1. Home
  2. Cisco Systems
  3. Question about ip nat on a 7301

Question about ip nat on a 7301

I have a 7301 router that talks to a 7604 router via a public WAN interface. Behind the 7301 is a private network (dot1q). This private network makes its way over the WAN link to the 7604, and there its routed to an appliance that NATs it.

I want to see if its possible to NAT right at the 7301. The 7301 already routes out perfectly over its WAN interface.

Its kind of a weird config, so here are the key interfaces on the

7301:

interface Loopback0 ip address 172.17.0.8 255.255.255.255 ! interface GigabitEthernet0/0 ip address 206.252.161.9 255.255.255.252 ! interface FastEthernet1/0 description Cisco 2955 no ip address ! interface FastEthernet1/0.2 description MGMT_VLAN2 encapsulation dot1Q 2 ip address 172.17.24.1 255.255.252.0 ! interface FastEthernet1/0.200 description Client Network Vlan 200 encapsulation dot1Q 200 ip address 10.10.128.1 255.255.224.0 ! ip route 0.0.0.0 0.0.0.0 206.252.161.10 250

Fe1/0 goes to a Cisco 2955. That device is where all the Vlan 2 devices are connected (172.X). The Vlan 2 devices are Wireless access points. Vlan 2 is the outside interface, the inside network of these Wifi AP's is Vlan 200 (10.10.X). All the clients have IPs like

10.10.128.8, and 10.10.129.56, and so on.

I would like to ip nat the 10.10.128.X to a public address right on the 7301. The only available public IP address I have is the

206.252.161.9 which is assigned to Gi0/0. Is it possible to NAT out using the ip address assigned to this interface. The examples I see online always have a special pool.

My initial thoughts were to simply apply "ip nat inside" to the Fe1/0.200, then apply "ip nat outside" to the Gi0/0. But I'm not sure what to use for my "ip nat" command in global config - especially since I am unsure if the one IP address is enough?

Reply to
essenz
Loading thread data ...

----- Original Message ----- From: "essenz"

yep

something like

ip nat inside source list NAT-THIS int gig0/0 overload

ip access-list extended NAT-THIS permit ip 10.10.128.0 0.0.0.255 any

Depends... eg do you have more than one web server which would require port

80 forwarding?

And, BEWARE! Doing NAT on the 7301 will increase the load there quite a bit.

Michael.

Reply to
Michael Bowe

Mike,

Thanks for the reply. The only port forwarding we will doing is on the core uplink 3750's which is alot higher in our architecture topology. On the 3750 we will be port forwarding port 80 to a single destination

- I also need help on that syntax as well.

As for the 7301 load, I am aware it will increase. To give you an idea, at peak usage, there may be 300 users max behind a 7301.

My other question was what if I have multiple outside interfaces? Do I just apply ip nat outside to both?!

Thanks John

Reply to
essenz

"essenz" wrote

try something like

ip nat inside source static tcp 80 interface gig0/0 80

or

ip nat inside source static tcp 80 206.252.161.9 80 extendable

yes

Michael.

Reply to
Michael Bowe

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.