This is a weird one, so I'll try to explain in as much detail as I can so I'm giving the whole picture.
As I've mentioned in my other questions, I'm in the process of setting up a new Cisco 881 as my WAN router and NAT firewall. I'm facing an issue where NAT NVI rules that I have configured are not enabled after a reload of the router, regardless of the fact that they are present in the startup-config.
In order to clarify this a little, here's the relevant section of my current running-config:
Router1#show running-config | include nat source
ip nat source list 1 interface FastEthernet4 overload
ip nat source list 2 interface FastEthernet4 overload
ip nat source static tcp 192.168.1.x 1723 interface FastEthernet4 1723
ip nat source static tcp 192.168.1.x 80 interface FastEthernet4 80
ip nat source static tcp 192.168.1.x 443 interface FastEthernet4 443
ip nat source static tcp 192.168.1.x 25 interface FastEthernet4 25
ip nat source static tcp 192.168.1.x 587 interface FastEthernet4 587
ip nat source static tcp 192.168.1.x 143 interface FastEthernet4 143
ip nat source static tcp 192.168.1.x 993 interface FastEthernet4 993
...and here's the mappings 'in action':
Router1#show ip nat nvi translations | include ---
tcp <WAN IP>:25 192.168.1.x:25 --- ---
tcp <WAN IP>:80 192.168.1.x:80 --- ---
tcp <WAN IP>:143 192.168.1.x:143 --- ---
tcp <WAN IP>:443 192.168.1.x:443 --- ---
tcp <WAN IP>:587 192.168.1.x:587 --- ---
tcp <WAN IP>:993 192.168.1.x:993 --- ---
tcp <WAN IP>:1723 192.168.1.x:1723 --- ---
...and here's proof that the mappings are saved to startup-config:
Router1#show startup-config | include nat source
ip nat source list 1 interface FastEthernet4 overload
ip nat source list 2 interface FastEthernet4 overload
ip nat source static tcp 192.168.1.x 1723 interface FastEthernet4 1723
ip nat source static tcp 192.168.1.x 80 interface FastEthernet4 80
ip nat source static tcp 192.168.1.x 443 interface FastEthernet4 443
ip nat source static tcp 192.168.1.x 25 interface FastEthernet4 25
ip nat source static tcp 192.168.1.x 587 interface FastEthernet4 587
ip nat source static tcp 192.168.1.x 143 interface FastEthernet4 143
ip nat source static tcp 192.168.1.x 993 interface FastEthernet4 993
However, look what happens after a reload of the router:
Router1#reload
Proceed with reload? [confirm]Connection to router closed by remote host.
Connection to router closed.
$ ssh joe@router
Password:
Authorized Access only
Router1>en
Password:
Router1#show ip nat nvi translations | include ---
Router1#
Router1#show ip nat translations | include ---
tcp 188.222.181.173:25 192.168.1.2:25 --- ---
tcp 188.222.181.173:80 192.168.1.2:80 --- ---
tcp 188.222.181.173:143 192.168.1.2:143 --- ---
tcp 188.222.181.173:443 192.168.1.2:443 --- ---
tcp 188.222.181.173:587 192.168.1.2:587 --- ---
tcp 188.222.181.173:993 192.168.1.2:993 --- ---
tcp 188.222.181.173:1723 192.168.1.2:1723 --- ---
Router1#
Here's proof that the running config should have the mappings setup as NVI:
Router1#show running-config | include nat source
ip nat source list 1 interface FastEthernet4 overload
ip nat source list 2 interface FastEthernet4 overload
ip nat source static tcp 192.168.1.2 1723 interface FastEthernet4 1723
ip nat source static tcp 192.168.1.2 80 interface FastEthernet4 80
ip nat source static tcp 192.168.1.2 443 interface FastEthernet4 443
ip nat source static tcp 192.168.1.2 25 interface FastEthernet4 25
ip nat source static tcp 192.168.1.2 587 interface FastEthernet4 587
ip nat source static tcp 192.168.1.2 143 interface FastEthernet4 143
ip nat source static tcp 192.168.1.2 993 interface FastEthernet4 993
At this point, the mappings are not working (inbound connections from WAN on the HTTP/IMAP fail). I presume that this is because my interfaces are using ip nat enable for use with NVI mappings, instead of ip nat inside/outside.
