Cisco Router - NAT in and out on the same interface

Question

Here's the situation:

I have a couple of clients connected to a switch and the switch is connected to a Cisco 2621.

The clients all have IP addresses in the range 192.168.1.0/24 and the router address is 192.168.1.254.

So, host A has the address 192.168.1.1 and host B has the address 192.168.1.2.

I would like to be able to get to each host using another address (172.16.1.1 for 192.168.1.1 for example).

So I need to be able to NAT this on the router. I have played about and used a loopback interface and assigned an address and used ip nat outside on there, though I couldn't really get it working.

Any ideas on how to do this would be great.

Thanks

Solution

This configuration is called 'NAT on a stick', as the router will forward to the same end of the stick.

Cisco has a good design technote here which explain how to use it with indeed a loopback, but also with route-maps. This could help you.

Here is the configuration they're using. With only a little ajustments you should be able to use it with your setup:

interface Loopback0   
 ip address 10.0.1.1 255.255.255.252
 ip nat outside

interface Ethernet0
 ip address 192.168.1.2 255.255.255.0 secondary
 ip address 10.0.0.2 255.255.255.0
 ip nat inside
 ip policy route-map Nat-loop

ip nat pool external 192.168.2.2 192.168.2.3 prefix-length 29
ip nat inside source list 10 pool external overload
ip nat inside source static 10.0.0.12 192.168.2.1


ip classless

ip route 0.0.0.0 0.0.0.0 192.168.1.1
ip route 192.168.2.0 255.255.255.0 Ethernet0

access-list 10 permit 10.0.0.0 0.0.0.255 

access-list 102 permit ip any 192.168.2.0 0.0.0.255
access-list 102 permit ip 10.0.0.0 0.0.0.255 any
access-list 177 permit icmp any any

route-map Nat-loop permit 10
 match ip address 102
 set ip next-hop 10.0.1.2

Comments

[fdf33]

Thanks. I'd seen that before and gave it a go and couldn't get it working at all. Would it essentially let me ping say 172.16.1.1 and this be translated to 192.168.1.1?

[petrus]

well, you have to adapt it to your configuration, but yes, this would allow it.

[fdf33]

Just adapted that config and tried it on my router. Basically, the pings now work, but the router shows nothing when debugging NAT and the host isn't showing that it's getting the actual pings either when using tcpdump. So it's like it's pinging just the router itself.