NAT'd IP Address

Hi, i'm currently on Infinity 2 with a hub 5 router, basically i use opendns on both my desktop and laptop with the ip updater software. Anyway recently i had an issue were other people seem to be affected by my dns settings even though i'm in Northern Ireland and they are in England. Following a fair amount of investigation by OpenDns support and tests from my PC they believe i'm on a NAT'd Ip address. Can this be looked into by someone in support. This issue occured around 2 weeks ago.

This picture will show if you are on CG-NAT.
http://forumhelp.dyndns.info/networking/cgnat.jpg
and this how to check and opt out http://btsupport.custhelp.com/app/answers/detail/a_id/44044/c/6433
If you want to say thanks for a helpful answer,please click on the Ratings star on the left-hand side If the reply answers your question then please mark as ’Mark as Accepted Solution’

Similar Messages

Trusted RFC and Remote logon not possible due to Nat'd IP addresses

Hi,
We are trying to connect our SolMan 4 to our cusotmers ECC 6 and BI7 systems, the systems are off site and the IP addresses for the customers systems are nat'd when they come in and go out from our Network.
The problem we get is that we cannot set up Trusted systems or Remote Logon to these systems due to issues with the Nating of the IP adresses. We can set up all standard RFC's after adding the the appropriate addresses into the hosts file and they work fine. But the trusted RFC does not set up properly and the BACK rfc from the satelite system does not get set up properly. What appears to happen is that when you try to start a remote session SAP goes to the satelite system and finds the Instance Name and the local IP address rather than the NAT'd IP address and try's to open a session from there. I found this by going into the trusted RFC in SM59 and then going to Extra's, System Information, Target System, this then tells me the Target System information, where it shows the System ID and IP address (which is the incorrect IP address).
Anyone know how we can get the system to try to have the correct IP adress in the target system information so that we can get Remote Logon's to work??
Cheers

Hi Carl,
Based on your explanation about Nating,, how will the RFC determine to connect to Solmans internal IP after it has been directed to the IP for the Router connection.
I feel it is like configuring a jump of RFCs from one IP to another in a single chain.
Can this be done ?? I mean we have to specify an IP in the RFC connection right.. so how will the automatic jumping of IPs be done.
Sorry not answering the question but its very interesting and wanted to know.
Also went trough note # 148832, might help.
Regards,
Kaustubh.
Edited by: Kaustubh Krishna on Aug 13, 2009 12:17 PM

Access another host on same subnet through Nat'd IP address

I appreciate any help in advance, I have a requirement to monitor a host's external IP address, the monitoring host (host A) initiating the request is located in the same DMZ subnet as the destination host (host B) I want to monitor, both are NAT'd to external IP addresses, I was expecting to see a request going out from host A, getting NAT'd to its respective external IP address and then coming back in through the external interface to reach the Nat'd IP address of host B. is this how NAT will be handled by the ASA or am I missing something here? thanks again.

Borman,
Its more complicated than that, consider the following scenario:
                            20.20.20.0/24
               ASA------------------------------Internet
                  | (DMZ)
             Switch
     Host A          Host B
   10.1.1.10      10.1.1.100
                      20.20.20.20 (Nat outside address)
Basically you want to monitor your host B using its public IP address, normally your NAT configuration (in case of version 8.2 and prior) would be something like this:
nat (DMZ,outside) 20.20.20.20 10.1.1.100
nat (DMZ) 1 0.0.0.0 0.0.0.0
global (outside) 1 interface
When going from Host A to host B, two translations should occur, first is the Unstranslate from 20.20.20.20 to 10.1.1.100 (By internal process of the ASA), then once it is unstranslated, the route-lookup comes in game. Firewall notices that is on the same interface as the source of the packet so we reach our first impass. The ASA does not support same security traffic by default. So we overcome this issue with the following command:
same-security-traffic permit intra-interface
Now that is done, so we move to the next packet process, the ASA tries to check if there is any NAT translation for a packet coming from the DMZ and going to the same DMZ. As you can see there is a "nat (DMZ) 1 0.0.0.0 0.0.0.0", that tells the firewall that everything coming from the DMZ should be translated, we hit that NAT and since the outgoing interface is the same as the source interface (DMZ) there is no global command, hence you will see an error that states, No translation group found. Here is how we overcome that issue
Global (DMZ) 1 interface
This will translate requests from the DMZ interface going to that same interface to the DMZ IP address, on the server 10.1.1.100, the connection will be seeing as it came from the firewall, the packets will be sent to the firewall again, hence avoiding asymmetric routing.
If running version 8.3 or higher, the concept is the same, but the commands change a bit.
8.3
same-security-traffic permit intra-interface
object network Server_Public
host 20.20.20.20
object network Server_Private
host 10.1.1.100
object network Any
subnet 0.0.0.0 0.0.0.0
Nat (DMZ,DMZ) source dynamic Any interface destination static Server_Public Server_Private
So bottom line, configuration needed on 8.2
global (outside) 1 interface
same-security-traffic permit intra-interface
Configuration for 8.3
same-security-traffic permit intra-interface
object network Server_Public
host 20.20.20.20
object network Server_Private
host 10.1.1.100
object network Any
subnet 0.0.0.0 0.0.0.0
Nat (DMZ,DMZ) source dynamic Any interface destination static Server_Public Server_Private
Hope this helps a bit.
Mike

