NAT Troubles

Have a question or want to start a discussion? Post it! No Registration Necessary.  Now with pictures!

Threaded View

I have an issue with NAT.  I'm trying to test the NAT config in the
Cisco doc

I have setup my CCNA network simulator lab as follows:

NAT Router

WWW Router

I also have two pc clients off each router via a switch.  Two NAT
clients are &  The two WWW clients are and

I configured the NAT router as follows:

ip address
ip nat outside

ip address
ip nat inside

First I tried to configure as per cisco doc
ip nat pool no-overload prefix 24
ip nat inside source list 7 pool no-overload
access-list 7 permit

When this didn't work, I then got rid of the dynamic stuff and just
put in
ip nat inside source static

On both occasions, I can't ping any of the WWW clients from my NAT
client.  I can't ping any further than from the NAT
client.  What gives?  If I implement routing between NAT and WWW it all
works.  Is routing still required in this situation?  I would have
thought the WWW router could relay traffic from hosts on the network to the network since the networks are
directly connected to the router.  All the examples I've seen state
to NAT the inside local (in this case my NAT client IP) to the inside
global (which is supposed to be an IP address on the other side- serial
interface- of the NAT router)

Any help greatly appreciated!


Re: NAT Troubles wrote:
Quoted text here. Click to load it
Quoted text here. Click to load it
I also plugged in all your values in Bosons NetSim and ran it, I ended
up with the same as yourself. I could ping from the hosts all to way to
the S0 interface of the router ( from both sides). Once I enabled
routing (RIP, and only advertised on each side), I could
reach to the other end of the Serial line each way.

I still can not ping from NAT Hosts to WWW Hosts, but Show IP NAT TRANS
on my NAT router says one way translations are occuring. Then I
advertised the network from the NAT router. Now I am able to
ping all the way across each way. However I realized this defeats the
purpose of "hiding" those 10.10.10.x host machines with NAT translations.

I shouldn't have to advertise the network from the NAT router
in order for this to work. Nat should translate the to inside global range of So to the WWW Router and its hosts, they
communicate with the NAT hosts via the 172.16.10.X addresses and not the
10.10.10.x addresses. However when I remove the RIP Network
from the NAT router, and WWW drops that route from its routing, I can no
longer ping to the hosts.

I then realize I need a simple default route on the NAT router to fix
this issue.

ip route (gateway of last resort)

Now a few pings from NAT hosts to 172.16.11.x hosts and some from the
WWW hosts back to the inside global addresses translated from NAT for
the hosts, and you can really watch the SHOW IP NAT
TRANSLATIONS screen fill with entries.

Re: NAT Troubles

On 17 Mar 2005 14:36:41 -0800, wrote:

Quoted text here. Click to load it

How does the NAT router know about the network on the
WWW router?  When you ping from the NAT hosts to the WWW hosts the
packet is arriving at the NAT router but it does not know how to get
to the network.

You need to set a static route or default gateway to point to and then the packets will return OK since the destination
address is the NATed which the WWW router knows about
since its directly connected.

If you have problems with NATing run a few debug commands like "debug
ip nat detailed" on the NAT router to get a better idea what the
router is doing. On the WWW router you can try debug icmp to see if
the ip is being translated.


Re: NAT Troubles

Quoted text here. Click to load it

I added default routes to both the NAT and WWW router and it works.
Strange but that with the default routes you can ping from pc to pc
using the unNATed address, but I imagine this would not be the case in
reality as opposed to a lab environment.  More importantly, the WWW PC
can ping the NATed address, which proves that NAT is in fact working.

Thanks for that

Re: NAT Troubles

On 21 Mar 2005 00:30:28 -0800, (R. Baker) wrote:

Quoted text here. Click to load it


You only need to set a default route on the NAT router. When you have
a default route on the WWW router everything is sent to the NAT router
no matter its destination. This explains why both the NATed and
unNATed addresses are pingable. When the default is taken out of the
WWW router only the NATed address will work since its directly
connected between the NAT and WWW routers.


Re: NAT Troubles

Quoted text here. Click to load it

Cool.  I'll try that tonight and make sure it works.

Site Timeline