FlexConnect in double NAT situation??

I have 1242AP deployed as FlexConnect in my guesthouse wherein my guesthouse is connected to a wireless broadband (3G) that I knew giving me private ip address and most likely natted to a public ip. And then this wireless broadband (3G) is again connected to my home router which provide connectivity to my 1242AP. My WLC residing at our corporate office is configured that the management ip is natted to a public ip and my ASA fw is also configured to allow UDP CAPWAP ports 5246/5247. I can see my 1242AP in my WLC and I can connect locally switched WLAN without problem. Now the problem is in the centrally switched wlan.. It seems that the WLC is dropping the client.
Here's the output from the debug client xx:xx:xx:xx:xx
(Cisco Controller) >*apfReceiveTask: Feb 21 17:20:40.587: 00:19:d2:73:dc:fb apfMsAssoStateDec
*apfReceiveTask: Feb 21 17:20:40.588: 00:19:d2:73:dc:fb apfHreapClientDelete (apf_80211.c:11252) Changing state for mobile 00:19:d2:73:dc:fb on AP 00:3a:98:f8:9f:90 from Associated to Idle
*apfReceiveTask: Feb 21 17:20:40.588: 00:19:d2:73:dc:fb apfMsDeleteByMscb Scheduling mobile for deletion with deleteReason 15, reasonCode 1
*apfReceiveTask: Feb 21 17:20:40.588: 00:19:d2:73:dc:fb Scheduling deletion of Mobile Station: (callerId: 30) in 1 seconds
*osapiBsnTimer: Feb 21 17:20:41.517: 00:19:d2:73:dc:fb apfMsExpireCallback (apf_ms.c:614) Expiring Mobile!
*apfReceiveTask: Feb 21 17:20:41.518: 00:19:d2:73:dc:fb pemApfDeleteMobileStation2: APF_MS_PEM_WAIT_L2_AUTH_COMPLETE = 0.
*apfReceiveTask: Feb 21 17:20:41.518: 00:19:d2:73:dc:fb 192.168.19.104 RUN (20) Deleted mobile LWAPP rule on AP [00:3a:98:f8:9f:90]
*apfReceiveTask: Feb 21 17:20:41.518: 00:19:d2:73:dc:fb apfMsRunStateDec
*apfReceiveTask: Feb 21 17:20:41.518: 00:19:d2:73:dc:fb apfMs1xStateDec
*apfReceiveTask: Feb 21 17:20:41.518: 00:19:d2:73:dc:fb Deleting mobile on AP 00:3a:98:f8:9f:90(0)

You need to maybe look at setting that AP up as an office extend AP since your behind a double nat.
Here are some links.
Q. Can we place the lightweight access point (LAP) under Network Address Translation (NAT)? Does the Lightweight Access Point Protocol (LWAPP) from access point (AP) to WLC work through NAT boundaries?
A. Yes, you can place the LAP under NAT. On the AP side, you can have any type of NAT configured, but, on the WLC side, you can have only 1:1 (static NAT) configured. PAT cannot be configured on the WLC side because LAPs cannot respond to WLCs if the ports are translated to ports other than 12222 or 12223, which are meant for data and control messages.
http://www.rracuares.com/2009/06/26/troubleshooting-lwapp-registration-to-wlc-4400-behind-firewall/
OfficeExtend
http://www.cisco.com/en/US/products/ps11579/products_tech_note09186a0080b7f10e.shtml
Sent from Cisco Technical Support iPhone App

Similar Messages

My Time Capsule is giving me a warning that double NAT situation is occurring and recommends that I set it to bridge mode What is all this about please can it be explained in layman's terms and not martian thank you.

My Time Capsule is giving me a warning that double NAT situation is occurring and recommends that I set it to bridge mode What is all this about please can it be explained in layman's terms and not martian thank you.

You have two devices....the Netgear and Time Capsule both configured to act as routers on the network. You only want one device providing this service.
I suggest that you configure the Time Capsule in Bridge Mode as suggested to eliminate the Double NAT error. Unfortunately, the Guest Network cannot be enabled in this setting.
No other adjustments are needed and everything else will operate normally...and the Time Capsule will still be providing your wireless network signal.
Once the Time Capsule is configured in Bridge Mode, it would be an excellent idea to perform a complete power cycle on the network to allow things to reset properly.
Just power off all devices on the network in any order that you want
Wait a minute
Start the Netgear device first, and let it run a minute by itself
Start the Time Capsule next the same way
Continue starting devices one at a time the same way until everything is powered backup
The other option you have is to "ignore" the error and the light will turn green. The Double NAT error may...or may not cause some issues for you down the line. The next time that you update the Mac operating system, or update the firmware in the Time Capsule, it may likely change the Time Capsule to Bridge Mode automatically.
If your Guest Network "disappears", you will know why this happened, and you will have to manually configure the Time Capsule again in Router Mode to provide DHCP and NAT services.
Double NAT can also cause a slow down of web page loading. You may...or may not....notice this.

