LANT-to-LAN using port NAT...

I have a 3000 series Concentrator with two public interfaces. On one public interface, I have a LAN-to-LAN using static NAT to a Cisco IOS IPSec router...
I would like to establish a LAN-to-LAN with the external (public) interface to the same IOS IPSec router...(no problem)
I would like to NAT the external interface to the same translated network...
It would look something like this:
NAT LAN-to-LAN rule:
Interface Source Net.: Translated --------------------> Remote Network
2 public 10.1.x.x : 191.1.1.1 --------------------> 172.x.x.x
3 external 10.2.x.x : 191.1.1.1 ----------------------> 172.x.x.x
IPSec LAN-to-LAN
Ethernet 2 pub 10.1.x.x peers 172.x.x.x
Ethernet 3 ext 10.2.x.x peers 172.x.x.x
Can I use port NAT for the above NAT scenario?
I would like to NAT the two public addresses to the same "translated network".
Thanks...

Well, I guess I have to answer my own question...
The Cisco VPNC does not allow more than one LAN-to-LAN connection to the same PEER...
The port NAT rule would work just fine if the VPNC could have more then one LAN-to-LAN to the same PEER...

Similar Messages

How do I use Port Mapping?

b How do I use Port Mapping?
(This document will assume that you are using and ABS/AEBS/AX as an internet router and have DHCP & NAT turned on.)
Sometime you may want to offer access to a computer on your AirPort network to users on the internet, whether it be a web site, or for file sharing, or just remote access for yourself when traveling. If any of these sound like something you want to do, then you need to understand how Port Mapping works.
b AirPort as Firewall
Most of the time your AirPort base station will not let any traffic into your network which did not originate from your network. It will let everything out and replies to your traffic back in, but it will not let sessions initiated on the internet side of the base station in to your network. This is what is referred to as the "NAT firewall" capability of the base station and it provides effective protection for your network from the internet. What Port Mapping does is poke a hole in this wall to allow certain type(s) of traffic into the network and direct this traffic to a specific computer on the network. In the firewall world this is commonly referred to as an "inbound proxy" or "inbound translation" rule or "PAT" (Port Address Translation) in the router world.
b The Need for Manual Addressing
Since a Port Mapping entry in the base station configuration requires an inside private IP address to be specified, the computer to which to mapping entry applies should always have the IP address specified in the mapping entry. Thus, DHCP should not be used for a computer offering services on the internet as the Port Mapping entry will no longer work if the target computer's IP address changes. In general, an Apple base station's DHCP server will try to assign IP addresses in the 10.0.1.2 to 10.0.1.200 range. IP addresses above 10.0.1.200 can be Manually assigned to computers and other devices on the network up to 10.0.1.254. 10.0.1.255 is reserved (it is the broadcast address for the 10.0.1 subnet). To Manually set up the TCP/IP information for a Macintosh running Mac OS X, go to System Preferences -> Network and "Show" the appropriate interface (Ethernet or AirPort) and click on the TCP/IP tab. Select "Configure Manually" and enter the following information:
IP address : 10.0.1.201 (or whatever address you decide to use)
Subnet mask : 255.255.255.0
Router IP : 10.0.1.1 (the AirPort base station LAN IP)
DNS server : 10.0.1.1, or whatever DNS server IP your ISP uses
After making these changes verify that your computer can still access the internet and local resources on the LAN before continuing.
b Port Mapping a service
In our example we will be hosting a web site on a computer which we have given an IP address of 10.0.1.201. Basic web sites are accessed using the HyperText Transport Protocol (HTTP) and this protocol typically uses port 80 to communicate. In order for others to see the web site, we must configure a Port Mapping entry in the base station configuration to not only allow the web browsers in, but to tell the base station what IP address the web server is using. The Port Mapping entry has three parts: Public Port, Private IP, and Private Port. In this case you would use the following values:
Public Port : 80
Private IP : 10.0.1.201 (this is the computer hosting the web site)
Private Port : 80
In order to access the web site from the internet, users must reference the base station's WAN port public IP (determined by looking at the base station configuration summary page in the AirPort Admin Utility). Since this address may change over time, you might want to use a Dynamic DNS service to simplify connecting for your users.
Sometimes the port you wish to use may be blocked by the ISP. In this case, use a different non-standard Public Port number for the service, but keep the Private Port standard. In the above example, if the ISP was blocking port 80, you could potentially use 8080 instead, so:
Public Port :

