Downloads |
Table Of Contents
NAT Routemaps Outside-to-Inside Support
Restrictions for NAT Routemaps Outside-to-Inside Support
Information About NAT Routemaps Outside-to-Inside Support
Routemaps Outside-to-Inside Support Feature Design
How to Configure NAT Routemaps Outside-to-Inside Support
Enabling NAT Routemaps Outside-to-Inside Support
Configuration Examples for NAT Routemaps Support
Enabling NAT Routemaps Outside-to-Inside Support: Example
NAT Routemaps Outside-to-Inside Support
The NAT Routemaps Outside-to-Inside Support feature enables the deployment of a NAT routemap configuration that will allow IP sessions to be initiated from the outside to the inside.
History for the NAT Routemaps Outside-to-Inside Support Feature
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
•
Restrictions for NAT Routemaps Outside-to-Inside Support
•
•
•
Restrictions for NAT Routemaps Outside-to-Inside Support
•
•
•
•
•
Information About NAT Routemaps Outside-to-Inside Support
To configure the NAT Routemaps Outside-to-Inside Support feature, you should understand the following concept:
•
Routemaps Outside-to-Inside Support Feature Design
An initial session from inside-to-outside is required to trigger a NAT translation. New translation sessions can then be initiated from outside-to-inside to the inside host that triggered the initial translation.
When routemaps are used to allocate global addresses, the global address can allow return traffic, and the return traffic is allowed only if the return traffic matches the defined routemap in the reverse direction. Current functionality remains unchanged by not creating additional entries to allow the return traffic for a routemap-based dynamic entry unless the reversible keyword is used with the ip nat inside source command.
How to Configure NAT Routemaps Outside-to-Inside Support
This section contains the following procedure:
•
Enabling NAT Routemaps Outside-to-Inside Support
Perform this task to enable NAT Routemaps Outside-to-Inside Support.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
Configuration Examples for NAT Routemaps Support
This section provides the following configuration example:
•
Enabling NAT Routemaps Outside-to-Inside Support: Example
The following example shows how to configure routemap A and routemap B to allow outside-to-inside translation for a destination-based NAT translation:
ip nat pool POOL-A 30.1.10.1 30.1.10.126 netmask 255.255.255.128ip nat pool POOL-B 30.1.20.1 30.1.20.126 netmask 255.255.255.128ip nat inside source route-map MAP-A pool POOL-A reversibleip nat inside source route-map MAP-B pool POOL-B reversible!ip access-list extended ACL-Apermit ip any 30.1.10.128 0.0.0.127ip access-list extended ACL-Bpermit ip any 30.1.20.128 0.0.0.127!route-map MAP-A permit 10match ip address ACL-A!route-map MAP-B permit 10match ip address ACL-BThe following example shows how to configure routemap R1 to allow outside-to-inside translation for static NAT:
ip nat inside source static 1.1.1.1 2.2.2.2 route-map R1 reversible!ip access-list extended ACL-Apermit ip any 30.1.10.128 0.0.0.127route-map R1 permit 10match ip address ACL-AAdditional References
The following sections provide references related to the NAT Routemaps Outside-to-Inside Support feature.
Related Documents
IP NAT commands: complete command syntax, command mode, command history, defaults, usage guidelines, and examples
Cisco IOS IP Command Reference, Volume 1 of 4: Addressing and Services, Release 12.3T
IP NAT configuration tasks
"Configuring Network Address Translation" section of Part 1 of the Cisco IOS IP Configuration Guide, Release 12.3
Standards
MIBs
RFCs
Technical Assistance
Command Reference
This section documents one modified command only.
•
ip nat inside source
To enable Network Address Translation (NAT) of the inside source address, use the ip nat inside source command in global configuration mode. To remove the static translation or remove the dynamic association to a pool, use the no form of this command.