Will 'Double NAT' cause any problems for me?

Hi there
I have just received a Netgear VMDG280 Cable/ DSL modem/wireless router from Virgin Broadband in the UK and I plugged it into my Airport Extreme 802.11n base station. The internet works fine but the amber light remains flashing, warning me of a Double Nat error.
I can easily select for my Airport to 'ignore' this Double NAT error message, but am worried that by ignoring this warning, I might compromise something important in my whole broadband set up. Could it also reduce security etc?
Essentially, Im not doing anything fancy with my wireless network, besides running a Macbook Pro, Iphone, Ipad and friend's laptops etc.
With Double NAT existing on my network, will this affect the service I will receive in any way? Or can I just put it out of my mind?
Many thanks
Dan

+If I operate Airport Extreme in Bridge mode, will that mean that the technical quality and security of the Airport Extreme base will be bypassed in favour of the Netgear?+
No
+if the Netgear is classed as the lesser device of the two, shouldnt the Airport Extreme handle the more important tasks rather than being a passive 'bridge'+
The Netgear is already configured as the "main" router on your network. It is what we call a "gateway", a combination modem and router on the same chassis. The AirPort Extreme does not include a modem, so if you wanted to make it the "main" router on your network, you would need to purchase a separate stand alone modem and then set up the Netgear as a "bridge". That gets really complicated.
If you are seeing no adverse effects of the Double NAT, you can choose to "ignore" the message and the light will turn green. If you want to do this, open AirPort Utility, click Manual Setup, and then click on the word "Status" on the summary page. Click "ignore" regarding the Double NAT.
Networking rules specify that you should try to avoid the Double NAT situation if possible. On a simple home network this is not usually a serious error, but it can slowdown internet browsing. If you plan to add a gaming console and want to play online games with other people, then the Double NAT will probably prevent you from doing so.
My suggestion to place the AirPort Extreme in bridge mode was just that...a suggestion. If you are happy with the performance of your network now and simply want to get the light to turn green, you can choose to "ignore" the message.

I live in an apartment with supplied internet. I have wireless network with no password. I have a wall outlet that I can plug into. When I plug in my TC I get a double NAT error. I try bridge mode, but I can't get the internet to work.

Can I get an explanation of what bridge mode is?
Can I get suggestions on what I should do to use the TC as a wireless device to spread the same wireless device my apartment is broadcasting?
Can I get a suggestion on how to use the TC as a different wireless device with it's own password without access to the cable modem. I only have access to a wall port.
I own many apple devices, iMac mid-2011, Macbook Air 2013, 2 ipads, and 2 iphones for the family, and Apple TV.
I want all my devices to be on a password related internet but the double nat on my TC makes weird things happen and slow. I try bridge mode but the internet doesn't work.
I hope I have described this situation clearly enough.
Thanks

I want all my devices to be on a password related internet but the double nat on my TC makes weird things happen and slow. I try bridge mode but the internet doesn't work.
You building supplied internet is a cheap service that is without proper routable addresses..
Therefore to use more than one IP you MUST have double NAT.. sorry there is no choice..
Slow that is because you are sharing internet with every other person in the building.. get your own broadband service.
Bridge will not work.. it cannot work because the building only has private IP addressing. And they only give you a single address.
You can put a password on the wireless.. go to the airport utility and put in a password.
Other than that I don't understand what password you expect.
Can I get an explanation of what bridge mode is?
No NAT.. means the TC becomes a dumb Wireless AP and switch.. works fine with a cable modem router.. or any broadband router but useless with your building system.
Can I get suggestions on what I should do to use the TC as a wireless device to spread the same wireless device my apartment is broadcasting?
Double NAT, and set your own wireless names. There is no alternative.. sorry.