Natting of Destination Address

Is is possble to nat the destination address. What I am trying to do it change DNS servers. I would like to have traffic going to the old address be natted but traffic going to the new address not be natted. Finally if the DNS devices generates traffic it would not be natted.

I understand it may be tricky, that is why I posted it. The DNS server is an internal server so from the router point of view I can make it either inside or outside. Currently it is connected directly to a 6509, but the thought is to put a 3640 between the DNS server and the 6509 and using static routes on the 6509 direct traffic for either address to the 3640 and then to the new server. My thought was to do nating on the 3640, but as I indicated I have not be able to get the router to change or nat the destination address and also not to nat traffic to the new address or new traffic coming from the DNS server.
If you are someone could give a specific config or point me to a cisco document that explains how to do this it would be great.

Site to Site VPN with Natting Internal IP address range?

This is our actual Internal LAN address: 10.40.120.0/26 (Internal Range) and I want to translate to
Translated address: 10.254.9.64.255.255.255.192(Internal)
Our remote local address is: 10.254.5.64 255.255.255.192(Remote site Internal Ip add range)
Based on above parameters I done this configuration
access-list outside_cryptomap permit ip 10.254.9.64 255.255.255.192 10.254.5.64 255.255.255.192
access-list policy-nat permit ip 10.40.120.0 255.255.255.192 10.254.5.64 255.255.255.192
static (inside,outside) 10.254.9.64 access-list policy-nat
I got all the Phase1 and Phase 2 parameters required and peer public ip add,
I had set up vpn using ASDM before but this scenario is new for me, all I am wondering is there anything I need to configure to succesfully setup VPN

Hi mate,
yeah issue on far site they arent allowing access to the port we are trying to access, and they made it up and we are good to g now,
One thing I am worried is only one IP add is able to access the resources, I mean i created an add range of 192.168.x.0/26, however only 192.168.x.3 one of our server is able to access the far site, havent got a clue
config is as folllows:
access-list pp-vpn extended permit ip 10.254.7.64 255.255.255.192 10.254.6.64 255.255.255.192
access-list policy-nat---- extended permit ip 192.168.x.0 255.255.255.192 10.254.6.64 255.255.255.192
static (inside,outside) 10.254.7.64 access-list policy-nat
crypto ipsec transform-set esp-aes256-sha esp-md5-hmac
crypto map outside_map 20 match address pp-vpn
crypto map outside_map 20 set peer 172.162.1.2
crypto map outside_map 20 set transform-set vpn1
crypto map outside_map interface outside
crypto isakmp identity address
crypto isakmp policy 65 encyptio
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
tunnel type ipsec-l2l
tunnel-group 172.162.1.2 ipsec-attributes
pre-shared-key *
Thank you immensly for all your assitance
ven

NAT ASA destination address

Hi
I am using a ASA 5540 running version 7.2(3) and would like to pass all http and https requests coming from the inside of the ASA to an external proxy server on the internet (All request need to pass to port 8080). I've tried using static commands but can only seem to NAT on the inside source address and not the destination address. Have also tried the same using dynamic NAT but again can only NAT on the source address.
Is there a way of NATing the destination address when coming from the inside of firewall?
Alternatively, if anyone can suggest another way of diverting http requests to a proxy server on the internet that would be appreciated.