Dynamic NAT
ip nat inside source {list {access-list-number | access-list-name} | route-map name} {interface type number | pool name} [mapping-id map-id | overload | reversible | vrf name]
no ip nat inside source {list {access-list-number | access-list-name} | route-map name} {interface type number | pool name} [mapping-id map-id | overload | reversible | vrf name]
Static NAT
ip nat inside source {static {esp local-ip interface type number | local-ip global-ip}} [extendable] [mapping-id map-id] [no-alias] [no-payload] [redundancy group-name] [route-map name [reversible]] [vrf name]
no ip nat inside source {static {esp local-ip interface type number | local-ip global-ip}} [extendable] [mapping-id map-id] [no-alias] [no-payload] [redundancy group-name] [route-map name [reversible]] [vrf name]
Port Static NAT
ip nat inside source {static {tcp | udp {local-ip local-port global-ip global-port | interface type name global-port}} [extendable] [mapping-id map-id] [no-alias] [no-payload] [redundancy group-name] [route-map name [reversible]] [vrf name]
no ip nat inside source {static {tcp | udp {local-ip local-port global-ip global-port | interface type name global-port}} [extendable] [mapping-id map-id] [no-alias] [no-payload] [redundancy group-name] [route-map name [reversible]] [vrf name]
Network Static NAT
ip nat inside source static network local-network global-network mask [extendable] [no-alias] [no-payload] [mapping-id map-id] [redundancy group-name] [vrf name]
no ip nat inside source static network local-network global-network mask [extendable] [no-alias] [no-payload] [mapping-id map-id] [redundancy group-name] [vrf name]
Syntax Description
Defaults
No NAT translation of inside source addresses occurs.
Command Modes
Global configuration
Command History
Usage Guidelines
This command has two forms: dynamic and static address translation. The form with an access list establishes dynamic translation. Packets from addresses that match the standard access list are translated using global addresses allocated from the pool named with the ip nat pool command.
Packets that enter the router through the inside interface and packets sourced from the router are checked against the access list for possible NAT candidates. The access list is used to specify which traffic is to be translated.
Alternatively, the syntax form with the keyword static establishes a single static translation.
Examples
The following example shows how to translate between inside hosts addressed from either the 192.168.1.0 or 192.168.2.0 network to the globally unique 171.69.233.208/28 network:
ip nat pool net-208 171.69.233.208 171.69.233.223 prefix-length 28ip nat inside source list 1 pool net-208!interface ethernet 0ip address 171.69.232.182 255.255.255.240ip nat outside!interface ethernet 1ip address 192.168.1.94 255.255.255.0ip nat inside!access-list 1 permit 192.168.1.0 0.0.0.255access-list 1 permit 192.168.2.0 0.0.0.255The following example shows how to translate only traffic local to the providers edge device running NAT (NAT-PE):
ip nat inside source list 1 interface e 0 vrf shop overloadip nat inside source list 1 interface e 0 vrf bank overload!ip route vrf shop 0.0.0.0 0.0.0.0 192.1.1.1ip route vrf bank 0.0.0.0 0.0.0.0 192.1.1.1!access-list 1 permit 10.1.1.1.0 0.0.0.255!ip nat inside source list 1 interface e 1 vrf shop overloadip nat inside source list 1 interface e 1 vrf bank overload!ip route vrf shop 0.0.0.0 0.0.0.0 172.1.1.1 globalip route vrf bank 0.0.0.0 0.0.0.0 172.1.1.1 globalaccess-list 1 permit 10.1.1.0 0.0.0.255The following example shows how to translate sessions from outside-to-inside.
ip nat pool POOL-A 30.1.10.1 30.1.10.126 255.255.255.128ip nat pool POOL-B 30.1.20.1 30.1.20.126 255.255.255.128ip nat inside source route-map MAP-A pool POOL-A reversibleip nat inside source route-map MAP-B pool POOL-B reversible!ip access-list extended ACL-Apermit ip any 30.1.10.128 0.0.0.127ip access-list extended ACL-Bpermit ip any 30.1.20.128 0.0.0.127!AP-A permit 10match ip address ACL-A!route-map MAP-B permit 10match ip address ACL-B!The following example shows how to configure routemap R1 to allow outside-to-inside translation for static NAT:
ip nat inside source static 1.1.1.1 2.2.2.2 route-map R1 reversible!ip access-list extended ACL-Apermit ip any 30.1.10.128 0.0.0.127route-map R1 permit 10match ip address ACL-ARelated Commands
Copyright © 2005 Cisco Systems, Inc. All rights reserved.
