Configuring Cisco 1841 router for Xbox Live

I'm aware this question has been asked before but my setup is a bit different.  I do have two Xbox consoles, one is 360 and the other is One.  They won't be played at the same time though.

So what I am looking for is guidance on how to configure the router firewall and/or NAT to ensure the Xbox Live ports are open.

In my setup, I have both consoles in the same VLAN which is labeled VLAN20 and will be connected to the 4port switch module so they will be plugged in ports fa0/1/0 and fa0/1/1.  This routes back to the main VLAN and out to the Internet.  I have just the default firewall rules applied that only has the customization of allowing DHCP and NTP traffic through since the router is Internet facing.

I have CLI and CCP access to the router and I have been told using CCP is the preferred method for configuring firewall.  My goal is to get open NAT for the Xbox consoles.  What is the best way to accomplish this?
LVL 17
bigeven2002Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

AlexBlinovCommented:
Which port you want to open for the xbox?
☠ MASQ ☠Commented:
Do you have both on fixed IPs?
Would you be OK with a DMZ for consoles only?
bigeven2002Author Commented:
Thanks for the replies.  The ports to be open I believe are 53 both, 80 tcp, 88 both, 3074 both
SolarWinds® Network Configuration Manager (NCM)

SolarWinds® Network Configuration Manager brings structure and peace of mind to configuration management. Bulk config deployment, automatic backups, change detection, vulnerability assessments, and config change templates reduce the time needed for repetitive tasks.

bigeven2002Author Commented:
Sorry on mobile and hit submit prematurely.  The ports I need are at this link
http://support.xbox.com/en-US/xbox-one/networking/network-ports-used-xbox-live

The consoles are on dhcp but I can configure static or dhcp reservation.  They are on a 10.0.2.0/29 subnet so I can given the 360 and One 10.0.2.2 for fa0/1/0 and 10.0.2.3 for fa0/1/1 respectively.  That vlan routed through 10.0.0.0/29 and to Internet.  The router ip is 10.0.0.1 on fa0/1 and it gets dhcp from Isp on fa0/0.
bigeven2002Author Commented:
Sorry for the last part, yes dmz is ok for the consoles.
☠ MASQ ☠Commented:
OK go for the static addresses

& for the 360
ip nat inside source static tcp 10.0.2.2 53 interface fastethernet 0/1 53
ip nat inside source static tcp 10.0.2.2 80 interface fastethernet 0/1 80
ip nat inside source static tcp 10.0.2.2 88 interface fastethernet 0/1 88
ip nat inside source static tcp 10.0.2.2 1863 interface fastethernet 0/1 1863

Open in new window


And for the One
ip nat inside source static tcp 10.0.2.3 53 interface fastethernet 0/1 53
ip nat inside source static tcp 10.0.2.3 80 interface fastethernet 0/1 80
ip nat inside source static tcp 10.0.2.3 88 interface fastethernet 0/1 88
ip nat inside source static tcp 10.0.2.3 500 interface fastethernet 0/1 500
ip nat inside source static tcp 10.0.2.3 3544 interface fastethernet 0/1 3544
ip nat inside source static tcp 10.0.2.3 4500 interface fastethernet 0/1 4500 

Open in new window


You might still see "Strict" though on the Console Network page - in which case fixed IPs & the DMZ will fix that

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
bigeven2002Author Commented:
Ok thanks. I will try these tonight.  Just to confirm, the interface does need to be set as fa0/1 instead of fa0/1/0 and fa0/1/1?
☠ MASQ ☠Commented:
Fast Ethernet fa0/1 (the ADSL-WAN) interface
bigeven2002Author Commented:
Well you were correct, even with the ip nat entries Xbox One still showed up as Strict Nat.  I tried adding it to DMZ and it also still shows up as Strict and the connection does not work.  So I'm still misconfiguring it somewhere.

I'm going to skip the 360 and just focus on getting One to work.  I'm having trouble finding help online on how to properly configure it for DMZ.  Do I need to have the NAT entries above in addition to having the Xbox One in the DMZ?
bigeven2002Author Commented:
Well a quick update.  I restarted the 1841 and discarded my changes from this.  After reboot, I reentered the commands above.  Now the Xbox One shows Moderate instead of Strict which is good.  I have no idea how though.  I just realized, I am double nat'ed in my network due the way the Internet is provided.  This is beyond my control so Moderate is the best I can do until I get a new ISP.

