Solved

Cisco 1841 NAT config - help needed

Posted on 2010-09-23
17
924 Views
Last Modified: 2012-05-10
* see attached network diagram (JPEG) *

need help with this design!
Take a look at the diagram:
I have two cisco 2810's that are configured and managed by AT&T (we can't touch or modify their config's), one located at site 1 and the other at site 2. Both are setup for T1 tying into a private network. The private network they tie into is however located in another part of the state.

As you can see, site one and site two are also connected via single mode fiber, the reason for this is because the data logger devices called out need be on the same network to work in conjunction with each other (and also NAT'd to the private 10. network). This is the reason I think another router that we can control needs to be in place. I have a spare cisco 1841 that I think can do the job.

What I need help with:
How to setup the 1841 for NAT routing (it has two FE ports).
Do I need to put another router at site two?
Should the two database systems assigned with 10.10 ip's be changed to local 192.168 ips and also NAT'd?

Thank you thank you thank you for anyone's help in this!

The 10.10 IP's with full class C are assigned by AT&T and are configured in the 2810's. Plenty of available IP's for NAT.
network.jpg
0
Comment
Question by:MikeG299
  • 11
  • 3
  • 3
17 Comments
 
LVL 24

Expert Comment

by:rfc1180
ID: 33751889
>How to setup the 1841 for NAT routing (it has two FE ports).

Why do you think you need NAT?
What is it you are trying to accomplish? (This has yet to be explained)
Maybe some clarification what source and destination communication flow.

Thanks
Billy
0
 

Author Comment

by:MikeG299
ID: 33753255
Hi Billy,

Pardon my lack of explanation; I'm still learning network design and how to configure cisco router's.

This is all about providing a path for the data loggers from site 1 & 2 called out in attached diagram to see each other. All of the devices will ultimately be polled by a data acquisition server on the private network (yellow cloud in diagram - and its not our network).

The data loggers need to see each other to execute calculations to provide accurate data prior to being polled by server on private network.

I believe I need NAT because the two 2810's are not managed by us, therefore, we cannot use them to create a local 192.168 network in order for the data loggers called out to see each other. As you can see, there is fiber between sites 1 & 2. So i thought it would be best to create a separate local network that both sites could see (mainly for data loggers to communicate and execute calculations) and then be NAT'd to each respectful 2810.

Long story short: if we had control of those two 2810's, then we could configure them to see each other using that fiber run as a path. We have no control over the yellow cloud or the T1 lines .


Does this help? I'm under the gun to make this happen, please let me know if you need further explanation. Thanks!

Each 2810 router (which we can't touch)
0
 
LVL 4

Expert Comment

by:gmooney7
ID: 33753538
Looking at your diagram, I can kinda see what you want to do.   I would suggest another 1841 (or even something with less horsepower) at site 2.  We're talking T1's, so interface bandwidth on this nat router shouldn't be a big deal.

Set up static nat's on anything that needs a 10.10 -> 192.168 address, and you could set up a dynamic pool for anything else.  Assign gateway's appropriately on each host for optimum routing to the private wan network.

Should work fine.
0
 

Author Comment

by:MikeG299
ID: 33753881
Thank you very much for the response. I could use some help from the procedural side on how to actually setup static nat, dynamic pool, gateway... If you could I'd be really appreciative. Thanks!
0
 
LVL 4

Accepted Solution

by:
gmooney7 earned 500 total points
ID: 33756707
As for the static nat portion, you can follow this guide.
http://blogs.techrepublic.com.com/networking/?p=264

You'll have a static nat entry for each 10.10 ip you need to forward to a 192.168 host.

For hosts that do not need a 10.10 address, you can overload the outside interface of each 1841 to do dynamic nat.

This explains that. http://articles.techrepublic.com.com/5100-10878_11-1039094.html?tag=leftCol;post-264

Each host inside the 192.168 network will need a gateway assigned.  If you use dhcp, hosts from one site may end up with using the other site's router for a gateway, and you really wouldn't want that.

So site 1's 1841 could have an inside ip address of 192.168.0.1 255.255.255.0/24, and site 2's inside interface can be 192.168.0.2 255.255.255.0/24 (or use whatever netmask you want)  site 1 machines will use .1 for their gw, and site 2 would use .2.

