

Unfortunately, the "ip nat outside source static" command doesn't take route maps to allow for policy, so it's going to affect traffic globally.
0
 
MightySWCommented:
Hi Jody, can you give me advice on how to get more involved with Cisco gear?  I am like you and I have been doing this for years.  I have my CCNA, but as you know that is just a stepping stone.  Is there one piece of literature or whitepage out there that you can specifically say helped you in one area or another?  More specifically switching, routing, advanced switching and advanced routing?

Let me know.  You can hit me up on my profile via email if you want.

Thanks Jody.

Steve
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now