Intermittant inside nat weirdness

[overmodulation]

I have a Cisco 1811 that I have set up inside address translations to point traffic coming from the outside to specific app servers inside my network.

The one that points to my SQL Server (1433) is open to the world, I know. It needs to come from one specific IP but I haven't figured out how to make that work yet.

The other problem that I'm having is that this MSSQL connection works great for days at a time and then stops working for some reason all of a sudden.

The other app server port forwards are listening for traffic from all over the place and they work fine consistently.

My old cheaper router, on which I just used the "port forwarding" functionality, worked fine all the time. The new Cisco is the only change to the setup.

Here's my NAT config. Let me know if you see something...

ip nat inside source list 1 interface FastEthernet0 overload
ip nat inside source static tcp 192.168.1.8 65531 interface FastEthernet0 65531
ip nat inside source static tcp 192.168.1.8 119 interface FastEthernet0 119
ip nat inside source static tcp 192.168.1.8 80 interface FastEthernet0 80
ip nat inside source static tcp 192.168.1.11 1433 interface FastEthernet0 1433

Thanks guys...

 

[makemorebeer]

Guess my first question would be do you have a single external IP, or a block of them, and why aren't you natting directly to the external Ip, instead of the Interface, which i'm guessing is configured with the external Ip address. The other questionw ould be the default routes from the servers to the router. seems to me that every time i've got a nat issue it's actually a routing issue.

 

[overmodulation]

It's a single IP address. FastEthernet0 is an ADSL ...

The router LAN is 192.168.1.x and the servers are all 192.168.1.x...

 

[eliotB]

For your SQL and allowing only 1 external IP..you should be able to do:

access-list 101 permit tcp host 1.2.3.4 any eq 1433
access-list 101 deny tcp any any eq 1433
access-list 101 permit ip any any


int x/x
ip nat outside
ip access-group 101 in

apply it inbound on your ip nat outside interface.
host 1.2.3.4 is the external host communicating w/the SQL server.

 

[baddos]

Yes it could very well be just someone going crazy on your SQL server. Applying that ACL would help, do it asap.

 

[overmodulation]

I had that before. It's bad - way bad. They see that 1433 open and send billions of login req's using the sa account.

I didn't see that in this case with ethereal but I'm gonna have this ACL done REAL SOON regardless!