If you need help with an actual config with ip's and everything you can copy/paste into the router, copy/paste a 'sh run' from the 1841 you have.  But this should be enough to go on.  good luck.
0
 

Author Comment

by:MikeG299
ID: 33757413
Thanks gmooney7, I'll work on this tonight and paste router config if I get stuck. Unfortunately, we can only use one router right now; which means reliability is not there if and when the fiber link goes down.

will report back soon.
0
 

Author Comment

by:MikeG299
ID: 33761851
Question: is it possible to do this with one router (we don't have another one at the moment)? Can you push NAT thru both FE INT's for both 2810's?

thanks...
0
 

Author Comment

by:MikeG299
ID: 33762114
Ok, having a problem when trying to input NAT

Here is how I input the commands:
(config)# ip nat inside source static tcp 192.168.0.3 10.10.152.3

Wouldn't take the command, here is my config so far....

Current configuration : 654 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
resource policy
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip subnet-zero
ip cef
!
!
!
!
!
!
!
!
interface FastEthernet0/0
 ip address 10.10.152.254 255.255.255.0
 ip nat outside
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.0.254 255.255.255.0
 ip nat inside
 duplex auto
 speed auto
!
ip classless
!
ip http server
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
 login
!
end

0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 

Author Comment

by:MikeG299
ID: 33762423
Ok, I figured out why my NAT commands failed, I had to call out the ports (lame, I know). Is there a command to call out to allow all ports instead of an individual one?

As mentioned in prior post, we'll only be able to use one router to handle all NAT routing including NAT for the other cisco 2810 at site 2 (other end of fiber run, a router which we also don't have control over). Original plan was to have an 1841 at both sites to handle NAT.

That said, I have one FE set for traffic to 2810 at site 1 and the other FE set to handle all 192.168.0.0 traffic. Not sure how to proceed, any help would be really great!
thanks!
0
 

Author Comment

by:MikeG299
ID: 33762428
Latest config:
interface FastEthernet0/0
 ip address 10.10.152.254 255.255.255.0
 ip nat outside
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.0.254 255.255.255.0
 ip nat inside
 duplex auto
 speed auto
!
ip classless
!
ip http server
ip nat inside source static tcp 192.168.0.3 502 10.10.152.3 502 extendable
ip nat inside source static tcp 192.168.0.6 502 10.10.152.4 502 extendable
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
 login
!
end

0
 
LVL 24

Expert Comment

by:rfc1180
ID: 33762436
ip nat inside source static <localaddr> <globaladdr> extendable

in your case:

ip nat inside source static 192.168.0.3 10.10.152.3 extendable

Billy
0
 

Author Comment

by:MikeG299
ID: 33762493
Thanks Billy, I assume thats for use on any port. Any idea on how to setup NAT for both 2810's??
0
 
LVL 24

Expert Comment

by:rfc1180
ID: 33762506
Sorry, I thought the configs on the 2810 could not be managed as there were managed by AT&T; did you install additional 2810s?

Billy
0
 

Author Comment

by:MikeG299
ID: 33762514
No, you are correct, the 2810's cannot be managed by us. The diagram shows two cisco 1841's to handle NAT for each site, however, we can't supply an 1841 for site two and I need help to config the 1841 to handle NAT for both sites.
0
 
LVL 4

Expert Comment

by:gmooney7
ID: 33770634
Mike,
Sorry I couldn't get back to you sooner.  One router cannot handle nat for both sites with the need for the data loggers to stay on the same network, unless you want to get really messy.

My suggestion is to buy a cheap linksys router for site 2, have everything on the same subnet behind site 1 and 2, and configure the gateway for site 1 hosts to the 1841, and the site 2 hosts to the cheap router.  

If you don't want to do it this way, configuration and physical layout become ugly.

Your 1841 still needs to be configured to allow all other hosts to nat out of it dynamically.

access-list 140 permit ip 192.168.0.0 0.0.0.255
ip nat inside source list 140 interface fa 0/0 overload
ip route 0.0.0.0 0.0.0.0 10.10.152.x ! x being whatever the ip is of the 2810's inside interface


Sorry I can't put more thought into this, have several broken things to tend to myself :p  

good luck



0
 

Author Comment

by:MikeG299
ID: 33788988
Hey no worries. I agree about having a second router; we'll proceed with getting a cheep Linksys to handle site 2. Will report back, thanks again!
0
 

Author Closing Comment

by:MikeG299
ID: 34019632
Thanks for your help!
0

Featured Post

Zoho SalesIQ

Hassle-free live chat software re-imagined for business growth. 2 users, always free.

Join & Write a Comment

AWS has developed and created its highly available global infrastructure allowing users to deploy and manage their estates all across the world through the use of the following geographical components   RegionsAvailability ZonesEdge Locations  Wh…
If you are thinking of adopting cloud services, or just curious as to what ‘the cloud’ can offer then the leader according to Gartner for Infrastructure as a Service (IaaS) is Amazon Web Services (AWS).  When I started using AWS I was completely new…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now