PG1X WIKI

My Knowledge Base

User Tools

Site Tools


tech:network:cisco:infrastructure-services:twice-nat:twice-nat

Cisco: Twice NAT: ip nat inside/outside source static

infrastructure-services.nat.static.twice.553889d2

this lab tested in IOSv 15.9(3)M2. IOS 15.2(1)T or newer version changed behavior. require no-alias option and enabled proxy arp

Memo

  1. Inside Local will translate
  2. Inside Global will translate
  3. Outside Local will translate
  4. Outside Global will translate

Twice NAT Lab

Base Configuration

Common Configuration Snippet

R1

ubuntu-0

ubuntu-1

Configure ip nat outside source 7696e436-b42e-4f28-9444-3528e0cdedb1

configure terminal
!
ip nat inside source static 172.16.1.101 172.16.2.101
ip nat outside source static 172.16.2.102 172.16.1.102 no-alias
!
interface GigabitEthernet0/0
 ip nat inside
interface GigabitEthernet0/1
 ip nat outside
!
! Seems Invalid on newer IOS because Directly connected route AD is preferred?
ip route 172.16.1.102 255.255.255.255 172.16.2.102
! Seems Invalid Configuration unless Serial Interface or newer IOS version?
!ip route 172.16.1.102 255.255.255.255 GigabitEthernet0/1
!
end
show ip nat translation
show ip route
show running-config | include ip route|ip nat (inside|outside) source
show ip arp
ping 172.16.1.102
ping 172.16.1.101
# success...
ping 172.16.2.102
nc 172.16.1.101 1234
nc -l 1234
ssh 172.16.1.102
ssh 172.16.1.101
# timeout
ssh 172.16.2.102
sudo tcpdump -nni ens2 host 172.16.1.101
# except DNS query, ICMP unreachable
sudo tcpdump -nni ens2 "not port 53 and not icmp[icmptype] == 3"

Verification

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is not set

      172.16.0.0/16 is variably subnetted, 6 subnets, 2 masks
C        172.16.1.0/24 is directly connected, GigabitEthernet0/0
L        172.16.1.1/32 is directly connected, GigabitEthernet0/0
S        172.16.1.102/32 [1/0] via 172.16.2.102
C        172.16.2.0/24 is directly connected, GigabitEthernet0/1
L        172.16.2.1/32 is directly connected, GigabitEthernet0/1
L        172.16.2.101/32 is directly connected, GigabitEthernet0/1
R1(config)#do sh ip arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  172.16.1.1              -   5254.0006.f311  ARPA   GigabitEthernet0/0
Internet  172.16.1.101            0   5254.001a.b554  ARPA   GigabitEthernet0/0
Internet  172.16.2.1              -   5254.001a.b690  ARPA   GigabitEthernet0/1
Internet  172.16.2.101            -   5254.001a.b690  ARPA   GigabitEthernet0/1
Internet  172.16.2.102            0   5254.0017.cd84  ARPA   GigabitEthernet0/1
  1. infrastructure-services.nat.static.outside.553889d2.7696e436.lab1-0-wrong.r1ge0-1_ubuntu-1-ens2.pcapng
  2. infrastructure-services.nat.static.outside.553889d2.7696e436.lab1-0-wrong.r1ge0-0_ubuntu-0-ens2.pcapng
R1(config)#do sh ip nat translation
Pro Inside global      Inside local       Outside local      Outside global
--- ---                ---                172.16.1.102       172.16.2.102
tcp 172.16.1.101:22    172.16.1.101:22    172.16.1.102:54376 172.16.2.102:54376
--- 172.16.2.101       172.16.1.101       ---                ---
  1. infrastructure-services.nat.static.outside.553889d2.7696e436.lab1-1-icmp.r1ge0-1_ubuntu-1-ens2.pcapng
  2. infrastructure-services.nat.static.outside.553889d2.7696e436.lab1-1-icmp.r1ge0-0_ubuntu-0-ens2.pcapng
R1(config)#do sh ip nat translation
Pro Inside global      Inside local       Outside local      Outside global
--- ---                ---                172.16.1.102       172.16.2.102
icmp 172.16.2.101:3    172.16.1.101:3     172.16.1.102:3     172.16.2.102:3
tcp 172.16.1.101:22    172.16.1.101:22    172.16.1.102:54376 172.16.2.102:54376
--- 172.16.2.101       172.16.1.101       ---                ---
  1. infrastructure-services.nat.static.outside.553889d2.7696e436.lab1-2-ssh-from-ubuntu-0.r1ge0-1_ubuntu-1-ens2.pcapng
  2. infrastructure-services.nat.static.outside.553889d2.7696e436.lab1-2-ssh-from-ubuntu-0.r1ge0-0_ubuntu-0-ens2.pcapng
R1(config)#do sh ip nat translation
Pro Inside global      Inside local       Outside local      Outside global
--- ---                ---                172.16.1.102       172.16.2.102
tcp 172.16.1.101:22    172.16.1.101:22    172.16.1.102:54376 172.16.2.102:54376
tcp 172.16.2.101:46378 172.16.1.101:46378 172.16.1.102:22    172.16.2.102:22
tcp 172.16.2.101:46438 172.16.1.101:46438 172.16.1.102:22    172.16.2.102:22
--- 172.16.2.101       172.16.1.101       ---                ---
  1. infrastructure-services.nat.static.outside.553889d2.7696e436.lab1-3-ssh-from-ubuntu-1.r1ge0-1_ubuntu-1-ens2.pcapng
  2. infrastructure-services.nat.static.outside.553889d2.7696e436.lab1-3-ssh-from-ubuntu-1.r1ge0-0_ubuntu-0-ens2.pcapng
R1(config)#do sh ip nat translation
Pro Inside global      Inside local       Outside local      Outside global
--- ---                ---                172.16.1.102       172.16.2.102
tcp 172.16.2.101:22    172.16.1.101:22    172.16.1.102:51744 172.16.2.102:51744
--- 172.16.2.101       172.16.1.101       ---                ---

References

tech/network/cisco/infrastructure-services/twice-nat/twice-nat.txt · Last modified: 2021/03/21 19:48 by wnoguchi