No DNS and Double NAT

Hello, I've recently encountered a very frustrating bug in my system that I could use some help troubleshooting. I've read several similar posts, some are resolved while others are not, however none of the resolutions have worked for my situation. Here it goes:
I have an old macbook pro, a new macbook air, a white macbook and 2 iPhone 4s's all connected to the internet via WiFi through an AirPort Extreme. The AE is connected to a cable modem which has internet service through Cablevision in NY. There is also an AT&T Microcell hooked up to the AE to boost my cell signal. All of this equipment has been working flawlessly together for a long time. Until recently. It could have started after an update, there have been several lately on all of the equipment including the firmware in the AE. Anyway, I'll be connected without any issues - all lights green and happy - when suddenly, the internet will drop off and the AirPort Utility will pop up and warn me that:
1) On the "internet" icon, it will say "disconnected"
2) On the AE icon, it says "No DNS server and Double NAT"
After a few minutes and nothing done on my part, the lights turn green, the internet reconnects and all is well again.
This happens frequently and is really beaching a nuisance. Due to the frequency of the disconnection, I can no longer download a large file, update, or anything. Streaming video is impossible.
So far, I have tried bridge mode and cycled the power in the order recommended to no avail. When I do that, the AE turns green, but the internet says "not connected". I have also read that there might be too many IP addresses which is not sitting well with my ISP, so I disconnected everything including unplugging the Microcell. Lastly, there are no other wireless phones or devises in the house. All to no avail.
I should also mention that this began occurring on my Time Capsule, which I replaced with the AE in an attempt to fix this issue.
Any help would be greatly appreciated.
Joe

Sounds very similar to what I've been trouble shooting for 2 months now, only I have DSL from AT&T and I don't see the Double NAT warning. My last post on the problem is here.
My only emergency solution for getting by day to day on the internet is to unplug the AE and connect one Mac directly to the DSL modem. There's no shared connection or WiFi. I looked at hosting WiFi from the Mac, but the only security available with that is WEP which isn't considered secure. Even with this set up, I think (seat of the pants) that there are quality of service problems.
I've replaced the Airport Extreme with 2 different new units and the DSL modem with a new unit to no avail. The Genius Bar and Apple phone support couldn't solve this, nor have 2 calls to AT&T support and one visit from an AT&T repairman.
I would like to know how to better test or quantify the poor quality of connection that seems to be the problem.

Double-NAT when iChat "Screen Sharing"

I have a weird situation, wondering if all you super-network geniuses could offer an opinion...
My current setup:
-DSL Modem hooked up to a Time Capsule.
-Time Capsule in Ethernet Mode & "Share Public IP Address: NAT & DHCP Enabled."
-Time Capsule has a wireless 5Gz "N-Only" network.
-2PC's, and an Airport Express connected to N Network wirelessly.
-Airport Express "Extends network" via ethernet cable to Slingbox & TiVo (via switch.)
-Airport Extreme wired to Time Capsule.
-Airport Extreme in Bridge Mode.
-Airport Extreme has a wireless "G" network & USB Printer.
-Airport Extreme network for "iPhones & G computer."
-Only Port Mapping is for slingbox, ports 5001,5001.
O.k. Everything works PERFECTLY! Except when I start a "Screen Sharing" session in iChat AV.
When I click "Ask to share xxx's screen" It says "Waiting on xxx" and then Airport Utility pops up, saying that the Time Capsule has an error - "Double NAT" and I'm off the internet. All I have to do is select "Restart Time Capsule" and after a reboot, I'm back in business, and all is well again. I can screen share, chat, etc. However, if I try and start "Screen Sharing" again, same thing - Double NAT.
Do I need to enable a Port Mapping for iChat?
Any suggestions or help would be greatly appreciated. I thought I finally had the network thing down, but this one little thing keeps making me reset my router. (Doesn't seem like the Apple way.)
Thanks.

I have the Time Capsule set up as the DHCP server, distributing a shared IP address.
The Express is set up to "Join and existing network."
I only have 1 Extreme and it is set to "Bridge Mode."
The Time Capsule is the router hooked directly to the DSL modem. It is in "Ethernet" mode, and I'm not quite sure how to check the little DSL modem's settings.
It's so strange, that only this one little request, "Ask to share xxx's screen" does this error occur.
Looking at more settings on the Time Capsule, under NAT settings, I do NOT have the "Enable default host at:" option checked, and the "Enable NAT Port Mapping Protocol" IS checked. Under Port Mappings, 5001,5001 is the only item for Slingbox.

