Ask a question
Search in Wireless Forums

Wireless Forum

Reply
Posted Nov 22, 2010
9:52:58 PM
Microcell behind a Cisco router running NAT

Hi,

 

I've got a pretty standard Cisco set up, just at home. I'm trying to set up a microcell and not having the best luck.

 

Currently my microcell picked up IP 192.168.0.18, so i built a few inbound NAT's and also permitted the traffic on my inbound ACL, but it's still not working. I have been searching on & off for days trying to find any documentation on how to get one of these to work from behind a cisco router but I've come up empty.

 

here's a snip of my config - I only have one internet IP (on my Fa4) interface:

 

ip nat inside source static udp 192.168.0.18 4500 interface FastEthernet4 4500
ip nat inside source static udp 192.168.0.18 123 interface FastEthernet4 123
ip nat inside source static udp 192.168.0.18 500 interface FastEthernet4 500
ip nat inside source static tcp 192.168.0.18 4500 interface FastEthernet4 4500 (the documentation lists UDP twice, but I figured this was worth a try)
ip nat inside source static esp 192.168.0.18 interface FastEthernet4
ip nat inside source static tcp 192.168.0.18 443 interface FastEthernet4 443

 

InboundACL -

permit udp 12.230.208.0 0.0.1.255 any eq ntp
permit udp 12.230.208.0 0.0.1.255 eq ntp any
permit udp 12.230.208.0 0.0.1.255 any eq isakmp
permit udp 12.230.208.0 0.0.1.255 eq isakmp any
permit udp 12.230.208.0 0.0.1.255 any eq non500-isakmp
permit udp 12.230.208.0 0.0.1.255 eq non500-isakmp any
permit tcp 12.230.208.0 0.0.1.255 any eq 4500
permit tcp 12.230.208.0 0.0.1.255 any eq 443
permit esp 12.230.208.0 0.0.1.255 any log-input
permit udp 12.230.208.0 0.0.1.255 any log-input
permit tcp 12.230.208.0 0.0.1.255 any log-input

permit ip 12.230.208.0 0.0.1.255 any log-input

deny   ip 12.230.208.0 0.0.1.255 any log-input

 

I know the microcell works since I swapped my cisco with an old netgear router and things connected just fine. Not sure why this is so difficult. I tried shotgunning permits at this thing and still everything lights up and the connect bars blink green occasionally instead of sync'ing up.

 

Any idea's?


~Jason

Hi,

 

I've got a pretty standard Cisco set up, just at home. I'm trying to set up a microcell and not having the best luck.

 

Currently my microcell picked up IP 192.168.0.18, so i built a few inbound NAT's and also permitted the traffic on my inbound ACL, but it's still not working. I have been searching on & off for days trying to find any documentation on how to get one of these to work from behind a cisco router but I've come up empty.

 

here's a snip of my config - I only have one internet IP (on my Fa4) interface:

 

ip nat inside source static udp 192.168.0.18 4500 interface FastEthernet4 4500
ip nat inside source static udp 192.168.0.18 123 interface FastEthernet4 123
ip nat inside source static udp 192.168.0.18 500 interface FastEthernet4 500
ip nat inside source static tcp 192.168.0.18 4500 interface FastEthernet4 4500 (the documentation lists UDP twice, but I figured this was worth a try)
ip nat inside source static esp 192.168.0.18 interface FastEthernet4
ip nat inside source static tcp 192.168.0.18 443 interface FastEthernet4 443

 

InboundACL -

permit udp 12.230.208.0 0.0.1.255 any eq ntp
permit udp 12.230.208.0 0.0.1.255 eq ntp any
permit udp 12.230.208.0 0.0.1.255 any eq isakmp
permit udp 12.230.208.0 0.0.1.255 eq isakmp any
permit udp 12.230.208.0 0.0.1.255 any eq non500-isakmp
permit udp 12.230.208.0 0.0.1.255 eq non500-isakmp any
permit tcp 12.230.208.0 0.0.1.255 any eq 4500
permit tcp 12.230.208.0 0.0.1.255 any eq 443
permit esp 12.230.208.0 0.0.1.255 any log-input
permit udp 12.230.208.0 0.0.1.255 any log-input
permit tcp 12.230.208.0 0.0.1.255 any log-input

permit ip 12.230.208.0 0.0.1.255 any log-input

deny   ip 12.230.208.0 0.0.1.255 any log-input

 

I know the microcell works since I swapped my cisco with an old netgear router and things connected just fine. Not sure why this is so difficult. I tried shotgunning permits at this thing and still everything lights up and the connect bars blink green occasionally instead of sync'ing up.