It seems that when using the ACL in combination with the static translation statement (amounting to static policy NAT), the number of "real" addresses to be translated (as specified in the ACL) needs to equal to the number of addresses used for translation (which is only 1 address).
For example, my Cisco ASA 5505 took gave no errors when I entered the following:
Static Policy Nat - Accepted by ASA w/ no errors - (1 to 1 mapping of 1 real address to 1 mapped address)
access-list staticPOLICYnat line 1 extended permit ip host 172.16.0.2 host 74.125.45.105
static (inside,outside) 192.168.1.253 access-list staticPOLICYnat
The above policy static nat translates the real source address of 172.16.0.2 to 192.168.1.253 when 172.16.0.2 attempts connections to 74.125.45.105
Notice that there is a 1 to 1 mapping of the "real" address of 172.16.0.2 to the mapped address of 192.168.1.253.
However, in the past I also wondered if I could translate more than one real addresses and map them to one global address using the ACL and static nat combo (which amounts to static policy nat). But I have not been able to get that to work. For example, entering the following provided me with the "global address overlaps with mask" error.
Static Policy Nat - Rejected By ASA w/ error of "global address overlaps with mask" - (many to 1 mapping of multiple real addresses to 1 mapped address)
access-list staticPOLICYnat line 1 extended permit ip any host 74.125.45.105
static (inside,outside) 192.168.1.253 access-list staticPOLICYnat
The above configuration was rejected by my ASA 5505 with an error of "global address overlaps with mask"
In my experience, it is, however, possible to map/translate more than one "real" IP addresses to one mapped/translated IP address using dynamic policy NAT. So for example, the following was accepted by my ASA with no errors.
Dynamic Policy Nat - Accepted by ASA w/ no errors - (many to 1 mapping of multiple real addresses to 1 mapped address)
access-list staticPOLICYnat line 1 extended permit tcp any host 74.125.45.105
nat (inside) 2 access-list staticPOLICYnat
global (outside) 2 192.168.1.253
If anyone knows how to translate or map multiple IP addresses to a single IP address using static policy NAT, please do share.
Best Regards,
David

NAT destination IP address

I have this toplogy:
A ------ ASA -------- B
A's real IP is 1.1.1.1
B's real IP is 2.2.2.2
B's mapped IP is 3.3.3.3
How do I NAT it so that when A tries to connect to 3.3.3.3, the destination is translated to 2.2.2.2. But at the same time, when B connects to A, it is using its real IP of 2.2.2.2 and is not NAT.
I have a problem where A is getting its DNS information from an external server which is resolving it to an external IP address.
Thank you in advanced!

I think I found the answer. The "unidirectional" keyword is what I needed.
nat (outside,inside) source static any any destination static MAPPED REAL unidirectional

Setting up static nat for ip addresses

We recently switched to a verizon fios line. Our company has two offices (CA, NC). There are servers in NC that we need to be able to print to printers in CA.
We have 5 static IP's from Verizon, I set 3 of the remaining IPs as a static nat to the private ips of the printers. I cannot ping these static public ips. I even have the port forwarding from UDP/TCP set to any for both the Source and Destination ports.
Can anyone help me as to why I cannot ping these IP addresses?
I can ping the private IP's from the private network (CA) that the printers are on.
Solved!
Go to Solution.

No, it does not. But they are working this morning. Maybe the DNS needed to propigate? Not sure but it works now.

Change Lync 2013 Edge Server Natted public ip addresses

we changed public ip addresses for Lync 2013 edge. I changed only a/v edge service NAT-Enabled public ipv4 address to the new public ip address .
published the topology
run
Invoke-CsManagementStoreReplication command
restarted edge server.
what else to do to solve it ?
Error:
The Microsoft Connectivity Analyzer is attempting to obtain the SSL certificate from remote server sip.*****.com on port 5061.
The Microsoft Connectivity Analyzer wasn't able to obtain the remote SSL certificate.
Additional Details
The certificate couldn't be validated because SSL negotiation wasn't successful. This could have occurred as a result of a network error or because of a problem with the certificate installation.

