Cisco IOS NAT Issues

/usr/home

Supreme [H]ardness
Joined
Mar 18, 2008
Messages
6,160
I originally had this setup great on my ASA, but I'm switching over to a 881 ISR. So, I have two static IPs from my ISP. I assigned one to the WAN interface and left the other one as is. I want all my internal traffic to go out the IP assigned to the interface, and that works great, but I also have a webserver that I want to have on the other static IP. Here's my running config:

Code:
interface FastEthernet0
 no ip address
!         
interface FastEthernet1
 switchport access vlan 2
 no ip address
!
interface FastEthernet2
 no ip address
!
interface FastEthernet3
 no ip address
!
interface FastEthernet4
 ip address x.x.x.static1 255.255.255.0
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface Vlan1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
!         
interface Vlan2
 ip address 192.168.2.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
!
ip forward-protocol nd
ip http server
ip http access-class 1
ip http authentication local
ip http secure-server
!
!
ip nat source static udp 192.168.1.2 500 x.x.x.static1 500 extendable
ip nat source static udp 192.168.1.2 4500 x.x.x.static1 4500 extendable
ip nat inside source list 1 interface FastEthernet4 overload
ip nat inside source static tcp 192.168.1.2 443 x.x.x.static1 443 extendable
ip nat inside source static tcp 192.168.1.205 80 x.x.x.static2 80 extendable
ip route 0.0.0.0 0.0.0.0 x.x.x.254
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 permit 192.168.2.0 0.0.0.255
!
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
line con 0
 logging synchronous
 login local
line aux 0
line vty 0 4
 privilege level 15
 login local
 transport input telnet ssh
!
ntp master
ntp update-calendar
ntp server 0.ca.pool.ntp.org prefer source FastEthernet4
ntp server 2.ca.pool.ntp.org
!
end

I can't get it to work. If I also ping that second IP, I get nothing. If I change my NAT statement to my other static IP, it works fine. I had this working on my ASA, but now I can't seem to get it to work in IOS. It could be something stupid that I'm overlooking as well.

Also, my upload speed is very slow behind the 881. I'm getting the correct speed outside the router, but behind it I'm getting 300kbps instead of 2000. I'm seeing a ton of CRC input errors. I set the duplex and the speed to full 100 which is what the 2Wire runs at and I tried auto as well. No difference. Any ides on this one?
 
Last edited:
Looks like I solved my NAT issues. I'm assuming the issue was the web server got the request but sent the packet back on a random port that wasn't specified on the second static IP so it went back out the first static IP. I added another NAT statement with an access list and added the webserver IP to it.

Edit: Also looks like it was my switch causing the upload speed issue. Very weird. I had to reset it back to system defaults to get my upload speed back.
 
Last edited:
Back
Top