 

Any idea's?


~Jason

Microcell behind a Cisco router running NAT

3,042 views
9 replies
(0) Me too
(0) Me too
Reply
View all replies
(9)
0
(0)
  • Rate this reply
View profile
Dec 2, 2010 3:15:11 PM
0
(0)
Tutor

Bump

 

Anyone??? Next step will have to be a sniffer on the inside & out to see if something is getting missed...



Bump

 

Anyone??? Next step will have to be a sniffer on the inside & out to see if something is getting missed...



Re: Microcell behind a Cisco router running NAT

2 of 10 (2,896 Views)
0
(0)
  • Rate this reply
View profile
Dec 3, 2010 9:12:00 AM
0
(0)
Tutor

I've got a Cisco 2621XM Running 12.4T that works with a Microcell behind it without any special NAT port forwarding done. Have you tried removing all the special forwarded ports you've got setup and just let it sit for a few hours and see if it'll register?

 

Once I get home I'll post my config for you to check out and compare to yours.

I've got a Cisco 2621XM Running 12.4T that works with a Microcell behind it without any special NAT port forwarding done. Have you tried removing all the special forwarded ports you've got setup and just let it sit for a few hours and see if it'll register?

 

Once I get home I'll post my config for you to check out and compare to yours.

Re: Microcell behind a Cisco router running NAT

3 of 10 (2,866 Views)
0
(0)
  • Rate this reply
View profile
Dec 3, 2010 10:18:01 AM
0
(0)
Tutor

I have tried it without the NAT stuff in there, but from what I had read, I had to put some of that in.  It seems to pick up and work fine when I take the Cisco out and use it with a little Linksys type router.

 

Thanks for the heads up though - good to know it's possible!

 

~Jason

I have tried it without the NAT stuff in there, but from what I had read, I had to put some of that in.  It seems to pick up and work fine when I take the Cisco out and use it with a little Linksys type router.

 

Thanks for the heads up though - good to know it's possible!

 

~Jason

Re: Microcell behind a Cisco router running NAT

4 of 10 (2,858 Views)
0
(0)
  • Rate this reply
View profile
Dec 5, 2010 2:49:14 PM
0
(0)
Tutor

 

Here is the configuration I use, the router is running version 12.4(25b)
No special access-lists are setup on the interface, so if your config still isn't working, and your using a recent IOS try removing all ACLs from your interfaces.
version 12.4
!
ip dhcp excluded-address 192.168.1.1 192.168.1.10
!
ip dhcp pool DHCP-LAN-IPv4
   network 192.168.1.0 255.255.255.0
   default-router 192.168.1.1 
   dns-server 8.8.8.8 8.8.4.4 
   lease 2
!
interface FastEthernet0/0
 ip address dhcp
 ip nat outside
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 duplex auto
 speed auto
!
ip nat inside source list NAT interface FastEthernet0/0 overload
!
ip access-list standard NAT
 permit 192.168.1.0 0.0.0.255
!
end

 

 

Here is the configuration I use, the router is running version 12.4(25b)
No special access-lists are setup on the interface, so if your config still isn't working, and your using a recent IOS try removing all ACLs from your interfaces.
version 12.4
!
ip dhcp excluded-address 192.168.1.1 192.168.1.10
!
ip dhcp pool DHCP-LAN-IPv4
   network 192.168.1.0 255.255.255.0
   default-router 192.168.1.1 
   dns-server 8.8.8.8 8.8.4.4 
   lease 2
!
interface FastEthernet0/0
 ip address dhcp
 ip nat outside
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 duplex auto
 speed auto
!
ip nat inside source list NAT interface FastEthernet0/0 overload
!
ip access-list standard NAT
 permit 192.168.1.0 0.0.0.255
!
end

 

Re: Microcell behind a Cisco router running NAT

5 of 10 (2,812 Views)
0
(0)
  • Rate this reply
View profile
Dec 6, 2010 12:28:42 PM
0
(0)
Tutor

So you don't have an outside ACL at all then? I'll give it a try without as that'll make it easier to sniff the traffic, but I'll have to apply an ACL before I can call this done.

