[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

How to redirect outbound traffic via Cisco IOS?

Posted on 2011-10-23
14
Medium Priority
?
1,499 Views
Last Modified: 2012-08-14
Is there a way to redirect all OUTBOUND traffic addressed to a specific host to a different one via Cisco IOS?

For example, I want to be able to redirect all traffic addressed to 74.134.x.x to 68.114.x.x. The specific client in this case is a Windows box.
0
Comment
Question by:pzam
  • 5
  • 4
  • 4
  • +1
14 Comments
 
LVL 6

Expert Comment

by:nativevlan
ID: 37014175
Will the clients be using the IP address or the hostname of the external service?
0
 
LVL 6

Expert Comment

by:nativevlan
ID: 37014226
If you are using the hostname then you will be able to accomplish this with DNS (assuming that you have an internal DNS server) or by changing the host file. If you need to use the IP address then you will have to implement DNAT (https://supportforums.cisco.com/thread/223940) . This scenario will probably be incompatible with your setup if you are using the IOS router to do NAT (PAT) to the internet.  
0
 

Author Comment

by:pzam
ID: 37014460
Unfortunately, the client is using an IP address; a FQDN is not an option.

The DNAT options that I have found in IOS all involve an outside global address of the Cisco as the destination. I need something that will redirect a remote global IP.

For example, I need this packet:

source 192.168.1.x port 10001 destination 74.134.x.x port 10001

Redirected/changed/fixed-up to:

source 192.168.1.x port 10001 destination 68.114.x.x port 10001

Will DNAT accomplish this and I just missed it?
0
Configuration Guide and Best Practices

Read the guide to learn how to orchestrate Data ONTAP, create application-consistent backups and enable fast recovery from NetApp storage snapshots. Version 9.5 also contains performance and scalability enhancements to meet the needs of the largest enterprise environments.

 
LVL 6

Expert Comment

by:nativevlan
ID: 37014481
Sorry I don't have alot of experience with DNAT, it looks like you would want to do this ?

ip nat inside source static 74.134.x.x 10001 68.114.x.x

Then apply the ip nat inside (local lan) and ip nat outside (internet facing).

To make sure you could put a switch between your IOS router and the internet connection, then mirror the port to a computer running wireshark to check that the translation occurred.

Again I'm not 100% sure on the config, maybe someone else has more xp with DNAT.
0
 

Author Comment

by:pzam
ID: 37014841
The only address option following IP NAT INSIDE SOURCE STATIC is defined as 'A.B.C.D  Inside local IP address.' I have yet to find a command that takes a remote IP as an argument.

Just for SAG, I did try the entry you suggested. The router accepts the command, but it does not work.  :)



0
 
LVL 18

Accepted Solution

by:
Garry Glendown earned 2000 total points
ID: 37014936
Actually, you want OUTSIDE nat, not INSIDE ... try this:

ip nat outside source static 74.131.x.x 68.114.x.x extendable

0
 
LVL 6

Expert Comment

by:nativevlan
ID: 37015044
Thanks Garry-G, any update on this pzam?
0
 

Author Comment

by:pzam
ID: 37015428
Garry-G,

I originially thought that some variant of 'ip nat outside destination static' would be command needed. After all, I was wanting to redirect one outside destination to another. Needless to say, I came to find that is not a command option in Version 15.0(1)M1.

I have since tried your version using the 'ip nat outside source static' syntax, but it does not work. The actual address options on that command are Outside Global, then Outside Local, which does not appear to allow two remote IPs.

Any other ideas?

Thanks.
0
 
LVL 18

Expert Comment

by:Garry Glendown
ID: 37015916
Ah, the joys of new IOS versions ... tested that on a 12.4 box ... although, checking with a rather new 1941 15.0(1)M5, the command is accepted just fine ... in fact, I can't seem to find any mention of the "ip nat outside global" syntax ... are you certain you're in the right context?
0
 
LVL 2

Expert Comment

by:adrianuta2004
ID: 37016774
0
 
LVL 18

Expert Comment

by:Garry Glendown
ID: 37016847
PBR is useful for multiple outgoing LINKS, not changing destination addresses ...
0
 

Author Comment

by:pzam
ID: 37016990
Garry-G,

I found the 'Outside Global' and 'Outside Local' definitions by using the help prompt. That is, typing in 'ip nat outside source static ?' produced:

  A.B.C.D  Outside global IP address
  network  Subnet translation
  tcp      Transmission Control Protocol
  udp      User Datagram Protocol

Then, typing 'ip nat outside source static 74.134.x.x ?' produced:

  A.B.C.D  Outside local IP address

Given the definitions provided, I dont think this will do what I want. Since I want to substitute one remote IP for another, both IPs would have to be a destination outside global.

Also, my router accepted the original command you suggested; it just didn't work as intended.

I wonder if there is something like a Tcl script that would accomplish this...?
0
 
LVL 18

Assisted Solution

by:Garry Glendown
Garry Glendown earned 2000 total points
ID: 37017202
Don't confuse the "Local" with meaning it's a local address - it's just from the "local" view ... so if you want to access IP 1.2.3.4 from your local server, and reach a server that is actually at 195.2.3.4, then that's what works ... do you have the "ip nat inside" and "ip nat outside" configure on your router interfaces?
0
 

Author Closing Comment

by:pzam
ID: 37017514
Your last comment helped to resolve this issue. I was, indeed, getting mired in semantics. I looked up the address definitions on Cisco and found a very help explanation:

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080094837.shtml

In doing so, I found that the original command you suggested was correct - except that the IPs were reversed for my specific needs. That is, the correct syntax turned out to be:

ip nat outside source static [REDIRECTED_IP]  [IP_TO_REDIRECT]

Thanks for your help!
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
This month, Experts Exchange’s free Course of the Month is focused on CompTIA IT Fundamentals.
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…

834 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question