Public Port : 8080
Private IP : 10.0.1.201
Private Port : 80
Your users would then have to enter "http://<publicIP>:8080/" (where <publicIP> is the public IP address of the AirPort base station) to access the web site.
b Internal Access
It should be noted that when accessing these services from within the network you cannot reference the Public IP/Public Port, but rather you must use the Private IP/Private Port. Thus, "http://10.0.1.201:80/" in the above example.
b Limits and Options
There is a maximum of 20 Port Mapping entries that can be made in an Apple base station configuration. If you use an AirPort Extreme or AirPort Express base station there is an option which can be helpful in the case where you need many ports opened to a single computer. This is the "Default Host" option. When using this it is not necessary to use Port Mapping at all as all ports will be opened to the specified "Default Host". This is found in "Base Station Options". The default IP address for the "Default Host" is 10.0.1.253. You may change this IP address. The target computer must be Manually configured as specified above with the same IP address. Since all ports are now open to this computer, you should enable and configure the Mac OS X firewall on the default host computer to protect it from intruders.
b Useful Related Links
<a href="http://docs.info.apple.com/article.html?artnum=52002>"Designing AirPort Extreme Networks: Manuals</a>
"Well Known" TCP and UDP Ports Used By Apple Software Products
IANA Port Number Assignments

Using one public ip for ssh`ing to different internal servers using port-redirections

Hi, we are having a requirement to use the same public IP to ssh into different internal servers using port re-direction. So lets say from outside, if a user does ssh @ root 4.4.4.4 2222, it should go to a sshsrv1 and then ssh @ root 4.4.4.4 2223 to sshsrv2
My config is like this:-
object network sshsrv1
host 10.110.100.10
nat (inside,Outside) static 4.4.4.4 service tcp 22 2222
And then i allowed the object "sshsrv1" in my inbound acl from outside.
It dosen`t seem to work. Is this doeable?
Any suggestions??

Hi,
Would need to see your NAT configurations.
There is a possibility that you have a NAT configuration that might be preventing this from working. Then again you are using an extra public IP address for this so it seems strange.
Could you try the "packet-tracer" command
packet-tracer input outside tcp 12345 2222
This should tell us if there is some problem in the ASA configurations.
- Jouni

Design help related to ACE to Switch connectivity using Port-Channel

Hi,
I have a Cisco ACE 4710 configured in One-Arm mode. This ACE is getting connected with 2 3750 switches. These 2 3750 switches connected in trunk mode.
ACE is connected to these 3750 switches using Port-channel.
ACE Config:
================================
interface gigabitEthernet 1/1
description One-arm mode port to DMZ Switch 1 port 20
channel-group 1
no shutdown
interface gigabitEthernet 1/2
description One-arm mode port to DMZ Switch 2 port 20
channel-group 1
no shutdown
interface port-channel 1
switchport access vlan 51
port-channel load-balance src-dst-ip
no shutdown
interface vlan 51
ip address 10.40.56.131 255.255.255.128
access-group input everyone
access-group output everyone
nat-pool 1 10.40.56.215 10.40.56.215 netmask 255.255.255.255 pat
service-policy input LB
service-policy input remote-access
no shutdown
===========================================================
The problem is that 3750 switches are not stacked.
Application is working fine. But i am getting a lot of MAC flapping messages..
kindly suggest whether this design is OK or something needs to be done to rectify it...
Attached a small diagram..

