CCIE.pl

[nell]

Witam serdecznie, miałbym takie pytanie do kolegów ekspertów.
Otórz konfigurowałem sobie w labie na Cat 6500 nata,

wiadomo....

Code:

int g1/1 ip add ..... ip nat inside int g1/2 ip add .... ip nat outside access list 1 permit ..... ip nat pool...... ip nat inside source .....

i jeśli port przełącznika nie jest switchportem to translacja działa - jest super, ale jeśli robię port g1/2 jako swichport jego adres ip interfejsu konfiguruję jako vlan2 i potem przypinam do portu g1/2 nie działa NAT, może chodzi o CEFa ?

Code:

int g1/1 switchport switchport mode access switchport access vlan3 int g1/2 switchport switchport mode access switchport access vlan2 int vlan 2 ip add .... ip nat outside int vlan 3 ip add .... ip nat inside access list 1 permit ..... ip nat pool...... ip nat inside source .....

Pomóżcie proszę, z góry dziękuję.

[okoo]

a stworzyles vlan2 i vlan3 ?

[nell]

Jasne, vlany działają jak trzeba, routing statyczny pomiędzy nimi także.

[unikat74]

Dołącze się do pytania bo to bardzo ciekawy przypadek jest cat 6500 WS-X6K-SUP2-2GE i teraz

Code:

#show cef idb Vlan2                               111    111 - * Vlan2                             113    113 NAT Vlan10                              102    102 - * Vlan10                            104    104 NAT

w samym configu

Code:

! interface Vlan2  description Vlan ZEW  ip address x.x.90.1 255.255.255.128  ip nat outside ! interface Vlan10  description Vlan WEW  ip address 192.168.18.1 255.255.255.0  ip nat inside !

do vlan10 należe grupa portów od 1 - 24 wszystkie tak samo przypisane
przykład

Code:

interface FastEthernet4/24  switchport  switchport access vlan 10  switchport mode access  no ip address !

do vlan2 nazley jeden port

Code:

! interface GigabitEthernet5/13  switchport  switchport access vlan 2  switchport mode access  no ip address !

sam nat

Code:

no ip nat service skinny tcp port 2000 no ip nat service H225 ip nat inside source list 100 interface Vlan2 overload access-list 100 permit ip 192.168.18.0 0.0.0.255 any

vlan 2 i 10 działa normalnie przez 2 lata cała podsieć 90.0/25
dodam że dodatkowo działa bgp i osfp na tym urządzeniu
ospf nie rozgłasza mi 192.168.18.0/24 do sieci bgp jest pełna tablica.

Przerobiłem x przykładów na nat żaden nie działał, przyłaczam się do przypadku kolegi nell może moja konfiguracja rzuci jakieś światło na błąd jaki jest popełniany bo też nie potrafię tego rozgryść.

sprzęt
Cat6k MSFC 2
Policy Feature Card 2
ios 12.2

EDIT: Do listingow konfiguracji, show, debug, etc uzywamy znacznikow [code]
Seba

[lbromirs]

[unikat74]

Code:

#show ip nat statistics Total active translations: 0 (0 static, 0 dynamic; 0 extended) Outside interfaces:   GigabitEthernet5/13 Inside interfaces:   FastEthernet4/1 Hits: 59  Misses: 1 Expired translations: 1 Dynamic mappings: -- Inside Source [Id: 6] access-list 100 pool ostrog refcount 0  pool ostrog: netmask 255.255.255.0         start xx.xx.x.6 end xx.xx.xx.6         type generic, total addresses 1, allocated 0 (0%), misses 0

Obecnie już zamieniłem vlany na fizyczne interfejsy i nadal nic jeżeli chodzi o

Code:

sh platform hardware capacity netflow

To jest czysto sam aspekt nata nie wymaga akurat dużej wydajności potrzebuje to dla kilku kompów a poco stawiac osobno pc jak jest taka możliwość na cat.

[okoo]

[lbromirs]

[lbromirs]

[unikat74]

Wydaje mnie się ze nie ruch jest problemem tylko ilość połączeń jakie zostają otwierane przez klientów nata do sieci, powenie tym się zabija maszyne nie ruchem.