Hi,
Please re-run Step 2-Setup or Remove Lync Server Components after changing IP in topology.
Kent Huang
TechNet Community Support

Routes, NAT & Sec IP Address lost at reboot

Hi
I don't know if this is the correct forum but I have BM installed
I have a NW 6.5sp1 Bordermanager 3.8. Everytime I reboot the server I
loose the configuration of one of my entries on the static routing table.
The NAT is set up to dynamic and it is lost just sometimes. The secondary
ipaddress are commented on the autoexec.ncf (I dont want them anymore)and
they are configured after each reboot even if I comment them.
tcpcfg.nlm Version 6.50.24
inetcfg Version 6.50.19
Any HELP would be really appreciated
Best Regards
Mariandrea

> In article <U7Qhc.870$[email protected]>, wrote:
> > But I still don't know what to do with the problem of my route, it
keeps
> > disappearing every time I boot my server. All other route are OK is
just
> > one that I configure last week
> >
> Do you have rip or ospf enabled?
>
> Are you setting routes with TCPCON (which does not make permanent
changes)?
> Use INETCFG, Protocols, TCPIP, LAN Static Routing instead.
>
> Craig Johnson
> Novell Support Connection SysOp
> *** For a current patch list, tips, handy files and books on
> BorderManager, go to http://www.craigjconsulting.com ***
>
RIP is disabled
OSPF is disabled
I am alwasy using INETCFG to configure the routes and some of the routes
get saved but the one I configured lately don't stay
Thanks
Mariandrea

NAT address to fixed IP

Hello,
My company has just started using an application called AS2 to send data
securely to ASDA/Wal-Mart. This application relies on communication from
wal-marts 6 ipaddresses using any port greater than 1023. I have setup
filters to allow any traffic from these 6 ipaddresses to come in. However
the server application which runs on a PC (which has a fixed ip address)
doesn't seem to get the packets.
What I think the problem is, is, the traffic is hitting my public
interface but doesn't know where to go there after. What i think i need
is a route to say when you hit my public interface route through to the
fixed IP on my PC.
I am struggling a bit with this any help would be great.
Thanks

Firstly, thank you for your response.
I believe that 'they' initiate contact with us.
If I created a second IP add on my BM server, NAT'd the address to the IP
address of my PC, then created a filter to let all traffic through, it
should allow me to at least test that I am getting a connection!?!?
> [email protected] wrote:
>
> > What I think the problem is, is, the traffic is hitting my public
> > interface but doesn't know where to go there after. What i think i
need
> > is a route to say when you hit my public interface route through to
the
> > fixed IP on my PC.
> >
> > I am struggling a bit with this any help would be great.
>
> If the PC running the app is on the private side of BM, then you need to
>
> 1) add a secondary public IP address to the BM server
> 2) statically-NAT this new public IP to the private IP of the PC
running
> the app
>
> 3) create filter exceptions that allow the necessary traffic, calling
> out the *private* Ip address of the PC. You're a little ambiguous as to
> what ports are being used. the "any port above 1023" sounds like the
> standard ephemeral ports for *response* traffic. Surely there is a
> specific destination port involved? Question: does the PC initiate
> contact with the remote servers, or do *they* initiate contact with
your PC?
>
>
> --
> Jim
> NSC Sysop

Nat two identical services on interface Public Address

Hi all,
can i nat two internal address with same services on one public interface address?
I have an ASA 5515-X and i want to nat two services, tcp\80, on same ip public interface address:
object network Owa-Interno
host 10.0.1.4
object network Sito-Interno
host 10.0.1.8
nat (INSIDE,OUTSIDE) source static Owa-Interno interface service http http
nat (INSIDE,OUTSIDE) source static Sito-Interno interface service http http
object network INSIDE-LAN
nat (any,OUTSIDE) dynamic interface
Thanks in advance.
M

