Cisco 1600 - NAT & Port Forwarding?

[ElijahBaley]

Hi

Just wondered if the 1600 series were capable of Network Address Translation and Port Forwarding.

What I want to do is assign a public IP address to an interface and have an access list or whatever forward to an internal reserved IP address allowing connections on only the specified ports.

Thanks

EB

 

[jimmyzz]

EB,
The c1600 can do NAT if you are running IP Plus. There are several basic forms of NAT. Here is a quick overview.

1. Static NAT. - Maps internal (private) address to public (registered) address one-to-one.

2. Dynamic NAT. - Maps several internal addresses to a group of public addresses.

3. Overloading (PAT) - Maps several internal addresses to a single public address using different ports (PAT).

4. Overlapping - Used if your internal network has registered addresses which need to be mapped to other public addresses.

Decide which scenario (most likely 1 2 or 3) suits your network and we can post some sample configs for that particular form of NAT.

JimmyZ

 

[ElijahBaley]

Thanks JimmyZ,

I think that option 1 will suite but I like the sound of 3, I assume that after I have mapped the IP's then an extended access list will provide the security of only allowing connections from hosts to specific ports?

What is IP Plus?

Some example configs would be very helpful and interesting, thanks again for your help,

EB

 

[jimmyzz]

EB,

For static NAT:

1. Setup the NAT statement:
Router(config)>ip nat inside source static <private IP> <public IP>

2. Apply NAT to internal ethernet (private):
Router(config-if)ip nat inside

3. Apply NAT to external ISP interface (public):
Router(config-if)ip nat outside

4. Create access-list as appropriate eg.:
Router(config)>access-list 100 permit ip any host <NAT IP of server> eq <port>

5. Apply the access-list to the external interface.
Router(config-if)>ip access-group 100 in

If you do a show ip nat translation, it will show you your current NAT config.

JimmyZ

 

[jimmyzz]

EB,
In addition to the above post, IP Plus is the feature set of the IOS image on your router. The basic IOS is IP (only). IP Plus allows you to run addtional IOS features such as NAT, OSPF, BGP etc.. Likewise to run VPN or Firewall features, you need to acquire the IOS feature set for those functions (ie. IP Plus/FW/IDS/IPSEC56).

So you'll need to do a show version to check you current IOS version, and goto the cisco site to confirm the feature set for that IOS image using there IOS feature matrix util.

JimmyZ

 

[ElijahBaley]

Thanks



..EB (Plainclothesman)