Hello acharyr123,
I don't think this design is ok, and it would cause mac flapping since the two indepedendent 3750 switches will learn the ace mac addresses off of two different interfaces. The 3750s would have to be stacked so that they would act as one switch then this should work correctly.
Thanks
Joel Lamousnery
TAC CSE

CER Use port description as port location

Hello all,
I am trying to confirm if this "feature" is as useless as I have found it to be. From my testing and what little documentation I can find when checking the "Use port description as port location" check box on the LAN switch details screen this will ONLY show you this information when looking at the switch port details screen. It DOES NOT actually use the switch port description as location information for the 911 call notifications.
My hope was that by checking this check box the switch port description would override the ALI location information configured within the ERL assigned to the switch port that the phone is connected to. This would allow the creation of one ERL/ALI per building say and the device specific room level information would simply come from the switch port description. With out this option a ERL/ALI has to be created for every room in the building.
Thank you all.

There's absolutely no problem in choosing 8888 as admin port while installing IWS in solaris Environment. Just make sure u follow these steps while installation:
(1)You should choose a random number for the administration server to make it harder for anyone to breach your server.
(2) Make sure the port you choose isn't in use. Look at the file /etc/services on the server machine to make sure you don't assign a port number that is reserved for another service. If you choose a port that is being used by another service, the installation program prompts you for another port.
(3)Note :If you choose a server port number lower than 1024, you must be logged in as root to start the server. After the server is bound to the port, the server changes from the root user account to the user account you specify. If you choose a port number greater than 1024, you don't have to be the root user to start the server.
Regards
T.Raghulan

Can I connect my Mac (Mac OS X) with other machine (Windows OS) on same LAN using telnet in terminal? For example, telnet ip address of other machine

Can I connect my Mac (Mac OS X) with other machine (Windows OS) on same LAN using telnet in terminal?
For example, telnet <ip address of other machine>
I m a networking student and I have learned to connect 2 machines on Red hat Linux OS on same Ethernet LAN which has same subnet mask. As Mac OS X is also a linux based OS I m trying to connect my Mac with my friends windows based machine using telnet <ip address of his machine>. However, I get a message "unable to connect to remote host".
Can anyone please tell me is this the problem because of different OS or it is something different!
Please reply...it will of great help..

The machine you're trying to connect to needs a Telnet server running on it - telnetd listening on port 23 (usually).
Incidentally, Mac OS X is not a Linux based OS, it is based on BSD Unix.

Create a LAN using Airport

I have an airport extreme (v 7.6.40 and two airport express (one older and a new one). I am looking to establish a good internet connection in my garage, however this is out of range (a separate building) from my main apple extreme network. I have tried establishing a LAN using BT LAN plugs connecting one end into the extreme using the LAN ethernet port, and the other end to the new express again connected to a BT LAN plug.
BT 3 router - Airport extreme- (LAN) Airport express (out with wireless range)
Is there something I am missing here or should I be purchasing a second extreme to provide the 'other end' of the LAN?
Is the issue more fundamental in that the BT plugs are just not doing what they should? When I try this all within range of the extreme, everything seems to work OK, however the airport utility shows the express connecting under the title 'wirelessly connecting the airport express'

Please test to see if the BT "plugs" are working as follows:
Disconnect the AirPort Express from the BT plug and connect a laptop or desktop using an Ethernet cable. Be sure to turn off the wireless on the computer for this "test".
See if the computer can get a good Internet connection this way. If it can.....the "plugs" are working correctly. You can turn the wireless back on at the computer now.
If it cannot.....then you need to do more troubleshooting with the plugs. You cannot install the AirPort Express until the plugs are working correctly in your "test".

Connect two pc's over a lan using labview

Hi,
I am trying to connect two pc's over a LAN using ethernet. Both pc's are connected to the LAN and I can ping each one from the other but I cannot get commseither using the visa vi's in labview or through MAX. In MAX I right clIck 'devices and interfaces' and select create new ->VISA TCP/IP Resource. A dialogue box appears and I select raw socket then click next. I put in the ip address. It looks for a port which I don't know I have tried a few numbers. What am I doing wrong?
Thanks,
Steven

Why don't you just use the TCP functions? There's several shipping examples. I suppose you could write client/server programs with VISA functions but I don't know of any examples of these. You might as well start with something that already exists and modify it for your needs.
I'm not sure MAX will detect just a pc resource unless you start VISA Server on the remote pc.