 

Thanks!

~Jason

So you don't have an outside ACL at all then? I'll give it a try without as that'll make it easier to sniff the traffic, but I'll have to apply an ACL before I can call this done.

 

Thanks!

~Jason

Re: Microcell behind a Cisco router running NAT

6 of 10 (2,780 Views)
0
(0)
  • Rate this reply
View profile
Jan 7, 2011 8:04:46 AM
0
(0)
Contributor

Were you able to get this working with an ASA in front of the MicroCell?  I have the same problems as you do when using the ASA.

Were you able to get this working with an ASA in front of the MicroCell?  I have the same problems as you do when using the ASA.

Re: Microcell behind a Cisco router running NAT

7 of 10 (2,450 Views)
0
(0)
  • Rate this reply
View profile
Jan 7, 2011 8:11:46 AM
0
(0)
Tutor

I never was able to get it working. It was a loaner from someone at work and I had to get it back to them.  Not sure if I'll bother buying one for myself even though it would really help me at home.  I did a sniffer capture on the inside & out and couldn't figure out why it wasn't working.  The only other thing I was going to try, was doing a sniffer capture in & out when it was hooked through a Linksys that works, then compare the results.

 

I'd be happy to help decode if you can get some captures, but I don't have a microcell to keep testing.

 

~J

I never was able to get it working. It was a loaner from someone at work and I had to get it back to them.  Not sure if I'll bother buying one for myself even though it would really help me at home.  I did a sniffer capture on the inside & out and couldn't figure out why it wasn't working.  The only other thing I was going to try, was doing a sniffer capture in & out when it was hooked through a Linksys that works, then compare the results.

 

I'd be happy to help decode if you can get some captures, but I don't have a microcell to keep testing.

 

~J

Re: Microcell behind a Cisco router running NAT

8 of 10 (2,445 Views)
0
(0)
  • Rate this reply
View profile
Jan 25, 2011 6:25:04 PM
0
(0)
Scholar

May need to configure IPSec Passthrough

 

ip inspect name General-Fixups purpose isakmp

ip inspect name General-Fixups purpose ipsec-msft

 

Then on your outside interface

 

ip inspect General-Fixups in

ip inspect General-Fixups out

 

I'm flying from memory here, but maybe give that a try

May need to configure IPSec Passthrough

 

ip inspect name General-Fixups purpose isakmp

ip inspect name General-Fixups purpose ipsec-msft

 

Then on your outside interface

 

ip inspect General-Fixups in

ip inspect General-Fixups out

 

I'm flying from memory here, but maybe give that a try

Re: Microcell behind a Cisco router running NAT

9 of 10 (2,182 Views)
0
(0)
  • Rate this reply
View profile
Jun 20, 2011 1:01:04 PM
0
(0)
Contributor

I was able to get mine working.  Here is the relevant part of the configuration.

 

nat (inside,outside) dynamic interface

access-list Outside-In extended permit udp any any eq 500

access-list Outside-In extended permit udp any any eq 4500

access-list Outside-In extended permit esp any any.

 

The port for ESP must be open along with the other relevant ports.  NAT was not an issue.

I was able to get mine working.  Here is the relevant part of the configuration.

 

nat (inside,outside) dynamic interface

access-list Outside-In extended permit udp any any eq 500

access-list Outside-In extended permit udp any any eq 4500

access-list Outside-In extended permit esp any any.

 

The port for ESP must be open along with the other relevant ports.  NAT was not an issue.

Re: Microcell behind a Cisco router running NAT

10 of 10 (1,338 Views)
Advanced
You must be signed in to add attachments
Share this post
Share this post