Cisco Natting. Please tel me if this is possible.

T

TheGuy

Expert Member
Joined
Sep 14, 2009
Messages
2,974
Reaction score
19
Location
Jozi
So I'm currently trying to setup a leased line between 2 particular clients. Now the problem is both these clients are using the same internal IP ranges so simple routing will not work.

Now what I proposed to the client is that we do natting on the routers so it maps to private IPs not in the same range.

It seems to me that this should be something standard to setup but the service provider says this is not a workable solution and they have done testing and this cannot work.

Any thoughts?
 
Technically it can be done, but honestly, it is probably much easier to just change one of the client networks to use another internal ip range.

The bigger the client range, the longer the config will be, not to mention the confusion it will be every time you want to debug an issue on that link.

I believe in, "Less is More". Going with that, you should just change the internal ip range of 1 client, and use a standard setup with simple routing. Trust me, you will thank the decision later on if you need to debug problems between the 2 networks.
 
Tinuva said:
Technically it can be done, but honestly, it is probably much easier to just change one of the client networks to use another internal ip range.

The bigger the client range, the longer the config will be, not to mention the confusion it will be every time you want to debug an issue on that link.

I believe in, "Less is More". Going with that, you should just change the internal ip range of 1 client, and use a standard setup with simple routing. Trust me, you will thank the decision later on if you need to debug problems between the 2 networks.
Click to expand...

Problem is both the clients are massive so changing IP ranges is not as easy as you think. They are running VLANs as well.
 
TheGuy said:
So I'm currently trying to setup a leased line between 2 particular clients. Now the problem is both these clients are using the same internal IP ranges so simple routing will not work.

Now what I proposed to the client is that we do natting on the routers so it maps to private IPs not in the same range.

It seems to me that this should be something standard to setup but the service provider says this is not a workable solution and they have done testing and this cannot work.

Any thoughts?
Click to expand...

It cannot work? Why cant they just do a range 1-1 NAt to a new IP structure?

Alternatively, how many hosts need to talk to each other? Do they need to talk to specifics or is it all over the place?

Tinuva said:
Technically it can be done, but honestly, it is probably much easier to just change one of the client networks to use another internal ip range.

The bigger the client range, the longer the config will be, not to mention the confusion it will be every time you want to debug an issue on that link.

I believe in, "Less is More". Going with that, you should just change the internal ip range of 1 client, and use a standard setup with simple routing. Trust me, you will thank the decision later on if you need to debug problems between the 2 networks.
Click to expand...

Debugging issues is fairly simply if you do a straight range 1-1 NAT and have proper logging. Certainly easier than changing the internal IP structure of a company (ask microsoft guys if they feel like changing their DC's IP's etc etc)
 
tau1z said:
It cannot work? Why cant they just do a range 1-1 NAt to a new IP structure?

Alternatively, how many hosts need to talk to each other? Do they need to talk to specifics or is it all over the place?
Click to expand...

it's a bunch of workstations that need access to a dumb terminal application so it's only one IP address.

Do you have any idea were I can get a sample script of just the nating part so I can send it to them?
 
TheGuy said:
Problem is both the clients are massive so changing IP ranges is not as easy as you think. They are running VLANs as well.
Click to expand...
What would you call "massive"? 100, 1000, 10 000, 100 000 ?

Depending on the setup, workstations should get ips from DHCP, so changing that should be straight forward, then hopefully only a few servers left.

So even if its massive, it should still be very easy, and vlans doesnt make it much more difficult, in fact it makes it easier, you can do a vlan at a time.

If its only 1 terminal server they need access to, why don't you just do the natting on a router (that should already be in place anyways) before it hits the leased line link? (on your own equipment, not the SP's equipment)
 
Last edited:
TheGuy said:
it's a bunch of workstations that need access to a dumb terminal application so it's only one IP address.

Do you have any idea were I can get a sample script of just the nating part so I can send it to them?
Click to expand...

easy as pie, just use a static for that IP and let your guys connect to that static.
Then hide your traffic behind an IP

IE

static (inside,outside) 192.168.1.1 10.0.1.123 netmask 255.255.255.255

access-list nat_1 ext permit tcp xxxx xxxx xxxx xxxx eq xx

nat (inside) 1 access-list nat_1
global (outside) 1 interface

/EDIT/ this is a firewall config, but i imagine the routers would be very similar

/edit2/ what this does is change the server IP that you connect to to something else.
Then hides your traffic behind the interface of the router. You can make this IP anything really, and just static route it back
 
Last edited:
Renumber. If you want to learn the hard way why you should renumber, you could try this:

Code: 
          +----------+ 10.0.0.1           10.0.0.2 +----------+
          | Router A |-----------------------------| Router B |
          +----------+                             +----------+
               |                                        |
/----------------------------/             /----------------------------/ 
 192.168.0.0/24 at site A                   192.168.0.0/24 at Site B

Assume that from the perspective of site A, site B's network will be addressed as 192.168.2.0/24. Likewise, that from the perspective of site B, site A's network will be addressed as 192.168.1.0/24. Achieving that might require Split-horizon DNS.

This'll allow hosts at Site A to connect to hosts at Site B by connecting to 192.168.2.x:

  • On Router A, add a static route for 192.168.2.0/24 via 10.0.0.2.
  • On Router A, configure NAT so that packets with a source address of 192.168.0.0/24 and a destination address of 192.168.2.0/24 are translated such that the source address becomes 10.0.0.1. (i.e. normal NAT).
  • On Router B, configure destination NAT so that packets with a source address of 10.0.0.1 and a destination address of 192.168.2.x/24 are translated such that the destination address becomes 192.168.0.x. (This is sometimes called reverse NAT.)
Note that, on the site B network, all connections from site A will come from a source address of 10.0.0.1.

Now, to allow connections in the other direction, do the inverse as well:

  • On Router B, add a static route for 192.168.1.0/24 via 10.0.0.1.
  • On Router B, configure NAT so that packets with a source address of 192.168.0.0/24 and a destination address of 192.168.1.0/24 are translated such that the source address becomes 10.0.0.2.
  • On Router A, configure destination NAT so that packets with a source address of 10.0.0.2 and a destination address of 192.168.1.x/24 are translated such that the destination address becomes 192.168.0.x.
Expressing that in your router vendor's syntax is left as an exercise to the reader.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X