IChat Screen Sharing causes Time Capsule to have "Double NAT"

I have a weird situation, wondering if all you super-network geniuses could offer an opinion...
My current setup:
-DSL Modem hooked up to a Time Capsule.
-Time Capsule in Ethernet Mode & "Share Public IP Address: NAT & DHCP Enabled."
-Time Capsule has a wireless 5Gz "N-Only" network.
-MacBook Pro, PC and an Airport Express connected to N Network wirelessly.
-Airport Express "Extends network" via ethernet cable to Slingbox & TiVo (via switch.)
-Airport Extreme hard-wired to Time Capsule.
-Airport Extreme in Bridge Mode.
-Airport Extreme has a wireless "G" network & USB Printer.
-Airport Extreme network for "iPhones & G computer."
-Only Port Mapping is for slingbox, ports 5001,5001.
O.k. Everything works PERFECTLY! Except when I start a "Screen Sharing" session in iChat AV.
When I click "Ask to share xxx's screen" It says "Waiting on xxx" and then Airport Utility pops up, saying that the Time Capsule has an error - "Double NAT" and I'm off the internet. All I have to do is select "Restart Time Capsule" and after a reboot, I'm back in business, and all is well again. I can screen share, chat, etc. However, if I try and start "Screen Sharing" again, same thing - Double NAT.
Do I need to enable a Port Mapping for iChat?
Any suggestions or help would be greatly appreciated. I thought I finally had the network thing down, but this one little thing keeps making me reset my router. (Doesn't seem like the Apple way.)
Thanks.

I have the Time Capsule set up as the DHCP server, distributing a shared IP address.
The Express is set up to "Join and existing network."
I only have 1 Extreme and it is set to "Bridge Mode."
The Time Capsule is the router hooked directly to the DSL modem. It is in "Ethernet" mode, and I'm not quite sure how to check the little DSL modem's settings.
It's so strange, that only this one little request, "Ask to share xxx's screen" does this error occur.
Looking at more settings on the Time Capsule, under NAT settings, I do NOT have the "Enable default host at:" option checked, and the "Enable NAT Port Mapping Protocol" IS checked. Under Port Mappings, 5001,5001 is the only item for Slingbox.

Since cahnging FIOS Internet provider, which required a router to go in front of "AirPort" I have a blinking yellow on the AirPort and suggested editing in AirPort utility to cahnge from Double NAT to "Bridge Mode" my knowledge base is not clear as t

How do I clean up my new FIOS connection? I just cahnged ISP Fios and they reqquired a router of thier own in front of my AirPort Extreme. Since then I have blinking yellow light on the AirPort and AirPort utility keeps promting for an edit. Suggests canging from NAT to "Bridge mode". Obviuosly U have some internet or this post would not go anywhere, my knowledge base is not enought to feel comfortable with changing the settings. Correctly editing can be tricky, so how do I make necessary changes?

How do I clean up my new FIOS connection?
The FIOS router needs to be in Bridge Mode to prevent the Double NAT error from occurring when two routers are both fighting with each other for control of the network.
Unfortunately, the likely problem from the FIOS side is that FIOS support will either tell you that their router cannot be configured to operate in Bridge Mode, or if it can, they will not tell you how to do it.
But, it could not hurt to check with FIOS to see if anything might have changed recently in this regard, so your first call would be to FIOS support.
If you cannot change the FIOS router to Bridge Mode, the alternate plan would be to change the AirPort Extreme to Bridge Mode. If you are using the Guest Network feature on the AirPort Extreme at this time, that feature will not work correctly when the AirPort is set up in Bridge Mode.

Why do I lose internet connection when I put airport extreme into bridge mode to correct Double NAT issue

I reset my airport extreme router the other day because I was too lazy to reset the password on my private network.
I have been reading the advice found on apple support communities and wide web, but the solutions do not solve any problems and often create new ones.
I'm regretting because everything was working just fine.
But I remember having this double nat error when I first set it up a few months back, but now I cannot resolve it.
I would live with the yellow light, but it seems that this double nat error is preventing my playstation 3 from connecting to the airport extreme.
When I put the aiport extreme into bridge mode, I loose all my wireless networks, even when I reboot the airport extreme and the modem.
I try rebooting the modem, then the airport. and vice versa. No internet.
I switch back to NAT/DCHP and the internet works fine on apple devices, but not the playstation 3, and I have the 1 Double NAT error.
I have a plain stock Motorolla modem and I can dial in and see settings (although nothing about NAT). I didn't see where to see them.
I tried setting the DHCP only but it said it didn't like the settings. is there a stock range i could be using?

