• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

config-subif problem

P

plur

[H]ard|Gawd
Joined
Jun 3, 2001
Messages
1,397
I'm studying for CCNA!

I'm trying to get my 2513 (SINGLE ETHERNET) to simply NAT my connection between myself and my dsl router for er, educational purposes :)
I'm trying to follow this guide

http://www.cisco.com/en/US/products...on_guide_chapter09186a00800ca6b4.html#1002244

Configuring Static Translation
To configure static inside source address translation, use the following commands beginning in global configuration mode:

=====

Step 1 ip nat inside source static local-ip global-ip Establish static translation between an inside local address and an inside global address.

Step 2 interface type number Specify the inside interface.

Step 3 ip nat inside Mark the interface as connected to the inside.

Step 4 interface type number Specify the outside interface.

Step 5 ip nat outside Mark the interface as connected to the outside.
Click to expand...

The problem I'm having is where the guide references two physical interfaces (I think) and I am substituting this for sub interfaces. I was going to use e0.0 and e0.1 however, I get the following error.


charlie.zzcom(config-subif)#ip address 99.99.164.229 255.255.255.240

Configuring IP routing on a LAN subinterface is only allowed if that
subinterface is already configured as part of an IEEE 802.10, IEEE 802.1Q, or ISL vLAN.

I've tried with secondary IP addressing but I cant figure out how to apply the nat inside/outside to it; none of my course material seems to cover this.

I have a 16 ip block from my isp and want to give the 2513 a public ip so I can NAT from it just to explore the various IOS stuff.

I have been googling for ages about secondary IP addressing and sub interfaces but not turned up much.
Any help appreciated :)

PS: Yes, I'm aware NAT isn't covered in the CCNA, just trying to broaden my knowledge :D
 
It seems sub interfaces are only for vlans/trunking.

So... is it possible to get NAT working on secondary addressing? :eek:
 
I don't think its possible as the outbound and inbound binding need to be on separate interfaces. Then again the last time I tried binding them to the same int was long long ago, so maybe cisco changed something by now?

FYI, subinterfaces are for VLAN trunking *usually*. I could see the reasoning in setting up your outside network on one vlan and the internal on a secodn vlan, but I'm not sure you'll be able to do the internal/external bindings to teh subs like you want to.

This is definitely a thread worth watching....
 
Hi Bob, thx for replying :)
I've been on this all night, sort of losing hope now.
I've read the FAQ here about 10 times tonight, a few ppl imply this is possible but it's beyond my knowledge at this point.

I'll keep searching ;)
 
It is called 'NAT on a stick'

Here's ciscos word on it

http://www.cisco.com/warp/public/556/nat-on-stick.html

I've tried in vain to get their config working. It just doesn't. It seems ambiguous to me with incorrect subnetting and missing info.
What I found highly amusing:

The above network diagram is very common in a cable modem set up.
Click to expand...
I'm sure cable companies are perfectly used to giving out two different subnets to single customers. The prefix lengths are based on /29 (8 ips) but the customer was only given 3... OK.
Then further down the cfg it is routed as a full C-class instead of a .248??

I should mention, I'm very tired at this point :p


Here is the configuration I have half managed to get working.


interface Loopback0
ip address 172.16.1.1 255.255.255.0
no ip directed-broadcast
ip nat inside
ip policy route-map nat
!
interface Ethernet0
ip address 172.16.2.1 255.255.255.0 secondary
ip address 75.102.181.33 255.255.255.0
no ip directed-broadcast
ip nat outside
!
ip nat inside source list 1 interface Ethernet0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Loopback0
!
access-list 1 permit 172.16.0.0 0.0.255.255
route-map nat permit 10
set ip next-hop 75.102.181.1
!

Replacing 75.102.181.33 with one of my own ips and next-hop 75.102.181.1 with my dsl router ip. A lot of guesswork and assumption, slowly getting there :)

My 2513 can now ping the world, the clients etc.
The clients dont seem to get their packets forwarded tho.
Feedback appreciated :confused:
 
Perhaps its your route statement?

Try ip route 0.0.0.0 0.0.0.0 Ethernet0
 
Change the default route to point at the distant end (the ISP). Also, 9 times out of 10 its a bad idea to point a static route at an ethernet interface. Generally speaking, its A Very Bad Thing to point a static or default route at a loopback interface.
 
Thx for the feedback all.

The config you mentioned the changes to I will be trying now.
It actually came from this website from a CCIE. It looked contrary to everything I'd read but who am I to argue with a CCIE ;)


EDIT: For some strange reason, the router dies when I enable 'ip routing'
Can't ping anywhere etc.
'no ip routing' returns it back to working order??

EDIT2: The client cant ping the router with the above conf. Tried 172.16.1.2/24 and 172.16.2.2/24. Neither work :(
 
Alrighty then!

I was eternally puzzled why disabling ip routing would appear to make the router work. i.e. could ping out.

After tweaking the cfg for ages, experimenting, removing default-gateway etc, what finally made it work was:

ip routing
router rip
network 99.99.164.224 <-- My network address


I'm now sitting here, behind my 'NAT-on-a-stick' 2500 series single ethernet... pretty pleased with myself (it's taken me two days)!
 
Would you mind posting a copy of your config so I can see what all was needed? A network map with IPs would be beneficial as well as that's what usually ties it all together upstairs.
 
Yeh, no problem Bob. Just trying to iron out some minor problems now... i.e. can't telnet to the router, cant ping it (ACL related?) although NAT is working fine.

Also, my internal linux server running a few of my ips is now unreachable, despite the rest of the rest of the internet being ok.
 
charlie.zzcom#sh run
Building configuration...

Current configuration : 1334 bytes
!
version 12.2
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
service tcp-small-servers
!
hostname charlie.zzcom
!
enable secret zzzzzzzzz
enable password zzzzzzzz
!
ip subnet-zero
ip name-server 199.99.73.95
!
!
!
!
interface Loopback0
ip address 192.168.1.1 255.255.255.0
ip nat inside
no ip mroute-cache
ip policy route-map nat
!
interface Ethernet0
ip address 192.168.0.19 255.255.255.240 secondary
ip address 99.99.164.229 255.255.255.240
ip nat outside
no ip mroute-cache
!
interface Serial0
no ip address
no ip mroute-cache
shutdown
!
interface Serial1
no ip address
no ip mroute-cache
shutdown
!
interface TokenRing0
no ip address
no ip mroute-cache
shutdown
!
router rip
network 99.0.0.0
!
ip default-gateway 99.99.164.225
ip nat inside source list 1 interface Ethernet0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Loopback0
no ip http server
ip pim bidir-enable
!
!
access-list 1 permit 192.168.0.0 0.0.255.255
!
route-map nat permit 10
set ip next-hop 99.99.164.225 99.99.164.229
!
banner motd ^Czz.com - Don't hate the player, hate the game.^C
!
line con 0
line aux 0
transport input all
line vty 0
password zzzzzzzzzzzz
login
length 44
line vty 1
password zzzzzzzzzzz
login
length 41
line vty 2 4
password zzzzzzzzzzz
login
!
end

charlie.zzcom#

note: ip default-gateway is only used when ip routing is disabled but I've left it in anyway, for redundancy. Substitute the IP's for your own and whala!
Perhaps this could be included in the FAQ?
 
You must log in or register to reply here.
Back
Top