How to set up different virtual LANs (using the E3200)?

Hi.
I would like to set up different virtual LANs (using the E3200) so that I can have two different networks that can't access each other.
The E3200 is connected to a modem for internet access.
I would like both networks to have access to the internet.
Does the E3200 alone support creating virtual LANs?
If not, is there another way I can meet the requirement using the E3200 alone (using something other than virtual LANs)?
I'm ultimately thinking that I would need at least one other router.
So for example,
Router A (E3200) is connected to the modem and setup for DHCP using a LAN IP range 192.168.1.1/24.
Router B is connected to Router A and setup for DHCP using a LAN IP range 192.168.2.1/24.
In this way devices connected to Router A should not have access to devices connected to Router B and visa-versa, correct? For example, Device X connected to Router A cannot ping or browse files on Device Y connected to Router B and visa-versa, correct?
Would I need to setup anything else on Router B? For example, do I need to setup DNS settings so that devices connected to Router B can connect to the internet without issue? Would I need to specify that these virtual LANs are not bridged, and on which router, or both?
I already know how to set up a static IP, DHCP, LAN IP ranges, and static DNS settings on a router, etc.
In regards to wireless devices, I am thinking they would follow the same pattern; so wireless devices connected to Router A (E3200) have access to other wired and wireless devices connected to Router A but not to wired or wireless devices connected to Router B and visa-versa. However, if wireless devices currently don't have access to wired devices also connected to Router A, then that is fine for now.
Thank you very much!
-Rami
Solved!
Go to Solution.

The E3200 has no VLAN support according to the manual. There's no way to configure two separate networks with this router alone.
You will need to add network electronics.
Ex:
Managed Switch with VLAN
Another wireless router with VLAN
If your modem supplies multiple public or private IP addresses then you could put a switch after the modem and two wireless routers attached to the switch.
Please remember to Kudo those that help you.
Linksys
Communities Technical Support

Tor resolves ip address using port 80 [SOLVED]