[unikat74]

Code:

! upgrade fpd auto version 12.2 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime service timestamps log datetime msec localtime service password-encryption service counters max age 5 ! hostname router-c6509 ! boot system flash disk0:s222-advipservicesk9_wan-mz.122-18.SXF13.bin logging snmp-authfail no logging console enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxx ! username xxxxxxxxxxxx password 7 xxxxxxxxxxxxxxxxxx no aaa new-model ip subnet-zero no ip source-route ! ! ip dhcp excluded-address 192.168.18.1 ! ip dhcp pool nat network 192.168.18.0 255.255.255.0 dns-server 208.67.222.222 default-router 192.168.18.1 ! no ip bootp server ip tcp selective-ack ip tcp timestamp ip tcp path-mtu-discovery no ip domain-lookup ip dhcp-server 192.168.18.1 mls flow ip destination mls flow ipx destination no mls acl tcam share-global ! ! ! ! ! ! ! ! redundancy mode rpr-plus main-cpu auto-sync running-config auto-sync standard spanning-tree mode pvst diagnostic cns publish cisco.cns.device.diag_results diagnostic cns subscribe cisco.cns.device.diag_commands ! vlan internal allocation policy ascending ! ! ! ! interface Loopback0 name Techniczny-dla-ospf ip address xxx.x.x 255.255.255.0 ! interface GigabitEthernet1/1 no ip address shutdown ! interface GigabitEthernet1/2 no ip address shutdown ! interface FastEthernet4/1 ip address 192.168.18.1 255.255.255.0 ip nat inside ! interface FastEthernet4/2 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/3 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/4 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/5 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/6 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/7 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/8 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/9 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/10 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/11 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/12 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/13 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/14 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/15 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/16 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/17 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/18 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/19 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/20 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/21 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/22 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/23 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/24 switchport switchport access vlan 10 switchport mode access no ip address ! interface FastEthernet4/25 switchport switchport access vlan 11 switchport mode access no ip address ! interface FastEthernet4/26 no ip address shutdown ! interface FastEthernet4/27 no ip address shutdown ! interface FastEthernet4/28 no ip address shutdown ! interface FastEthernet4/29 no ip address shutdown ! interface FastEthernet4/30 no ip address shutdown ! interface FastEthernet4/31 no ip address shutdown ! interface FastEthernet4/32 no ip address shutdown ! interface FastEthernet4/33 no ip address shutdown ! interface FastEthernet4/34 no ip address shutdown ! interface FastEthernet4/35 no ip address shutdown ! interface FastEthernet4/36 no ip address shutdown ! interface FastEthernet4/37 no ip address power inline never ! interface FastEthernet4/38 no ip address shutdown ! interface FastEthernet4/39 no ip address shutdown ! interface FastEthernet4/40 no ip address shutdown ! interface FastEthernet4/41 no ip address shutdown ! interface FastEthernet4/42 no ip address shutdown ! interface FastEthernet4/43 no ip address shutdown ! interface FastEthernet4/44 no ip address shutdown ! interface FastEthernet4/45 no ip address power inline never ! interface FastEthernet4/46 no ip address ! interface FastEthernet4/47 no ip address power inline never ! interface FastEthernet4/48 description Trunk-do-Z switchport switchport trunk encapsulation dot1q switchport trunk native vlan 8 switchport trunk allowed vlan 8,344,345 switchport mode trunk no ip address power inline never ! interface GigabitEthernet5/1 switchport switchport trunk encapsulation dot1q switchport trunk allowed vlan 1,107-109 switchport mode trunk no ip address ! interface GigabitEthernet5/2 description straz ip address 172.16.10.97 255.255.255.224 ip ospf message-digest-key 1 md5 7 050757012A19575C ip ospf network broadcast ! interface GigabitEthernet5/3 description metro-siedliska switchport switchport trunk encapsulation dot1q switchport trunk allowed vlan 811 switchport mode trunk no ip address ! interface GigabitEthernet5/4 ip address 172.16.10.1 255.255.255.224 ip ospf message-digest-key 1 md5 7 1309461C00591D7F ip ospf network broadcast ! interface GigabitEthernet5/5 ip address 172.16.10.33 255.255.255.224 ip ospf message-digest-key 1 md5 7 07037042455C0050 ip ospf network broadcast ! interface GigabitEthernet5/6 no ip address shutdown ! interface GigabitEthernet5/7 no ip address shutdown ! interface GigabitEthernet5/8 no ip address shutdown ! interface GigabitEthernet5/9 no ip address shutdown ! interface GigabitEthernet5/10 no ip address ! interface GigabitEthernet5/11 no ip address shutdown ! interface GigabitEthernet5/12 no ip address ! interface GigabitEthernet5/13 ip address xx.xx.xx.1 255.255.255.128 ip nat outside ! interface GigabitEthernet5/14 description Kierunek-X switchport switchport trunk encapsulation dot1q switchport trunk allowed vlan 8,33,103,112,344,345,731 switchport mode trunk no ip address ! interface GigabitEthernet5/15 switchport no ip address ! interface GigabitEthernet5/16 description BGP do firmy A ip address xx.xx.xx.6 255.255.255.252 ! interface Vlan1 no ip address ! interface Vlan8 no ip address ! interface Vlan33 description BGP do firmy Y ip address xx.xx.xx.76 255.255.255.0 ! interface Vlan103 ip address 10.18.24.9 255.255.255.252 ! interface Vlan107 ip address x.xx.xx.81 255.255.255.248 traffic-shape rate 2000000 225000 225000 1000 ! interface Vlan108 ip address xx.xx.xx.89 255.255.255.248 ! interface Vlan112 description BGP do firmy X ip address xx.xx.xx.17 255.255.255.252 ! interface Vlan731 ip address xx.xx.xx.2 255.255.255.252 ! interface Vlan811 ip address 172.16.10.65 255.255.255.224 ip ospf message-digest-key 1 md5 7 104258170E420B5E ip ospf network broadcast ! router ospf 100 router-id xx.xx.xx.254 log-adjacency-changes area 0 authentication message-digest network xx.xx.0.0 0.0.255.255 area 0 network 172.16.10.0 0.0.0.255 area 0 network 172.16.0.0 0.0.255.255 area 0 default-information originate always ! router bgp 3xxx3 no synchronization bgp router-id xx.xx.xx.1 bgp cluster-id 1310677231 bgp log-neighbor-changes network xx.xx.xx.0 mask 255.255.248.0 neighbor xxx.xx.xx.18 remote-as 1xxx0 neighbor xx.xx.xx.18 filter-list 10 out neighbor xx.xx.xx.5 remote-as 1xxx1 neighbor xx.xx.xx.5 filter-list 10 out no auto-summary ! no ip nat service skinny tcp port 2000 no ip nat service H225 ip nat pool natek xx.xx.90.1 xx.xx.90.1 netmask 255.255.255.128 ip nat inside source list 100 pool natek overload ip classless ip route 0.0.0.0 0.0.0.0 xx.xx.xx.5 ip route xx.xx.xx.0 255.255.248.0 xx.xx.xx.5 ip route xx.xx.xx.128 255.255.255.128 10.18.24.10 ! ip as-path access-list 10 permit ^$ no ip http server ! access-list 100 permit ip 192.168.18.0 0.0.0.255 any no cdp run ! snmp-server community xxxxxxxxxxxxxxxxx ! ! dial-peer cor custom ! ! ! ! line con 0 line vty 0 4 password 7 xxxxxxxxxxxxxxxxx login local transport input telnet ssh line vty 5 15 login transport input telnet ssh ! ntp clock-period 17179888 ntp server 217.153.69.35 ntp server 150.254.183.15 no cns aaa enable end

