Trouble with NAT in my lab

---

Hey there. I am trying to troubleshoot a NAT config in my lab and it is driving me a little crazy. I have 3 Gi interfaces on this 2900 series router. Gi0/0 is configured as the WAN with an IP of 192.168.98.45.. Then I have two internal subnets connected to different interfaces I am trying to get to NAT out using that IP. I've tried just about every combination of the configuration I can think of, but I can only ever successfully get one or the other internal subnet to NAT.. Not both at the same time. Here is the latest attempt:

ip nat outside on Gi0/0

ip nat inside on both Gi0/1 and Gi0/2

IP on Gi0/1
192.168.7.1 255.255.255.0

IP on Gi0/2
192.168.8.1 255.255.252.0

~~ snip of config
ip nat pool PrimaryPool 192.168.98.45 192.168.98.45 netmask 255.255.255.0

ip nat inside source list 1 pool PrimaryPool overload

access-list 1 permit 192.168.8.0 0.0.3.255 log
access-list 1 permit 192.168.7.0 0.0.0.255 log

I also tried doing away with the pool and just using "inteface Gi0/0 overload" in the ip nat inside source statement. no dice.. What am I missing?

-Adam

@Adam-Tyler said in Trouble with NAT in my lab:

Hey there. I am trying to troubleshoot a NAT config in my lab and it is driving me a little crazy. I have 3 Gi interfaces on this 2900 series router. Gi0/0 is configured as the WAN with an IP of 192.168.98.45.. Then I have two internal subnets connected to different interfaces I am trying to get to NAT out using that IP. I've tried just about every combination of the configuration I can think of, but I can only ever successfully get one or the other internal subnet to NAT.. Not both at the same time. Here is the latest attempt:

ip nat pool PrimaryPool 192.168.98.45 192.168.98.45 netmask 255.255.255.0

I'm thinking this may be your problem right here for your overload addressing. You've set up a single IP for the pool, the pool works

ip nat inside source list 1 pool PrimaryPool overload

access-list 1 permit 192.168.8.0 0.0.3.255 log
access-list 1 permit 192.168.7.0 0.0.0.255 log

I also tried doing away with the pool and just using "inteface Gi0/0 overload" in the ip nat inside source statement. no dice.. What am I missing?

-Adam

Ok. we setup the lab as close as possible to your information as we could here's our recommendation:

1. Make sure the outside interface is in the same network as your pool (e.g. 192.168.98.x /24?)

2. With the address pool you're using you need to use more than a single IP your pool. we found that the router doing the nat translation would take 1 ip address. We set one using 2 addresses instead, turn on debug ip nat to see the translations

3. Before configuring nat verify that you've got connectivity between all your devices for nat configuration to take place. (e.g. we removed any previous routing such as static routes and implemented a simple eigrp configuration)

Thanks Ronnie. I worked on this for a couple of hours after posting and started questioning my sanity. Went back and watched the NAT episodes in the CCENT course.. I'll keep playing with it. I was wondering if including multiple subnets in the Access Control List was the issue, but it doesn't sound like it. I did attempt including two ip addresses in the NAT pool and it didn't seem to help. Upgraded firmware on the router thinking it was a bug, same behavior..

I tested that the router could ping the gateway on the 192.168.98.0/24 subnet, that works. I tested that my client workstation could ping the gateway of 192.168.8.1 or 192.168.7.1 depending on which network I was connected to at the time. Both worked.

One strange thing I was getting just before I gave up for the evening.... If my notebook was connected to 192.168.8.0/22 and I had NAT working with the config supplied, then I disconnected from that network and connected to 192.168.7.0/24 NAT did not seem to work. If I went to the router and did a "shutdown" on the WAN interface (Gi0/0), then did an "no shut", NAT would start working for 192.168.7.0/24.. Huh? Then the reverse issue would occur. I move my notebook back to the 192.168.8.0/22 network and it wouldn't NAT until I shut/no shut Gi0/0...

The other thing I didn't really understand or remember being covered in the course was the creation of this NVI0 interface when the first ip nat outside command was issued on Gi0/0. You can see the interface when you do an "show ip int br" commmand and it doesn't get removed until all IP NAT statements are removed from the config and the router rebooted. Blogs say this was added after some release of Cisco IOS 12, but I'm not sure exactly what it does or why it gets created.

Thanks for you time.
-Adam

@Adam-Tyler,

I just tried to recreate it from scratch and this time it worked. Here is the config that I have that was successful. I don't see much different but this one work for me, I turned on debug ip nat

I would try it from a clean router with no previous config and see what happens. Here is my config that worked on the NAT router.

!
interface FastEthernet0/0
 ip address 192.168.7.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface Serial0/0
 no ip address
 shutdown
 clock rate 2000000
!
interface FastEthernet0/1
 ip address 192.168.98.1 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface FastEthernet1/0
 ip address 192.168.8.1 255.255.252.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
!
router eigrp 1
 network 0.0.0.0
 no auto-summary
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip nat pool PrimaryPool 192.168.98.45 192.168.98.46 netmask 255.255.255.0
ip nat inside source list 1 pool PrimaryPool overload
!         
access-list 1 permit 192.168.7.0 0.0.0.255
access-list 1 permit 192.168.8.0 0.0.3.255
no cdp log mismatch duplex

p.s. I just changed the pool to use a single address in the pool and it worked as well. R.

Ronnie, thanks for the update and your research. I will give this another shot with my 2911 router. I actually have two so I will try and factory default each and see if I get the same result.

I passed my CCENT 100-105 exam last week using only ITPro.TV as a source of material for the most part. Thanks guys for a great product.

Regards,
Adam Tyler

With no additional activity for this post, I'm marking as solved. Congratulations on your success on CCENT.