I have a plain stock Motorolla modem and I can dial in and see settings (although nothing about NAT). I didn't see where to see them.
Exact model .. motorola make adsl, cable and probably wireless modems.. with some modems and some modem router.. we need exact info. What kind of broadband do you have?
I would note.. some of the motorola cable modems seem to have issues with the apple routers. If you are about due to change modems.. now is a good time.. not another motorola.
If the modem is a straight cable modem, the AE must be in router mode.. but you need to power down the cable modem. maybe for 20min so the new router can pick up the IP address.
You cannot use DHCP alone.. the ISP do not give you a block of IP addresses.
You cannot use bridge with a pure modem.. you will find it works.. but only to one device.
The only reason you get double NAT is the failure to pick up the public IP.
Give the info required..
If you have trouble, I need the actual IP of the modem. the actual IP of the AE WAN port when plugged in. Screenshots are good.

Airport Internet Sharing and Double Nat Issue on the road

The Airport express is a very handy little piece of hardware that is particularly easy to pack in a luggage and carry along for those of us that are spending lots of time out of the office and home.
So here is the scenario when I travel and check in into an overseas hotel: I got two iphones, one local network, one my home network, and a Mac Book Pro, and soon, [when it finally ships], an iPad.
That makes it at least 3 MAC addresses in one room, and if i have any visiting colleagues to pack up a presentation, I will have more.
Usually hotels in Asia are well equipped with ethernet points in every room. The problem comes when I want to allow all my gears to connect to the internet.
I can use the Mac Book to share its ethernet connection while tethered to the plug, which not only turns it into an unlikely desktop, but also do not champion stability when it goes in stand by or sleeps and at times it even mixes up which is the access point to the net. Therefore this does not seem to be the best solution.
I can put the AE in bridge mode and plug it straight to the ethernet. But most hotels internet access are designed to charge per MAC address, so every time the router assigns via DHCP an IP to one of my gears it requires to accept new charges for that gear, even if they are all in the same room. This definitely does not seem right either.
Now if I configure the AE to share a public IP address and force it to ignore the double NAT warning, the AE light turns green but the internet sharing does not seem to work at all.
My two questions are:
1) Why can't the AE be configured like the Mac Book to have a simple "Internet Sharing" protocol that will be always live and not going to sleep or stand by like the laptop [As the AE is design to be always online as a wireless connection].
2) is there any way to make that "Share a public IP - *** double NAT" work?
Any feedback is welcome.
Thanks. M

Hi Bob,
thanks for your reply. Yes the only way to work it out on a typical hotel set up is to adopt the bridge mode and sometime the do waive your extra logs in. But I am not always so lucky and I often need to come up with less optimal solution.
This is a bit disappointing when you a have a AE in your luggage and you can't use it properly.
Yet my Mac can work the problem out effortlessly by just "Sharing a internet connection" with the only major limitation of being physically connected to the Ethernet cable.
Why can't the Airport Express do the same thing? Basically the AE could share the internet connection like the Mac Book, i guess introducing a secondary layer of NAT after the Hotel modem/router NAT setup [which is what the MAC Book is doing].
If AE can't do that at all then I guess soon we will just end up shelving it.
I wonder if this is an actual hardware limitation, MAC Book can wire TCP/IP flow to different sources on a double nat and AE can't, or this is just a software limitation and Apple could fix it with a firmware upgrade.
Any thoughts on this?

Time Capsule - No DNS servers and Double NAT

I'm connecting an MBP running 10.5.6 to a Time Capsule which accesses Virgin Media broadband using a cable modem.
It has been working fine for 6 months, but I made some changes this morning to get my wireless camera onto the network, which broke the connection, and don't seem to be able to undo them.
The TC now flashes amber, and going into Airport Utility I get the following errors:
- No DNS Servers
- Double NAT
I've typed the DNS servers' IP addresses for my ISP into Airport Utility but it doesn't seem to recognise them. It also complains about a double NAT problem but I don't have another router assigning IP addresses.
I've also tried a hard reset on the TC, switched it and the modem off, waited 30 mins and then switched back on again - no luck.
Screenshots of all the settings on my TC from Airport Utility are here:
http://web.me.com/julianlove/Site/TimeCapsule.html
I'm not very knowledgeable about networking so any assistance appreciated.

Double NAT is an indication that you have two devices on the network both trying to perform routing duties. You only want one device doing this on a network. Solve the NAT issue and the DNS issue will go away as well.
What is the make and model number of the device that you call your "modem"?