Hi Karsten,
thanks for reply, you confirmed that can not use.
Another question, with this configuration static nat and vpn should work correctly right:
interface GigabitEthernet0/1
nameif OUTSIDE
security-level 0
ip address 217.51.xxx.xxx 255.255.255.240
object network INSIDE-LAN
subnet 10.0.0.0 255.0.0.0
object network Owa-Interno
host 10.0.1.4
object network Sito-Interno
host 10.0.1.8
object network Rete_VpnAnyconnect
subnet 172.16.1.0 255.255.255.0
nat (INSIDE,OUTSIDE) source static Owa-Interno interface service https https
nat (INSIDE,OUTSIDE) source static Sito-Interno interface service http http
nat (INSIDE,OUTSIDE) source static INSIDE-LAN INSIDE-LAN destination static Rete_VpnAnyconnect Rete_VpnAnyconnect no-proxy-arp route-lookup
object network INSIDE-LAN
nat (any,OUTSIDE) dynamic interface
Thanks.
M

Ping Times to NAT Addresses

If I ping a NAT'ed IP address configured on an ASA 5505, is it handled at the firewall (as far as priority) as if I were pinging the firewall interface itself, or the end device? The reason I ask is I am seeing waves of ping latency that I can relate to data transfers, but the nothing is even close to being maxed out as far as CPU, memory, or bandwidth. My guess is this is being handled by the ASA in software instead of in hardware. Just looking for clarification.
Thanks,
Matt

If I ping a NAT'ed IP address configured on an ASA 5505, is it handled at the firewall (as far as priority) as if I were pinging the firewall interface itself, or the end device? The reason I ask is I am seeing waves of ping latency that I can relate to data transfers, but the nothing is even close to being maxed out as far as CPU, memory, or bandwidth. My guess is this is being handled by the ASA in software instead of in hardware. Just looking for clarification.
Thanks,
Matt

Question regarding NAT and directed-mode

Hello,
I have two WAE 574 devices and a CM 274 all running code level 4.3.1.6, The CM is behind a PIX firewall. There is no firewall between the branch and core WAE. The branch device is behind a NAT router. The CM and SSL ASA rea behind a PIX 515 firewall. The branch WAE is running inline mode and the core WAE is using WCCP redirection. Both the CM and SSL ASA are reverse NATted on the PIX firewall. The branch WAE has the primary interface unchecked on the CM and is using the NAT address.
I am getting asymmetric route issues. This is because for some reason the NAT address of the branch WAE sends the SYN which is responded to but the ACK is coming from the unnatted private address. When I turn off directed mode I can see optimisation start for some sessions but not for the SSL
ASA.
Example
Branch WAE Private 192.68.1.45
Branch WAE Public 206.99.88.10
CM private 192.168.20.9
CM public 240.10.10.20
PIX log
an 15 2012 11:50:58: %PIX-6-106015: Deny TCP (no connection) from 192.68.1.45/46871 to 240.10.10.20/443 flags PSH ACK on interfe
Although the PIX NATs the CM address, the core WAE is still still seeing it's private address.
Do you have any idea what could be causing this ?
Best regards
Stephen
Jan 15 2012 11:51:12: %PIX-5-106100: access-list DMZ_access_in denied tcp DMZ/192.168.20.9(443) -> outside/206.99.88.10(46871) hit-cnt 1 f]
Jan 15 2012 11:51:31: %PIX-6-106015: Deny TCP (no connection) from 192.68.1.45/46871 to 240.10.10.20/443 flags PSH ACK on interfe
Jan 15 2012 11:51:37: %PIX-6-106015: Deny TCP (no connection) from 192.68.1.45/46847 to 240.10.10.20/443 flags PSH ACK on interfe
Jan 15 2012 11:52:08: %PIX-6-106015: Deny TCP (no connection) from 192.68.1.45/49634 to 240.10.10.20/443 flags PSH ACK on interfe
Jan 15 2012 11:52:10: %PIX-5-106100: access-list outside_access_in permitted tcp outside/206.99.88.10(23183) -> DMZ/240.10.10.20(443) ]
Jan 15 2012 11:52:10: %PIX-6-302013: Built inbound TCP connection 1475554768 for outside:206.99.88.10/23183 (206.99.88.10/23183) to DMZ:WAD)
Jan 15 2012 11:52:10: %PIX-6-106015: Deny TCP (no connection) from 192.68.1.45/23183 to 240.10.10.20/443 flags ACK on interface e

