Re: Why is this happening?

Martin Gallagher wrote:
On Thu, 11 May 2006 13:38:31 +0200, Tomasz Grzelak wrote:

ip nat inside source list 10 interface FastEthernet0/0 overload
ip nat inside source static esp 10.44.44.254 interface FastEthernet0/0
!
!

access-list 10 permit any

!


Don't know offhand, but this is bad ju-ju in a NAT config:

!
access-list 10 permit any
!

NAT ACLs should only match the traffic you want to be natted. If you
tell NAT to modify any old traffic, it will, and the result may not be
what you want or expect. Not saying it's causing the problem but it ought
to be fixed.


but the problem is I want all traffic to be NATted - VPN box 1 needs full Internet access, and additionally it needs the tunnel with VPN box 2


Looking at Cisco IOS NAT Application Layer Gateways,
http://www.cisco.com/en/US/products/ps6640/products_white_paper09186a00801af2b9.shtml



I looked at the site, read the info, but IOS on my router is 12.3(8)T5, so it is fresh enough I suppose...

The static esp command "might" also be natting more traffic than you
want, so if your IOS doesn't need it you might get rid of it.


so how can I tell the router to forward all esp traffic to the VPN box 1 ?

Commands that may be prove useful.

show ip nat trans
show ip nat stat
debug ip nat


Thank you for your reply!
Tomasz Grzelak
.

Relevant Pages

  • Re: IOS Debug
    ... : ip nat outside ... :access-list 101 permit udp any host removed eq isakmp ... and they were necessary in older IOS releases. ... IOS has recently changed which IP needs to be named in a crypto map ...
    (comp.dcom.sys.cisco)
  • Re: 3640 some sites slow....
    ... for the Internet connection that's doing NAT and VPN) A 2821 should work ... ip nat inside source static udp 192.168.10.24 21000 interface Dialer1 ... permit ip 172.25.0.0 0.0.255.255 any ... permit tcp any eq ftp-data any ...
    (comp.dcom.sys.cisco)
  • Inside to Inside NAT
    ... I'm trying to configure my c837 to use inside-to-inside NAT, but I'm not getting anywhere, and everywhere I've looked on the Internet regarding this problem seams to tail off without resolve... ... deny ip 172.16.0.0 0.15.255.255 any ... permit icmp any any echo-reply ...
    (comp.dcom.sys.cisco)
  • Cisco 837, NAT & Netscreen in transparent Mode
    ... The VLAN interface of the Netscreen is 192.168.102.7 and the ... I am seeing the Cisco attempt to perform NAT ... Source Any to Dest Any permit HTTP ... ip nat inside source list 23 interface Dialer1 overload ...
    (comp.dcom.sys.cisco)
  • Re: BitTorrent kills 837
    ... NAT problem on our 837 router. ... access-list 102 permit ip 192.168.168.0 0.0.0.255 any ...
    (comp.dcom.sys.cisco)