NAT from a secondary subnet

Question

I have been testing a scenario and not having much success, so I would like
to know if this is even possible.
I have a real-world subnet with a 255.255.255.240 mask. I am natting
several addresses internally and it works perfectly.
I have run out of addresses and so I'm trying to add another subnet. I
added a secondary binding to an address on another subnet with a
255.255.255.248 mask. This works fine, but when I try to setup NAT for an
address on this subnet, it doesn't work.
I tried NAT'ing from both subnets to the same address and that didn't work.
I removed the NAT entry from the original subnet and just used the new one
and that didn't work either.
Can NAT only work from a Primary IP binding?
Keith

Answer 1

That will be because the core switch is relying on an arp table and it
then has to deal with 2 subnets... this can be a problem. I didn't
realise that you were using a big switch with VLANs so...
The solution of the second public NIC could work well though, as then
only hosted services use one NIC and the outbound stuff could use the
second :-)
Good luck
On Wed, 12 Oct 2005 12:22:15 GMT, "Keith Larson"
<[email protected]> wrote:
>i did exactly that and got some very bad results. i can't tell if the
>routing within the server got screwed up or it caused a serious ARP issue in
>the switch that the server was plugged into. I lost all of my outside
>services that were tied to the original subnet until i removed the binding
>on the new subnet.
>
>when i make this binding on the second subnet to a different physical nic,
>everything works perfectly.
>
>if i go back to a second binding on the same physical nic. everything on
>the inside and on the physical subnet can ping everything perfectly. the
>core switch that everything is plugged into can ping all addresses on the
>original subnet and the secondary address on the second subnet, but can't
>ping the actual binding for the second subnet. we worked backwards from
>that switch to the internet and found one more farther away could do exactly
>the same thing. ping the secondary on the second subnet, but not the actual
>binding address. beyond that router nobody could ping anything on the
>second subnet. so everything on this new subnet was unreachable from the
>internet.
>
>really bizarre....
>
Tim
Tim Heywood (SYSOP)
NDS8
Scotland
(God's Country)
www.nds8.co.uk
http://support.novell.com/forums/
In theory, practice and theory are the same
In Practice, they are different