So, I re-apply the mappings:
Router1#configure ter
Router1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router1(config)#ip nat source static tcp 192.168.1.2 1723 interface FastEthernet4 1723
Router1(config)#ip nat source static tcp 192.168.1.2 80 interface FastEthernet4 80
Router1(config)#ip nat source static tcp 192.168.1.2 443 interface FastEthernet4 443
Router1(config)#ip nat source static tcp 192.168.1.2 25 interface FastEthernet4 25
Router1(config)#ip nat source static tcp 192.168.1.2 587 interface FastEthernet4 587
Router1(config)#ip nat source static tcp 192.168.1.2 143 interface FastEthernet4 143
Router1(config)#ip nat source static tcp 192.168.1.2 993 interface FastEthernet4 993
Router1(config)#end
... then they show up correctly:
Router1#show ip nat nvi translations | include ---
tcp 188.222.181.173:25 192.168.1.2:25 --- ---
tcp 188.222.181.173:80 192.168.1.2:80 --- ---
tcp 188.222.181.173:143 192.168.1.2:143 --- ---
tcp 188.222.181.173:443 192.168.1.2:443 --- ---
tcp 188.222.181.173:587 192.168.1.2:587 --- ---
tcp 188.222.181.173:993 192.168.1.2:993 --- ---
tcp 188.222.181.173:1723 192.168.1.2:1723 --- ---
Router1#
Router1#show ip nat translations | include ---
Router1#
... furthermore, now from both WAN and LAN, the services mapped above now work until the next reload. All of the above is required every time I have to reload the router (which is all too often at the moment :-( ).
Here's my full current config:
!
! Last configuration change at 20:20:15 UTC Tue Dec 11 2012 by xxx
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname xxx
!
boot-start-marker
boot-end-marker
!
!
enable secret 4 xxxx
!
aaa new-model
!
!
aaa authentication login local_auth local
!
!
!
!
!
aaa session-id common
!
memory-size iomem 10
!
crypto pki trustpoint TP-self-signed-xxx
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-xxx
revocation-check none
rsakeypair TP-self-signed-xxx
!
!
crypto pki certificate chain TP-self-signed-xxx
certificate self-signed 01
xxx
quit
ip gratuitous-arps
ip auth-proxy max-login-attempts 5
ip admission max-login-attempts 5
!
!
!
!
!
ip domain list dmz.xxx.local
ip domain list xxx.local
ip domain name dmz.xxx.local
ip name-server 192.168.1.x
ip cef
login block-for 3 attempts 3 within 3
no ipv6 cef
!
!
multilink bundle-name authenticated
license udi pid CISCO881-SEC-K9 sn xxx
!
!
username admin privilege 15 secret 4 xxx
username joe secret 4 xxx
!
!
!
!
!
ip ssh time-out 60
!
!
!
!
!
!
!
!
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
switchport access vlan 2
no ip address
!
interface FastEthernet4
ip address dhcp
ip access-group 101 in
ip nat enable
duplex auto
speed auto
!
interface Vlan1
ip address 192.168.1.x 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat enable
!
interface Vlan2
ip address 192.168.0.x 255.255.255.0
!
ip forward-protocol nd
ip http server
ip http access-class 1
ip http authentication local
ip http secure-server
!
!
ip nat source list 1 interface FastEthernet4 overload
ip nat source list 2 interface FastEthernet4 overload
ip nat source static tcp 192.168.1.x 1723 interface FastEthernet4 1723
!
!
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 2 permit 192.168.1.0 0.0.0.255
access-list 101 permit udp 193.x.x.0 0.0.0.255 any eq 5060
access-list 101 deny udp any any eq 5060
access-list 101 permit ip any any
!
!
!
!
control-plane
!
!
banner motd
Authorized Access only
!
line con 0
exec-timeout 15 0
login authentication local_auth
line aux 0
exec-timeout 15 0
login authentication local_auth
line vty 0 4
access-class 2 in
login authentication local_auth
length 0
transport input all
!
!
end
I'd appreciate it greatly if anyone can help me find out why these mappings are not setup correctly using the saved config after a reload.