sh mod

Code:

#sh mod Mod Ports Card Type                              Model              Serial No. --- ----- -------------------------------------- ------------------ -----------   1    2  Catalyst 6000 supervisor 2 (Active)    WS-X6K-SUP2-2GE    SALxxxxx99   4   48  48 port 10/100 mb RJ45                 WS-X6348-RJ-45     SADxxxxxWV   5   16  SFM-capable 16 port 1000mb GBIC        WS-X6516-GBIC      SALxxxxxF2E Mod MAC addresses                       Hw    Fw           Sw           Status --- ---------------------------------- ------ ------------ ------------ -------   1  0006.d65f.7714 to 0006.d65f.7715   5.1   7.1(1)       12.2(18)SXF1 Ok   4  0004.28a0.3b70 to 0004.28a0.3b9f   1.5   5.4(2)       8.5(0.46)RFW Ok   5  0009.11e2.5588 to 0009.11e2.5597   5.0   6.3(1)       8.5(0.46)RFW Ok Mod  Sub-Module                  Model              Serial       Hw     Status ---- --------------------------- ------------------ ----------- ------- -------   1  Policy Feature Card 2       WS-F6K-PFC2        SALxxxxGYK  3.5    Ok   1  Cat6k MSFC 2 daughterboard  WS-F6K-MSFC2       SALxxxxKBZ  2.8    Ok   4  Inline Power Module         WS-F6K-PWR                      1.0    Ok Mod  Online Diag Status ---- -------------------   1  Pass   4  Pass   5  Pass

Jeżeli chodzi o iosy to było przjeście z catosa na ios na 12.1 i teraz jest 12.2 na 12.1 też nie latało na catosie niewiem nie sprawdzałem.

[unikat74]

A jeszcze dopisz że wykonałem test na drugim cat6500 na ios który miałem wcześniej 12.1 z tym że tam nie mam bgp ani ospf dwa ip wew i zew brama do netu i nat działa, oczywiście przenoszę konfig z nata i tutaj nie działa, mam zamiar jeszcze poświęcić nockę i wywalić wszystko z konfiga uruchomić nata i odpalać pokolei ospfa i bgp i szukać co powoduje że przetsaje działać a może to faktycznie jakiś bug.

[unikat74]

OK. problem rozwiązany powód ip nat out musi być na interfejsach które obsługują bezpośrednio bgp niewiem dalczego ale tak jest no i oprócz tego mam out na tych co posiadają IP z mojej klasy zew żeby wychodzić z własnymi IP. I teraz działa.