Microcell behind a Cisco router running NAT

Microcell behind a Cisco router running NAT

Hi,

 

I've got a pretty standard Cisco set up, just at home. I'm trying to set up a microcell and not having the best luck.

 

Currently my microcell picked up IP 192.168.0.18, so i built a few inbound NAT's and also permitted the traffic on my inbound ACL, but it's still not working. I have been searching on & off for days trying to find any documentation on how to get one of these to work from behind a cisco router but I've come up empty.

 

here's a snip of my config - I only have one internet IP (on my Fa4) interface:

 

ip nat inside source static udp 192.168.0.18 4500 interface FastEthernet4 4500
ip nat inside source static udp 192.168.0.18 123 interface FastEthernet4 123
ip nat inside source static udp 192.168.0.18 500 interface FastEthernet4 500
ip nat inside source static tcp 192.168.0.18 4500 interface FastEthernet4 4500 (the documentation lists UDP twice, but I figured this was worth a try)
ip nat inside source static esp 192.168.0.18 interface FastEthernet4
ip nat inside source static tcp 192.168.0.18 443 interface FastEthernet4 443

 

InboundACL -

permit udp 12.230.208.0 0.0.1.255 any eq ntp
permit udp 12.230.208.0 0.0.1.255 eq ntp any
permit udp 12.230.208.0 0.0.1.255 any eq isakmp
permit udp 12.230.208.0 0.0.1.255 eq isakmp any
permit udp 12.230.208.0 0.0.1.255 any eq non500-isakmp
permit udp 12.230.208.0 0.0.1.255 eq non500-isakmp any
permit tcp 12.230.208.0 0.0.1.255 any eq 4500
permit tcp 12.230.208.0 0.0.1.255 any eq 443
permit esp 12.230.208.0 0.0.1.255 any log-input
permit udp 12.230.208.0 0.0.1.255 any log-input
permit tcp 12.230.208.0 0.0.1.255 any log-input

permit ip 12.230.208.0 0.0.1.255 any log-input

deny   ip 12.230.208.0 0.0.1.255 any log-input

 

I know the microcell works since I swapped my cisco with an old netgear router and things connected just fine. Not sure why this is so difficult. I tried shotgunning permits at this thing and still everything lights up and the connect bars blink green occasionally instead of sync'ing up.

 

Any idea's?


~Jason

Message 1 of 10 (3,062 Views)

Re: Microcell behind a Cisco router running NAT

Bump

 

Anyone??? Next step will have to be a sniffer on the inside & out to see if something is getting missed...



Message 2 of 10 (2,916 Views)
Tutor

Re: Microcell behind a Cisco router running NAT

I've got a Cisco 2621XM Running 12.4T that works with a Microcell behind it without any special NAT port forwarding done. Have you tried removing all the special forwarded ports you've got setup and just let it sit for a few hours and see if it'll register?

 

Once I get home I'll post my config for you to check out and compare to yours.

Message 3 of 10 (2,886 Views)

Re: Microcell behind a Cisco router running NAT

I have tried it without the NAT stuff in there, but from what I had read, I had to put some of that in.  It seems to pick up and work fine when I take the Cisco out and use it with a little Linksys type router.

 

Thanks for the heads up though - good to know it's possible!

 

~Jason

Message 4 of 10 (2,878 Views)
Tutor

Re: Microcell behind a Cisco router running NAT

 

Here is the configuration I use, the router is running version 12.4(25b)
No special access-lists are setup on the interface, so if your config still isn't working, and your using a recent IOS try removing all ACLs from your interfaces.
version 12.4
!
ip dhcp excluded-address 192.168.1.1 192.168.1.10
!
ip dhcp pool DHCP-LAN-IPv4
   network 192.168.1.0 255.255.255.0
   default-router 192.168.1.1 
   dns-server 8.8.8.8 8.8.4.4 
   lease 2
!
interface FastEthernet0/0
 ip address dhcp
 ip nat outside
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 duplex auto
 speed auto
!
ip nat inside source list NAT interface FastEthernet0/0 overload
!
ip access-list standard NAT
 permit 192.168.1.0 0.0.0.255
!
end

 

Message 5 of 10 (2,832 Views)

Re: Microcell behind a Cisco router running NAT

So you don't have an outside ACL at all then? I'll give it a try without as that'll make it easier to sniff the traffic, but I'll have to apply an ACL before I can call this done.

 

Thanks!

~Jason

Message 6 of 10 (2,800 Views)
Contributor

Re: Microcell behind a Cisco router running NAT

Were you able to get this working with an ASA in front of the MicroCell?  I have the same problems as you do when using the ASA.

Message 7 of 10 (2,470 Views)

Re: Microcell behind a Cisco router running NAT

I never was able to get it working. It was a loaner from someone at work and I had to get it back to them.  Not sure if I'll bother buying one for myself even though it would really help me at home.  I did a sniffer capture on the inside & out and couldn't figure out why it wasn't working.  The only other thing I was going to try, was doing a sniffer capture in & out when it was hooked through a Linksys that works, then compare the results.

 

I'd be happy to help decode if you can get some captures, but I don't have a microcell to keep testing.

 

~J

Message 8 of 10 (2,465 Views)
Scholar

Re: Microcell behind a Cisco router running NAT

May need to configure IPSec Passthrough

 

ip inspect name General-Fixups purpose isakmp

ip inspect name General-Fixups purpose ipsec-msft

 

Then on your outside interface

 

ip inspect General-Fixups in

ip inspect General-Fixups out

 

I'm flying from memory here, but maybe give that a try

Message 9 of 10 (2,202 Views)
Highlighted
Contributor

Re: Microcell behind a Cisco router running NAT

I was able to get mine working.  Here is the relevant part of the configuration.

 

nat (inside,outside) dynamic interface

access-list Outside-In extended permit udp any any eq 500

access-list Outside-In extended permit udp any any eq 4500

access-list Outside-In extended permit esp any any.

 

The port for ESP must be open along with the other relevant ports.  NAT was not an issue.

Message 10 of 10 (1,358 Views)
Share this topic
Announcements

Welcome to the AT&T Community Forums!!! Stop by the Community How-To section for tips on how to get started.