Hey everyone,
I'm trying to provide a service to fellow internet users that don't like their internet traffic to be snooped on. To explain my situation I'll tell something about my setup.
I use a router to access the internet. I let a router set up a vpn connection to my vpn provider. Then I tell it, using iptables, to redirect all http and https traffic through the VPN tunnel and let all other traffic go over the standard WAN. Not entirely true, I also redirect all udp and icmp traffic through the vpn tunnel.
I have a server that I want to act as the TOR relay. I want it to use the WAN acces and not go over the VPN. This makes sure I don't burden my vpn provider with a bunch of traffic that can just use my WAN acces.
When setting up the TOR relay I use port 4436 as the relay port and port 9030 as the Directory port. My router directs all this traffic over the WAN. I also port forward these ports in the router towards the server.
The TOR relay seems to work but not entirely. I have the following message log: (I have replaced the ip addresses that belong to my WAN and VPN tunnel with "<wan-ip>" and "<vpn-ip>" to make it clearer. )
sep 04 17:29:48.164 [Notice] Self-testing indicates your DirPort is reachable from the outside. Excellent.
sep 04 17:35:08.532 [Notice] Our IP Address has changed from <wan-ip> to <vpn-ip>; rebuilding descriptor (source: 154.35.32.5).
sep 04 17:35:09.883 [Notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor.
sep 04 17:55:08.476 [Warning] Your server (<vpn-ip>:9030) has not managed to confirm that its DirPort is reachable. Please check your firewalls, ports, address, /etc/hosts file, etc.
sep 04 18:15:08.476 [Warning] Your server (<vpn-ip>:9030) has not managed to confirm that its DirPort is reachable. Please check your firewalls, ports, address, /etc/hosts file, etc.
sep 04 18:26:44.664 [Notice] Our IP Address has changed from <vpn-ip> to <wan-ip>; rebuilding descriptor (source: 128.31.0.34).
sep 04 18:26:45.117 [Notice] Our IP Address has changed from <wan-ip> to <vpn-ip>; rebuilding descriptor (source: 194.109.206.212).
sep 04 18:26:49.342 [Notice] Our IP Address has changed from <vpn-ip> to <wan-ip>; rebuilding descriptor (source: 76.73.17.194).
sep 04 18:26:58.255 [Notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor.
sep 04 18:33:01.221 [Notice] Self-testing indicates your DirPort is reachable from the outside. Excellent.
sep 04 18:36:52.096 [Notice] Our IP Address has changed from <wan-ip> to <vpn-ip>; rebuilding descriptor (source: 212.112.245.170).
sep 04 18:37:10.626 [Notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor.
sep 04 18:56:51.965 [Warning] Your server (<vpn-ip>:9030) has not managed to confirm that its DirPort is reachable. Please check your firewalls, ports, address, /etc/hosts file, etc.
sep 04 19:16:51.967 [Warning] Your server (<vpn-ip>:9030) has not managed to confirm that its DirPort is reachable. Please check your firewalls, ports, address, /etc/hosts file, etc.
sep 04 19:27:44.011 [Notice] Our IP Address has changed from <vpn-ip> to <wan-ip>; rebuilding descriptor (source: 128.31.0.34).
sep 04 19:27:44.092 [Notice] Our IP Address has changed from <wan-ip> to <vpn-ip>; rebuilding descriptor (source: 171.25.193.9).
sep 04 19:27:44.095 [Notice] Our IP Address has changed from <vpn-ip> to <wan-ip>; rebuilding descriptor (source: 128.31.0.34).
sep 04 19:27:44.098 [Notice] Our IP Address has changed from <wan-ip> to <vpn-ip>; rebuilding descriptor (source: 194.109.206.212).
sep 04 19:27:50.211 [Notice] Our IP Address has changed from <vpn-ip> to <wan-ip>; rebuilding descriptor (source: 76.73.17.194).
sep 04 19:27:55.398 [Notice] Self-testing indicates your DirPort is reachable from the outside. Excellent.
sep 04 19:28:08.914 [Notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor.
sep 04 19:29:45.764 [Warning] We just marked ourself as down. Are your external addresses reachable?
sep 04 19:37:51.966 [Notice] Our IP Address has changed from <wan-ip> to <vpn-ip>; rebuilding descriptor (source: 212.112.245.170).
sep 04 19:37:55.358 [Notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor.
What I think will fix the problem is that TOR should not resolve my ip address using http or https since that will provide the wrong ip address. When trying to access that ip address at another port (in this case 9030) will obviously not work. However there is no setting to do that. Is there any way to archieve this?
Please ask if anything is unclear.
Regards,
Berend
--edit--
I was able to set the Address field in the torrc file. This means I can hardcode the ipaddress I want it to use (WAN). However that address can change every 6 months or so. If someone has a better solution that would be very welcome.
Last edited by Berend (2013-09-05 00:47:25)

Berend wrote:@progandy
I don't have any experience with that.
I guess I can tag them with a TOS so my router knows what to do with it. But how would I give that tag?
Select the packtes with owner and then depending on what your router supports you can set either DSCP or TOS. dscp is the current standard, tos is deprecated.

SAN Switch 9148 UPG procedure when using Port Channel

Hi,
I am kind of new to the UPG procedure of Cisco Switch, and the customer i am working with is using Port Channel.
Do i have to shutdown the port channel before executing the switch UPG or if everything can stay up? Will i lose connection when the UPG will proceed ?
If anyone has some documentation that describe the process, it would be much appreciated.
Thank you
Christian

Hi,
I am kind of new to the UPG procedure of Cisco Switch, and the customer i am working with is using Port Channel.
Do i have to shutdown the port channel before executing the switch UPG or if everything can stay up? Will i lose connection when the UPG will proceed ?
If anyone has some documentation that describe the process, it would be much appreciated.
Thank you
Christian

Do I have to use port forwarding in router to log my essential server 2012 from outside

hi,
1--do I have to use port forwarding if I have only essential server 2012 in my home?
2- what is exactly the benefit of port forwarding, besides the converting static IP adres to internal IP adres for clients?
thanks
johan
h.david