How do I set up my Airport Express to my Viasat modem, which requires a DHCP connection, without getting a double NAT connection error?

I have an Airport Express connected to a Viasat 4100 satellite modem. This requires a DHCP connection and is connected to my Airport Express by Ethernet. I then have three computers (two running Mavericks and one running Lion) and two IPhone 5s and an Apple Tv on the network. If the Airport Express is set to DHCP and NAT then the network works and I have internet, but the amber light flashes and I have a double NAT error. If I use it in Bridge mode the airport express goes green but I have no internet. How can I set it up so it works properly? If anyone knows could they please give all the settings I shoud use on the Airport Express as I may have left incorrect setting on it whilst trying to fix the problem. I have checked and it has been confirmed that I cannot change any settings on the satellite modem.

Go into AirPort Utility, click on the AirPort Express, and click on the "Double-NAT" error. Click Ignore. There's nothing that can be done about the Double-Nat unless you ignore it (no harm) or contact your ISP and get them to change your Modem/Router into Bridge Mode, and even then can't guarantee that you won't get that error.
Again, best thing to do: Ignore the Double-Nat Error.

NAT overload is not working when i configure Double NAT for VPN

I have Cisco 2921 router with OS version 15.1(4)M1.
the router is configured for NAT overload and working fine, i have site to site VPN tunnel with peer with normal NAT translation. now we need to configure Double NAT on the VPN tunnel as we need to free the subnet on peer network. for double nat i use 3.2.21.x - 3.2.23.x / 24 network and apply following command
Double NAT translation
ip nat inside source static network 192.168.10.0 3.2.21.0 /24 no-alias
ip nat inside source static network 192.168.20.0 3.2.22.0/24 no-alias
ip nat inside source static network 192.168.30.0 3.2.23.0 /24 no-alias
Nonat
access-list 101 deny   ip 3.2.21.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny   ip 3.2.22.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny   ip 3.2.23.0 0.0.0.255 3.2.1.0 0.0.0.255
VPN encrypted traffic over the tunnel
access-list 115 permit ip 3.2.21.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 115 permit ip 3.2.22.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 115 permit ip 3.2.23.0 0.0.0.255 3.2.1.0 0.0.0.255
Problem:
as soon as i apply Double NAT translation command the NAT overload stop working and client cannot reach to the internet
the router partial configuration is as below
REACH-R01(config)#do sh run
Building configuration...
Current configuration : 19233 bytes
! Last configuration change at 09:56:45 MST Tue Jan 29 2013 by admin
! NVRAM config last updated at 13:57:54 MST Wed Jan 30 2013
! NVRAM config last updated at 13:57:54 MST Wed Jan 30 2013
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname REACH-R01
boot-start-marker
boot-end-marker
card type t1 0 0
logging buffered 51200 warnings
no aaa new-model
clock timezone MST -7 0
clock summer-time MST recurring
network-clock-participate wic 0
network-clock-select 1 T1 0/0/0
no ipv6 cef
ip source-route
ip cef
ip dhcp excluded-address 192.168.20.1 192.168.20.99
ip dhcp excluded-address 192.168.20.250 192.168.20.255
ip dhcp pool CISCO_PHONES
network 192.168.20.0 255.255.255.0
default-router 192.168.20.254
option 150 ip 192.168.20.254
no ip domain lookup
ip domain name reach.local
ip inspect name ethernetin ftp timeout 3600
ip inspect name ethernetin h323 timeout 3600
ip inspect name ethernetin http timeout 3600
ip inspect name ethernetin rcmd timeout 3600
ip inspect name ethernetin realaudio timeout 3600
ip inspect name ethernetin smtp timeout 3600
ip inspect name ethernetin sqlnet timeout 3600
ip inspect name ethernetin streamworks timeout 3600
ip inspect name ethernetin tcp timeout 3600
ip inspect name ethernetin tftp timeout 30
ip inspect name ethernetin udp timeout 15
ip inspect name ethernetin vdolive timeout 3600
multilink bundle-name authenticated
isdn switch-type primary-ni
trunk group PRI
crypto pki token default removal timeout 0
crypto pki trustpoint TP-self-signed-3180627716
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3180627716
revocation-check none
rsakeypair TP-self-signed-3180627716
voice-card 0
dsp services dspfarm
voice service voip
allow-connections sip to sip
fax protocol t38 version 0 ls-redundancy 0 hs-redundancy 0 fallback none
sip
voice translation-rule 1
rule 5 /^7804981231/ /401/
voice translation-rule 2
rule 5 // /7804981231/
voice translation-profile DID_INBOUND
translate called 1
voice translation-profile DID_OUTBOUND
