HELP!! Cisco 1721 Port opening problem

[Travstar]

Hi,
I am by far a cisco expert, and i apologise in advance for my crappy IOS config. Here is the situation:
I am configuring my 1721 with a WIC 1T (serial) connected to a PPP connection, then NATted out to the rest of the network through the Fast Ethernet Interface. Here is my config file:

Current configuration : 2225 bytes
!
version 12.3
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname TheRouter
!
no logging console
enable secret 5 xxxxxxxxxxxxxxxxx
enable password 7 xxxxxxxxxxxxxxxxxxxxxxx
!
ip subnet-zero
!
!
no ip domain lookup
!
!
!
!
!
interface FastEthernet0
description connected to EthernetLAN
ip address 192.168.8.3 255.255.255.0
ip nat inside
speed auto
full-duplex
!
interface Serial0
description connected to Internet
ip address 61.88.xxx.xxx 255.255.255.252
ip access-group 106 in
ip nat outside
encapsulation ppp
no fair-queue
!
router rip
version 2
passive-interface Serial0
network 192.168.8.0
no auto-summary
!
ip nat pool Cisco1721-natpool-0 61.88.172.106 61.88.xxx.xxx netmask 255.255.255.252
ip nat inside source list 1 pool Cisco1721-natpool-0 overload
ip nat inside source list 10 interface Serial0 overload
ip nat inside source static tcp 192.168.8.1 25 61.88.xxx.xxx 25 extendable
ip nat inside source static tcp 192.168.8.1 110 61.88.xxx.xxx 110 extendable
ip nat inside source static tcp 192.168.8.1 53 61.88.xxx.xxx 53 extendable
ip classless
ip route 0.0.0.0 0.0.0.0 61.88.xxx.xxx
no ip http server
!
access-list 1 permit 192.168.8.0 0.0.0.255
access-list 106 permit tcp any any eq ftp-data
access-list 106 permit tcp any any eq ftp
access-list 106 permit tcp any any eq telnet
access-list 106 permit ip any any
access-list 106 permit tcp any any eq smtp
access-list 106 permit icmp any any echo
access-list 106 permit icmp any any echo-reply
access-list 106 permit tcp any any eq www
access-list 106 permit tcp any any eq pop3
access-list 106 permit tcp any any eq domain
access-list 106 permit udp any any eq domain
access-list 106 permit udp any any eq nameserver
access-list 106 permit tcp any any eq 4899
access-list 106 permit tcp any any eq 6600
dialer-list 1 protocol ip permit
no cdp run
snmp-server community public RO
snmp-server location xxxxxxxxxxxxxxxxx
snmp-server contact xxxxxxxxxxxxxxxxxx
snmp-server enable traps tty
!
line con 0
exec-timeout 0 0
password 7 xxxxxxxxxxxxxxxxxxxxxxxx
login
line aux 0
line vty 0 4
password 7 xxxxxxxxxxxxxxxxxxxxxxxxxxx
login
!
no scheduler allocate
!
end

(4899 and 6600 are for a remote management software)

The problem is mainly two things:

One:
i am unable to type 'no ip nat pool Cisco1721-natpool-0' to get rid of that nat pool. apparently its "in use", I have tried getting rid of the references to nat on the interfaces (no ip nat inside, outside etc..), but still nothing. This doesnt REALLY worry me, having the line 'ip nat inside source list 10 interface Serial0 overload' doesnt affect it does it?

Two:

Although I have enabled all the different ports in access list 106, and applied it to s 0, a port scanning program (NetScanTool v5.1) detected only the Telnet port was open. I can telnet to it fine. Any reason for this? should i maybe use the port numbers instead of the key words? apparently 4899 and 6600 are still closed, so i dont know if that would work either. grrr

Thanks in Advance and i apologise again for being such a stupid newbie to cisco routers


-Trav

 

[routerman]

Have you tried removing the nat pool this way:


no ip nat inside source list 1 pool Cisco1721-natpool-0 overload
no ip nat pool Cisco1721-natpool-0 61.88.172.106 61.88.xxx.xxx netmask 255.255.255.252

Regarding the second question, I dont see a problem, surely you dont want to be able to see the open ports?

For testing only, remove the outside access list, test your connectivity then start to apply the list adding a couple of lines at a time.

In your ACL processing for IP (UDP and TCP) stops at line 4 as you have a match for any IP addresses.

Remember the following for ACL's

The list is processed top down, when the 1st match is found no more processing takes place.

There is an implicit deny at the end, if there is no match in the list the packet gets dropped.

In the extended list example above the first IP is the source, the second is the destination. Aslo not the direction the list works in, this is specified by the command that applies the list to the Interface. In your router thats under s0:
ip access-group 106 in

The mask is inverted, so a class c range is 0.0.0.255 which means match the first 3 octets, ignore the last.

You can use the keyword `log' after the ACL to output a message to the console port every time the line is hit, use for testing only, remove from production configuration.

Finally an individual address can be proceded by a host keyword.

Easy way to edit ACL's

Use notepad,

no access-list 106
access-list 106 permit tcp any any eq ftp-data

Paste in text to router, first line removes the list, then build the list up in the order you want.

 

[Travstar]

Thanks routerman. Your answer was informative and patient for a 'newbie' like me!

I will put the changes in now!

Thanks Again.

 

[rcasta]

I went through the same problem (nat statement "in use&quot. What has to be done is entering the "clear ip nat translations *". After doing so, your router will clear any still alive dynamic translations. Execute a "show ip nat translations". See if the cache is empty and you can then remove the nat statements.

hope it helps,