I can't seem to have both IPs for 360 and One routed to the same ports for WAN interface.  When I do a show ip nat translation after entering them they are overwriting each other.
☠ MASQ ☠Commented:
As a workaround (and because only one will be on at any time) give both consoles the same fixed IP and merge the NAT instructions (taking out any duplicates).  Unless you have MAC address filtering that should allow either device to get Moderate.

If your ISP is also using NAT then you can't fix this further right now, double NAT is the scourge of computer gaming behind routers an firewalls!!
JustInCaseCommented:
Xbox Live (on Xbox One) requires the following ports to be open:

    Port 88 (UDP)
    Port 3074 (UDP and TCP)
    Port 53 (UDP and TCP)
    Port 80 (TCP)
    Port 500 (UDP)
    Port 3544 (UDP)
    Port 4500 (UDP)
ip nat inside source static tcp 10.0.2.3 53 interface fastethernet 0/1 53
ip nat inside source static udp 10.0.2.3 53 interface fastethernet 0/1 53
ip nat inside source static tcp 10.0.2.3 80 interface fastethernet 0/1 80
ip nat inside source static udp 10.0.2.3 88 interface fastethernet 0/1 88 
ip nat inside source static udp 10.0.2.3 500 interface fastethernet 0/1 500
ip nat inside source static udp 10.0.2.3 3544 interface fastethernet 0/1 3544
ip nat inside source static tcp 10.0.2.3 3074 interface fastethernet 0/1 3074
ip nat inside source static udp 10.0.2.3 3074 interface fastethernet 0/1 3074
ip nat inside source static udp 10.0.2.3 4500 interface fastethernet 0/1 4500 

Open in new window

interface Fa0/1 <---- is your WAN interface (so if int fa0/0 is WAN, your need to adjust it)
You need command extendable if you want to use port forward to more than one device, but since other device (Xbox 360) need the same ports you can't have  port forward from the same WAN port to two devices, as you already established.
If the same IP address is applied to both devices just one device can be used at the time.
:)
bigeven2002Author Commented:
Ok I will try merging the rules and making them same ip.  As far as I know there isn't any Mac filtering active since I used to have another router hooked up initially before replacing with the Cisco and it still connected.

I didn't realize that fa0/1 was supposed to be the wan interface.  That means I may have to redo a lot of my setup since right now it is the opposite.  So if I change fa0/1 to be wan facing, does that change the vlan switch ports as well such as instead of fa0/1/0 it would become fa0/0/0?

I wrote the rules above to point the ports from Xbox ip to fa0/0.

Another thought occurs, is it possible to write the rule like this and keep both xboxes with theirs individual ips?

ip nat in source static tcp int vlan20 53 int fa0/0 53
JustInCaseCommented:
Interface fa0/1 does not need to be WAN, I was just pointing that port that is WAN should be set instead of Fa0/1.
If your WAN interface is Fa0/0 that command would be
ip nat inside source static udp 10.0.2.3 4500 interface fastethernet 0/0 4500
that's all I tried to say.

And rule is for individual IPs.
bigeven2002Author Commented:
Gotcha.  Yeah that was what I did when entering the rules I specified fa0/0.  I do have moderate nat now instead of strict.

I will review this one more time this evening and wrap up.  So the thought above with specifying vlan20 won't work?
JustInCaseCommented:
Port forward - forwards traffic from port to specific destination. It is not multicast traffic, so destination host must be configured (can't just tune into frequency). :)
bigeven2002Author Commented:
Ah ok thanks for letting me know.  I will wrap this up tonight then.  Thanks!
bigeven2002Author Commented:
After further reading it appears to be common behavior for the Xbox One to fluctuate with Moderate and Strict NAT.  Like MASQ said, double nat'ing is scourge so this is indeed as good as it gets with the port forwarding.  I'm not gonna bother with DMZ since it will get same result.  If anything, I learned more about Cisco IOS.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Routers

From novice to tech pro — start learning today.