translate calling 2
license udi pid CISCO2911/K9 sn FGL1540114P
license accept end user agreement
license boot module c2900 technology-package securityk9
hw-module ism 0
hw-module pvdm 0/0
username test test
redundancy
controller T1 0/0/0
cablelength long 0db
pri-group timeslots 1-6,24
no ip ftp passive
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
crypto isakmp key P@ssw0rd address 33.33.33.33 no-xauth
crypto ipsec transform-set ESP-AES256-SHA esp-aes 256 esp-sha-hmac
crypto map VPN-TUNNEL 1 ipsec-isakmp
description COMPUGEN
set peer 33.33.33.33
set transform-set ESP-AES256-SHA
match address 115
interface Embedded-Service-Engine0/0
no ip address
shutdown
interface GigabitEthernet0/0
description Outside Interface To the Internet
ip address dhcp
ip access-group outside_access_in in
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
crypto map VPN-TUNNEL
interface ISM0/0
ip unnumbered GigabitEthernet0/1.20
service-module ip address 192.168.20.2 255.255.255.0
!Application: CUE Running on ISM
service-module ip default-gateway 192.168.20.254
interface GigabitEthernet0/1
no ip address
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
interface GigabitEthernet0/1.10
description VLAN 10 DATA VLAN
encapsulation dot1Q 10
ip address 192.168.10.254 255.255.255.0
ip nat inside
ip inspect ethernetin in
ip virtual-reassembly in
interface GigabitEthernet0/1.20
description VLAN 20 VOICE VLAN
encapsulation dot1Q 20
ip address 192.168.20.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
interface GigabitEthernet0/1.30
description VLAN 30 WIRELESS VLAN
encapsulation dot1Q 30
ip address 192.168.30.254 255.255.255.0
ip nat inside
ip inspect ethernetin in
ip virtual-reassembly in
interface GigabitEthernet0/2
no ip address
shutdown
duplex auto
speed auto
interface ISM0/1
description Internal switch interface connected to Internal Service Module
no ip address
interface Serial0/0/0:23
no ip address
encapsulation hdlc
isdn switch-type primary-ni
isdn incoming-voice voice
trunk-group PRI
no cdp enable
interface Vlan1
no ip address
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip http path flash:CME8.6/GUI
ip nat inside source static tcp 192.168.10.10 443 interface GigabitEthernet0/0 443
ip nat inside source static tcp 192.168.10.10 25 interface GigabitEthernet0/0 25
ip nat inside source static tcp 192.168.10.10 1723 interface GigabitEthernet0/0 1723
ip nat inside source static tcp 192.168.10.10 3389 interface GigabitEthernet0/0 3389
ip nat inside source static tcp 192.168.10.10 123 interface GigabitEthernet0/0 123
ip nat inside source static tcp 192.168.10.10 987 interface GigabitEthernet0/0 987
ip nat inside source list 101 interface GigabitEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 75.152.248.1
ip route 0.0.0.0 0.0.0.0 75.152.248.1 254
ip route 0.0.0.0 0.0.0.0 205.206.0.1 254
ip route 192.168.20.2 255.255.255.255 ISM0/0
ip access-list extended outside_access_in
permit udp any any eq bootps
permit udp any any eq bootpc
permit tcp any host 22.22.22.22 eq 1723
permit tcp any host 22.22.22.22 eq 3389
permit tcp any host 22.22.22.22 eq smtp
permit tcp any host 22.22.22.22 eq 443
permit tcp any host 22.22.22.22 eq domain
permit udp any host 22.22.22.22 eq domain
permit tcp any host 22.22.22.22 eq 123
permit icmp any host 22.22.22.22 unreachable
permit icmp any host 22.22.22.22 echo-reply
permit icmp any host 22.22.22.22 packet-too-big
permit icmp any host 22.22.22.22 time-exceeded
permit icmp any host 22.22.22.22 traceroute
permit icmp any host 22.22.22.22 administratively-prohibited
permit icmp any host 22.22.22.22 echo
permit tcp any host 22.22.22.22 eq 987
permit tcp any host 22.22.22.22 eq 47
permit gre any host 22.22.22.22
permit udp any host 22.22.22.22 eq isakmp
permit esp any host 22.22.22.22
access-list 23 permit any
access-list 101 deny   ip 192.168.20.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny   ip 192.168.30.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny   ip 192.168.10.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny   ip 3.2.21.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny   ip 3.2.22.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny   ip 3.2.23.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 permit ip 192.168.10.0 0.0.0.255 any
access-list 101 permit ip 192.168.20.0 0.0.0.255 any
access-list 101 permit ip 192.168.30.0 0.0.0.255 any
access-list 110 permit ip 0.0.0.0 255.255.255.0 0.0.0.0 255.255.255.0
access-list 115 permit ip 3.2.21.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 115 permit ip 3.2.22.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 115 permit ip 3.2.23.0 0.0.0.255 3.2.1.0 0.0.0.255
Solution: Support forums team

