NAT on 2621

I have a new T1 line that I am going to cut over to. The router that I am using has 2 NICs one for the routable IPs and the other for a 10.x.x.x net and these are connected to 2924 switches

Currently I do not have the T1 plugged in and I want to test the the network connections. I have PC in the net with address 10.0.0.100 and when I try pinging some other device on the net I get packet losses. If I ping 10.0.0.100 fromm router, no losses, but if I ping F1/0 from that PC I get some losses

Here is the config I am using the gateway is on F0/0 and the routable IPs are in the upper half of the class C. I am copying and pasteing out of hyperterm which is a nuisance. There seems to be a screwy entry in access-list 101, how do you remove it without having to redo the list?

Any sage advice greatly appreciated.

cisco2#sho config Using 2774 out of 29688 bytes ! version 12.3 service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname cisco2 ! boot-start-marker boot-end-marker ! logging buffered 65535 debugging logging console informational enable secret 5 $1$Y1GM$BP64yCQ88SQb8tbyl enable password xxxxxxxxxxx ! clock timezone PST -8 no aaa new-model ip subnet-zero ip cef ! ! ip domain name Kednos.com ip name-server 12.70.58.130 ip name-server 12.70.58.132 ip name-server 12.70.58.133 ip name-server 12.70.58.134 ip name-server 12.70.58.135 ip name-server 12.70.58.137 ! ip audit po max-events 100 ! ! ! ! ! ! ! ! interface FastEthernet0/0 description OUTSIDE INTERFACE TO THE INTERNET ip address 12.70.58.129 255.255.255.128 ip access-group 101 in no ip redirects no ip unreachables no ip proxy-arp ip nat outside speed auto full-duplex no cdp enable ! interface Serial0/0 ip address 12.89.208.122 255.255.255.252 ip access-group 101 in ip access-group 102 out ip nat outside no ip mroute-cache ! interface FastEthernet1/0 description INSIDE INTERFACE TO PRIVATE NETWORK ip address 10.0.0.1 255.0.0.0 ip nat inside duplex auto speed auto ! ip nat inside source list 1 interface FastEthernet0/0 overload no ip http server no ip http secure-server ip classless ip route 0.0.0.0 0.0.0.0 12.89.208.121 ! ! access-list 1 permit 10.0.0.0 0.0.0.255 access-list 101 deny ip 10.0.0.0 0.255.255.255 any access-list 101 deny ip 172.16.0.0 0.0.15.255 any access-list 101 deny ip 192.168.0.0 0.0.255.255 any access-list 101 deny ip host 0.0.0.0 any access-list 101 deny ip 127.0.0.0 0.255.255.255 any access-list 101 deny ip 192.0.2.0 0.0.0.255 any access-list 101 deny ip 224.0.0.0 31.255.255.255 any access-list 101 deny ip 255.0.0.0 0.255.255.255 any access-list 101 deny ip any 255.0.0.0 0.255.255.255

Reply to
Tom Linden
Loading thread data ...

Sounds to me like you have a layer 2 issue. Check duplex and speed settings on every device between the PC and router. Make sure the duplex settings match on both ends of every connection. Also try pinging each device the packets go through to get to the router. When you start getting packet loss, you have a place to start looking for a problem.

Reply to
Thrill5

All the devices are on 2924 switches, the PCs have 10.x.x.x addresses the OpenVMS servers have routable IPs and 10.x.x.x aliases, so it is not a matter of following a chain to find the broken link. The fact that I can ping in one direction but not the other is likely due to the way the router is configured, but that

10.x.x.x peers can't ping each other is more complex. Perhaps the way I have set up the NAT access-lists is wrong. Don't know, which is why I posted here.

Reply to
Tom Linden

Here is how the interfaces are configured

interface FastEthernet0/0 description OUTSIDE INTERFACE TO THE INTERNET ip address 12.70.58.129 255.255.255.128 ip access-group 101 in no ip redirects no ip unreachables no ip proxy-arp ip nat outside speed auto full-duplex no cdp enable ! interface Serial0/0 ip address 12.89.208.122 255.255.255.252 ip access-group 101 in ip access-group 102 out ip nat outside no ip mroute-cache ! interface FastEthernet0/1 description INSIDE INTERFACE TO PRIVATE NETWORK ip address 10.0.0.1 255.0.0.0 ip nat inside duplex auto speed auto ! ip nat inside source list 1 interface FastEthernet0/0 overload no ip http server no ip http secure-server ip classless ip route 0.0.0.0 0.0.0.0 12.89.208.121 !

now when I do a show access-list

Extended IP access list 102 10 permit ip 12.70.58.128 0.0.0.127 any 20 permit ip host 12.89.208.122 any 30 deny ip any any cisco#sho access-list 101 Extended IP access list 101 10 deny ip 10.0.0.0 0.255.255.255 any (306 matches) 20 deny ip 172.16.0.0 0.0.15.255 any 30 deny ip 192.168.0.0 0.0.255.255 any 40 deny ip host 0.0.0.0 any 50 deny ip 127.0.0.0 0.255.255.255 any 60 deny ip 192.0.2.0 0.0.0.255 any 70 deny ip 224.0.0.0 31.255.255.255 any 80 deny ip 255.0.0.0 0.255.255.255 any 90 deny ip any 255.0.0.0 0.255.255.255 100 permit icmp any any echo-reply 110 permit icmp any any time-exceeded 120 deny icmp any any echo 130 deny udp any any eq snmp 140 deny udp any any eq snmptrap 150 deny icmp any any 160 deny 53 any any 170 deny 55 any any 180 deny 77 any any 190 deny pim any any 200 permit ip any any (78 matches)

Note the matches. It appears to be the first one I am tripping over.

What have I botched?

--- snip ---

Reply to
Tom Linden

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.