NAT Overloading not working

[thejimmahknows]

I have a GNS3 lab set up and I am trying to get NAT overloading working with a dynamic pool. Please see diagram

The issue I am having is traffic is being routed correctly from PC1 to the ISP1 or ISP2. However the translation I believe is not working because I see this on the ISP routers. PC1 = 192.168.0.101 and PC2 = 192.168.0.102

ISP1# *Oct  7 16:14:46.211: ICMP: echo reply sent, src 1.1.1.2, dst 192.168.0.101, topology BASE, dscp 0 topoid 0
    ISP1#
    *Oct  7 16:14:48.211: ICMP: echo reply sent, src 1.1.1.2, dst 192.168.0.101, topology BASE, dscp 0 topoid 0

Here is my config from Edge1:

 interface Loopback0
     ip address 167.69.0.1 255.255.0.0
    
    interface GigabitEthernet0/0
     ip address 172.16.0.1 255.255.255.0
     ip nat inside
     media-type gbic
     speed 1000
     duplex full
     negotiation auto
    !
    interface POS1/0
     description "ISP1"
     ip address 1.1.1.1 255.255.255.252
     ip nat outside
    !
    interface POS2/0
     description "ISP2"
     ip address 2.2.2.1 255.255.255.252
     ip nat outside
    
    router eigrp 1
     network 172.16.0.0 0.0.0.255
    !
    router bgp 10001
     no synchronization
     bgp log-neighbor-changes
     network 167.69.0.0
     neighbor 1.1.1.2 remote-as 65100
     neighbor 2.2.2.2 remote-as 65200
     maximum-paths 2
     no auto-summary
    
    ip nat pool overloadNAT 167.69.255.1 167.69.255.100 netmask 255.255.255.0
    ip nat inside source list 100 pool overloadNAT
    
    access-list 100 permit ip 192.168.0.0 0.0.0.255 any log
    access-list 100 permit icmp 192.168.0.0 0.0.0.255 any log

Here is my show ip route from Edge1:

 Edge1#show ip route
    Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
           D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2
           i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
           ia - IS-IS inter area, * - candidate default, U - per-user static route
           o - ODR, P - periodic downloaded static route, H - NHRP
           + - replicated route, % - next hop override
    
    Gateway of last resort is not set
    
          1.0.0.0/8 is variably subnetted, 3 subnets, 3 masks
    B        1.0.0.0/8 [20/0] via 1.1.1.2, 01:15:59
    C        1.1.1.0/30 is directly connected, POS1/0
    L        1.1.1.1/32 is directly connected, POS1/0
          2.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
    C        2.2.2.0/30 is directly connected, POS2/0
    L        2.2.2.1/32 is directly connected, POS2/0
  
          167.69.0.0/16 is variably subnetted, 2 subnets, 2 masks
    C        167.69.0.0/16 is directly connected, Loopback0
    L        167.69.0.1/32 is directly connected, Loopback0
          172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
    C        172.16.0.0/24 is directly connected, GigabitEthernet0/0
    L        172.16.0.1/32 is directly connected, GigabitEthernet0/0
    D     192.168.0.0/24 [90/28416] via 172.16.0.3, 02:06:17, GigabitEthernet0/0
                         [90/28416] via 172.16.0.2, 02:06:17, GigabitEthernet0/0

I can't make heads or tails of why my inside ips are not being translated....weird.

Thank you for looking!

-Jim

 

[tangoseal]

Is the problem your sim?

You have switches involved also ... maybe there is something amiss in their configs.

You also have an EIGRP route.. is your other EIGRP players properly configured? Is there any "redistribution" you need to turn on?

That is a pretty advanced setup for a sim. I dont use sims, never have, so not sure what exactly can go wrong in the sim.

 

[BlueLineSwinger]

You forgot to add the keyword "overload" to the end of the command:
'ip nat inside source list 100 pool overloadNAT overload'

Also, why are you using an extended ACL to declare the private range? Since all you need to do is define source IP addresses, a standard ACL (1-99, 1300-1999) should be used:
'access-list 1 permit 192.168.0.0 0.0.0.255'
or a named ACL could be used instead:

Router(config)# ip access-list standard NAME
Router(config-std-nacl)# permit 192.168.0.0 0.0.0.255
(additional private address range declarations as appropriate)
Router(config-std-nacl)# exit

I don't know if the way you're presently using an extended ACL to define the private range is even allowed. If you need to allow/deny certain addresses, use a separate ACL and apply it to an interface as appropriate.

 

[thejimmahknows]

You forgot to add the keyword "overload" to the end of the command:
'ip nat inside source list 100 pool overloadNAT overload'

Also, why are you using an extended ACL to declare the private range? Since all you need to do is define source IP addresses, a standard ACL (1-99, 1300-1999) should be used:
'access-list 1 permit 192.168.0.0 0.0.0.255'
or a named ACL could be used instead:

Router(config)# ip access-list standard NAME
Router(config-std-nacl)# permit 192.168.0.0 0.0.0.255
(additional private address range declarations as appropriate)
Router(config-std-nacl)# exit

I don't know if the way you're presently using an extended ACL to define the private range is even allowed. If you need to allow/deny certain addresses, use a separate ACL and apply it to an interface as appropriate.

You da man! That did it. Must not have liked my extended ACL, changed to basic (acl<100), and now it is translating correctly.

access-list 10 permit 192.168.0.0 0.0.0.255
access-list 11 permit 172.16.0.0 0.0.0.255

Yes it is a complicated sim. It first was an GLBP lab, which grew into a BGP lab, which grew into a NATing lab.