I have the same problem also. Restarting isn't helping and the auto lock/unlock button is on. Plus a couple of time when I turn it on it is asking if I want to power off. That is when I push the button on the front to wake it up. Not the power button on top. I have an IPAd 2. Worked fine before the update.

Back to my Mac: Double NAT error

I can't seem to get Back to my Mac to work. My Airport Extreme says that I have a double NAT error. I have tried to put it in Bridge mode, but doing so disables the wireless capabilities of the Airport Extreme.
The geography of my network is as follows:
Cable port on wall> Cable modem
Cable modem> Ethernet> Airport Extreme
Airport Extreme> WiFi> Macbook Pro
I have a Motorola surfboard modem, which I have called Motorola about and they say that it does not provide a layer of NAT. I have called my ISP and they confirmed that they do not provide a layer of NAT as well.
Does anyone have any ideas on how to resolve this issue?

FiggyOO wrote:
I have confirmed that my modem is simply a modem, no gateway. In case you were wondering its a Motorola SB5101U. According to the Airport utility, my IP is 10.1.4.104.
If that's really the "WAN" IP address of your AirPort unit, then it's a "private" IP address, as it's in one of the private address ranges of 10.0.0.0 - 10.255.255.255, 172.16.0.0 - 172.31.255.255, and 192.168.0.0 - 192.168.255.255. You can verify that address in the AirPort Utility Internet panel, TCP/IP tab. Unless your ISP tells you otherwise, you should have the "Configure IPv4" set to "Using DHCP" and the WAN IP address should be just below that.
If that address checks out, something "upstream" of your AirPort unit is doing a NAT operation.
The manuals I found for your modem seem to confirm that it has no router functionality, so it would be unable to be the source of the NAT.
I'd call your ISP and ask them why your modem is passing you a "private" IP address. There no need (at least initially) to mention what you have connected to the modem, as that would only tend to confuse the support people.

Double NAT Error with Airport Extreme and Airport Express

I have an Airport Extreme 802.11n base station which is connected to my DSL Modem/ Router via Ethernet. I have a MacPro which does not have an airport card installed so I bought an Airport Express 802.11n - which is connected to my MacPro via ethernet - and thus provides my MacPro with internet access.
Originally I had the APExtreme and the APExpress set up in a WDS - all worked well - my other wifi equipped macs and devices in the house connected to the network with no problem, but I did notice that the maximum throughput I was getting was 802.11g speeds - this is of course due to the overhead of the WDS.
I originally purchased these 802.11n devices because I wanted the higher throughput - so I decided to terminate the WDS and just have the APExpress (attached to my MacPro) "join" the wireless network instead of extending it - which works and I am enjoying the 802.11n speed.
So, I just upgraded a couple of my Macs to 10.6.2 and was going to start using "Back to My Mac" and I got the error that there is a double NAT address problem and that "Back to My Mac" won't work until this is resolved.
I know that going back to a WDS will resolve the double NAT problem - but I don't want to take the performance hit that goes with the WDS.
So, short of buying an Airport card for my MacPro (which would eliminate the need of the APExpress)
Is there any other way to resolve this double NAT problem besides WDS?
Thanks for any advice.

First of all thanks for your quick reply!
Connecting my MacPro to the Airport Extreme would be a serious pain as the DSL Modem and APExtreme are upstairs near the only connection point in the building to a phone line - and my MacPro is downstairs.
I suppose I could dig out a very long ethernet cable to perform the test. But before I jump through that hoop - please explain to me what you are trying to get at - in other words - what does it mean if this resolves the double nat error - and what does it mean if it does not?

FlexConnect in double NAT situation??

Similar Messages

Maybe you are looking for