Hi Stephen,
To troubleshoot this further, we would need to get a topology diagram of your network, as well as the configurations from all devices, so it would probably be better if you open a TAC service request.
Regards
Daniel

IpSec VPN and NAT don't work togheter on HP MSR 20 20

Hi People,
I'm getting several issues, let me explain:
I have a Router HP MSR with 2 ethernet interfaces, Eth 0/0 - WAN (186.177.159.98) and Eth 0/1 LAN (192.168.100.0 /24). I have configured a VPN site to site thru the internet, and it works really well. The other site has the subnet 10.10.10.0 and i can reache the network thru the VPN Ipsec. The issue is that the network 192.168.100.0 /24 needs to reach internet with the same public address, so I have set a basic NT configuration, when I put the nat configuration into Eth 0/0 all network 192.168.100.0 can go to internet, but the VPN goes down, when I remove the NAT from Eth 0/0 the VPN goes Up, but the network 192.168.100.0 Can't go to internet.
I'm missing something but i don't know what it is !!!!, See below the configuration.
Can anyone help me qith that, I need to send te traffic with target 10.10.10.0 thru the VPN, and all other traffic to internet, Basically I need that NAT and VPN work fine at same time.
Note: I just have only One public Ip address.
version 5.20, Release 2207P41, Standard
sysname HP
nat address-group 1 186.177.159.93 186.177.159.93
domain default enable system
dns proxy enable
telnet server enable
dar p2p signature-file cfa0:/p2p_default.mtd
port-security enable
acl number 2001
rule 0 permit source 192.168.100.0 0.0.0.255
rule 5 deny
acl number 3000
rule 0 permit ip source 192.168.100.0 0.0.0.255 destination 10.10.10.0 0.0.0.255
vlan 1
domain system
access-limit disable
state active
idle-cut disable
self-service-url disable
ike proposal 1
encryption-algorithm 3des-cbc
dh group2
ike proposal 10
encryption-algorithm 3des-cbc
dh group2
ike peer vpn-test
proposal 1
pre-shared-key cipher wrWR2LZofLx6g26QyYjqBQ==
remote-address <Public Ip from VPN Peer>
local-address 186.177.159.93
nat traversal
ipsec proposal vpn-test
esp authentication-algorithm sha1
esp encryption-algorithm 3des
ipsec policy vpntest 30 isakmp
connection-name vpntest.30
security acl 3000
pfs dh-group2
ike-peer vpn-test
proposal vpn-test
dhcp server ip-pool vlan1 extended
network mask 255.255.255.0
user-group system
group-attribute allow-guest
local-user admin
password cipher .]@USE=B,53Q=^Q`MAF4<1!!
authorization-attribute level 3
service-type telnet
service-type web
cwmp
undo cwmp enable
interface Aux0
async mode flow
link-protocol ppp
interface Cellular0/0
async mode protocol
link-protocol ppp
interface Ethernet0/0
port link-mode route
nat outbound 2001 address-group 1
nat server 1 protocol tcp global current-interface 3389 inside 192.168.100.20 3389
ip address dhcp-alloc
ipsec policy vpntest
interface Ethernet0/1
port link-mode route
ip address 192.168.100.1 255.255.255.0
interface NULL0
interface Vlan-interface1
undo dhcp select server global-pool
dhcp server apply ip-pool vlan1

ewaller wrote:
What is under the switches tab?
Oh -- By the way, that picture is over the size limit defined in the forum rules in tems of pixels, but the file size is okay. I'll let it slide. Watch the bumping as well.
If you want to post the switches tab, upload it to someplace like http://img3.imageshack.us/, copy the thumbnail (which has the link to the original) back here, and you are golden.
I had a bear of a time getting the microphone working on my HP DV4, but it does work. I'll look at the set up when I get home tonight [USA-PDT].
Sorry for the picture and the "bumping"... I have asked in irc in arch and alsa channels and no luck yet... one guy from alsa said I had to wait for the alsa-driver-1.0.24 package (currently I have alsa-driver-1.0.23) but it is weird because the microphone worked some months ago...
So here is what it is under the switches tab

NAT'd IP Address

Similar Messages

Maybe you are looking for