cisco router secondary ip and nat problem
Posted on 2012-09-11
Cisco 1841 router 12.4(3i)
I have 2 disconnected public IP spaces - both from the same ISP. I am trying to NAT an IP from the second IP space to a sub-interface on the inside.
I have a primary and seconday IP on the outside interface and several sub-interfaces on the inside - each on a different vlan with isolated servers/services on each vlan.
I can't get a NAT to pass anything *except* ICMP on the IP in the second block.
That is to say, my access-list is tripped with a ping 184.108.40.206 and the ping replies. I see the icmp on the inside host (wireshark), so I know it's not just the router replying. however, the access-list for 220.127.116.11 is *not* hit when I try *any* other port - http, https, ssh, rdp..etc.
I am not mixing IP's from the public blocks into the same vlan on the inside (i.e., IP's from block 1 are NAT'd to VLAN 100, 101, 102, and I need IP's from block 2 NAT'd to vlan 103).
(public ip middle octets changed - first/last are actual, internal are actual)
ip address 18.104.22.168 255.255.255.248
ip address 22.214.171.124 255.255.255.224
ip nat outside
ip access-group in.outside in
ip address 10.0.100.1 255.255.255.0
ip address 10.0.103.1 255.255.255.0
ip nat inside source static tcp 10.0.100.10 443 interface fa0/1 443
ip nat inside source static 10.0.103.10 126.96.36.199 ext
ip access-list ext in.outside
permit ip any host 188.8.131.52
permit tcp any host 184.108.40.206 eq 443
permit icmp any any