Yes.
It allows certain ports to be accessed externally through your firewall, whilst blocking other ports.
You need to allow access to TCP Port 80 and 443 for Essentials Server.
Robert Pearman SBS MVP
itauthority.co.uk |
Title(Required)
Facebook |
Twitter |
Linked in |
Google+

Using Port with apex

I need some help...
I need some examples using port(serial, usb or paralelo) any execise please send it... to [email protected]
i want do a lot of things with it... or if you know where are there examples on the web.. please tell me
Thank u,

HTML is NOT really meant to do ANYTHING with the ports, you would need to look at Java or another higher level language.. What exactly ar eyou looking to do with the Ports?
Also, isn't this a duplicate of your other posting from today? Help in Apex3.2
Please try not to double post about the same topic..
Thank you,
Tony Miller
Webster, TX

Retrieving a file using port 80

Hi,
Can any one please tell how to do the following in Java:
I have a file in a machine. There is a httpd daemon running in the machine. So, i want to connect to connect to the machine using port 80 and retrieve the file. I should be also able to upload the file back to the machine after updating it locally in my machine.
thanks,
Divya lakshmi

Hi,
Can any one please tell how to do the following in
n Java:
I have a file in a machine. There is a httpd daemon
n running in the machine. So, i want to connect to
connect to the machine using port 80 and retrieve the
file. I should be also able to upload the file back to
the machine after updating it locally in my machine.
thanks,
Divya lakshmiIf you want to use a HttpURLConnection to connect to this web server, you can use this code to get the input stream off of the url (its got stuff in there for proxies if you're using one):
     * Get the Input Stream from the Connection given a specific URL
     public java.io.InputStream getInputStream(String urlString) {
          if (urlString == null) urlString = this.urlString;
          if (debug) System.out.println("getInputStream Method Called...");
          try {
               String auth = "";
               if (useProxy) {
                    System.getProperties().put("proxySet", "true");
                    System.getProperties().put("proxyHost", pHost);
                    System.getProperties().put("proxyPort", pPort);
                    String authString = "";
                    if (pUsername != null && pUsername != "") authString = pUsername + ":";
                    else authString = "username:";
                    if (pPassword != null && pPassword != "") authString = authString + pPassword;
                    else authString = authString + "password";
                    auth = "Basic " + new sun.misc.BASE64Encoder().encode(authString.getBytes());
               java.net.URL url = new java.net.URL(urlString);
               conn = (java.net.HttpURLConnection)url.openConnection();
               if (useProxy) conn.setRequestProperty("Proxy-Authorization", auth);
               conn.setRequestProperty("User-Agent", "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)");
               conn.setDoInput( true );
               conn.setDoOutput( true );
               conn.connect();
               return conn.getInputStream();
          } catch (java.io.IOException ioe) {
                  ExceptionDialog exDialog = new ExceptionDialog(new javax.swing.JFrame());
               exDialog.showForThrowable(ioe.toString(),ioe);
               return null;
     }From the input stream, you can extract the contents:
                    BufferedOutputStream out=new BufferedOutputStream(new FileOutputStream(new File("foo.contents"));
                    byte[] b=new byte[1024];
                    int numbytes=0;
                    InputStream ins = seeMethodAbove.getInputStream();
                    while((numbytes=ins.read(b,0,1024))!=-1) {
                         out.write(b,0,numbytes);
                    out.close();As for uploading a new file to the web server, that's going to be a different story. I prefer ftp, as it is a mature and stable protocol, and implementing it is quite easy. there are other ways, such as writing to a script that can process those requests using methods such as POST or GET. what options do you have with the web server?

Why do we use port no. 11333 for Hyperion planning?

Why do we use port no. 11333 for Hyperion planning Metadata Load through ODI?

What more do you need to know, when you deploy planning you will see that there is a "Java RMI Registry" service/process, this runs on port 13333. The planning adaptor communicates with the RMI registry and that then communicates with planning. If you need to know more then search for "Java RMI" on the internet.
Cheers
John
http://john-goodwin.blogspot.com/

LANT-to-LAN using port NAT...

Similar Messages

Maybe you are looking for