Only Nat specific traffic

[CPaul123]

I am currently NATing all outbound traffic behind my Multilink123 interface. However when I try to access an internal device the addresses are still being NATed. How can I create an ACL not to NAT my internal traffic?

Here is a copy of my config:
ip nat inside source list 98 interface Multilink123 overload
ip nat inside source static udp 192.168.1.10 161 interface Multilink123 10161

access-list 98 permit 192.168.1.0 0.0.0.255
access-list 98 permit 10.41.4.0 0.0.0.255
access-list 98 remark NAT ACL for IP Phones

Any help would be greatly appreciated.

 

[burtsbees]

First, ditch the acl and recreate an extended acl. Then permit the NAT addresses and simply deny the no-nat addresses...

NAT=192.168.1.0/25
NO-NAT=192.168.1.128/25

access-list 101 deny ip any 192.168.1.128 0.0.0.128
access-list 101 permit ip 192.168.1.0 0.0.0.255

ip nat inside source list 101 int multilink123 over

OR

you can make a route map...

route-map nonat permit 1
match address 101

and the NAT statement...

ip nat inside source route-map nonat int multilink123 over

Either way it works. I use the route map myself to deny nat to vpn addresses and permit the rest of the subnet since in my setup, the vpn pool exists in the LAN subnet. Easier this way in a router.

Burt

 

[burtsbees]

Sorry---the first statement needs to be

access-list 101 deny ip any 192.168.1.128 0.0.0.127

the wildcard mask was wrong...

Burt

 

[burtsbees]

CRAP! So is the second one!

0.0.0.127 instead of 0.0.0.255, but since the deny comes first, the second will only permit .1-.126 anyway...

Burt

 

[CPaul123]

These NATs are for our VOIP phones. 10.41.4.5 is one of the phones. This phone needs to be NATd in order for it to work however in order to connect to our NTP server it needs to keep its original address.

 

[unclerico]

CPaul, what model is your router?? What modules are installed in it?? Can you post your entire scrubbed config?? Are you using hosted VoIP services??

Burt, you kind of remind me of Tommy Boy lol...don't ask me why, but you do...of course it's a compliment

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[burtsbees]

Oh man---we're stoned..."

"Ro-o-o-w-a-a-a-d-s-s-s"

Burt

 

[CPaul123]

We are using a 2851 and using a VzB VOIP solution. In our other 8 centers we have a firewall performing the NAT but this was the first center to go live so we did the NAT on the router.