nat overload into pat 1

[robintobin]

We have a cisco pix 515e, 4 public ip addresses and approx. 50 internal clients. I have configured the system to use pat when the 4 public addresses are used.

The problem is that this does not seem to work. When the 4 public addresses are used no more clients can connect. After using the clear xlate command 4 other clients can connect but still limited to only 4.

Here is a copy of the config in use.


nameif ethernet0 outside security0
nameif ethernet1 inside security100

hostname firewall
domain-name
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list ping permit icmp any any
access-list tcp permit tcp any any
pager lines 24
interface ethernet0 10baset
interface ethernet1 10baset
mtu outside 1500
mtu inside 1500
ip address outside 62.232.142.219 255.255.255.248
ip address inside 192.1.1.152 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.1.1.237 255.255.255.255 inside
pdm location 192.1.1.0 255.255.255.255 inside
pdm location 192.1.1.151 255.255.255.255 inside
pdm history enable
arp timeout 14400

global (outside) 1 62.232.142.220-62.232.142.223 netmask 255.255.255.248
global (outside) 1 62.232.142.224 netmask 255.255.255.248
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group tcp in interface outside
route outside 0.0.0.0 0.0.0.0 62.232.142.217 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
http server enable
http 192.1.1.151 255.255.255.255 inside
http 192.1.1.237 255.255.255.255 inside
http 192.1.1.0 255.255.255.255 inside
http 192.1.1.150 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet timeout 5
ssh timeout 5
terminal width 80

If anyone has any ideas please let me know. It will be much appreciated.

Cheers
Robin

 

[gbiello]

To allow internal access to the outside, you should have a single IP address like this:
global (outside) 1 62.232.142.224
That's all.
If you give a range, it will not to PAT, it will do one-to-one NAT across the IP's you specify. Once they're taken up, your done, just like you experienced.

-gbiello

 

[ccif1024]

http://www.cisco.com/warp/public/110/19.html

details on using PAT in addition to NAT on the same device.
I'm not sure if this fits your situation, but it may give you some ideas.

 

[mickeyzalewski]

If your block of space from your ISP is a /29 (255.255.255.248) then you only have 6 usable ip adresses.
.216 is the net block .217 - .223 are useable. .217 is being used on the router, .219 is being used on your PIX outside interface, .220 - 223 are being used as your NAT pool - .224 is not your space.
Actually according to Cisco press your config is correct as far as syntax and use of the commands - I think it is possible you have overstepped your assigned IP space.

If I am correct regarding the IP assignment - according to your configs you should be able to use .218 as your PAT address. And by using the same nat_id (1 - in your case) PAT should only come into effect when the NAT addresses have all been used.

 

[MauriceChen]

if subnet mask is 255.255.255.248 then
Subnet ID is 62.232.142.216
Subnet Broadcast is 62.232.142.223
so available IP should be
62.232.142.217 ~ 62.232.142.222
since router internal IP use 217
PIX outside IP use 219
NAT should be 220 ~ 222, only three
PAT can use 218
Am I right?

 

[gbiello]

Yes, that is correct.
Also .224 is not in the address block.