jwink wrote:
I have a customer with a /29 block behind a 908e that is doing NAT for phones. The problem is the /29 is getting Natted to the IP on the 908 and that defeats the purpose of the customers block. Does anyone know of a configuration that would allow the /29 block IP's to show through and not be effected by the NAT? My first thought is to try 802.1q encapsulation. I'll attach some config examples and would greatly appreciate any feedback.
interface eth 0/2
encapsulation 802.1q
no shutdown
!
interface eth 0/2.1
vlan-id 1 native
description customer LAN
ip address 216.176.x.x 255.255.255.252
no shutdown
!
interface eth 0/2.10
vlan-id 10
description phones
access-policy Private
qos-policy in SET_DSCP
ip address 192.168.0.1 255.255.255.0
no shutdown
Would this NAT VLAN 10 but not 1 ?
|
You don't have the access-policies shown so it's hard to tell. Also you show a /30 for 216.176.x.x, not a /29.
Assuming that the /30 is the point-to-point to the provider and they're routing a /29 of www.xxx.yyy.zzz to you, you would have something like the following:
interface eth 0/2
encapsulation 802.1q
no shutdown
!
interface eth 0/2.1
vlan-id 1 native
description WAN link to ISP
access-policy Public
media-gateway ip primary
ip address 216.176.x.x 255.255.255.252
no shutdown
!
interface eth 0/2.10
vlan-id 10
description phones
access-policy Private
media-gateway ip primary
qos-policy in SET_DSCP
ip address 192.168.0.1 255.255.255.0
no shutdown
!
interface eth 0/2.20
vlan-id 20
description Public LAN block
access-policy Ethernet
ip address www.xxx.yyy.zzz 255.255.255.248
no shutdown
ip access-list standard ics
remark Internet Connection Sharing
permit any
ip access-list extended ether-in
remark Ethernet in
permit ip any www.xxx.yyy.zzz 0.0.0.7
! This is applied to the Public interface. Specifying the
! subnet of the LAN block itself prevents spoofing from outside.
ip access-list extended ether-out
remark Ethernet out
permit ip www.xxx.yyy.zzz 0.0.0.7 any
! This is applied to the Ethernet interface. Specifying the
! subnet of the interface itself prevents spoofing from inside.
ip policy-class Public
allow list self self
! This allows the public zone to receive any traffic for the Adtran itself
allow list ether-in policy Ethernet
! This allows traffic routed to the public addresses on the
! ethernet to be routed without NAT.
ip policy-class Ethernet
allow list ether-out
ip policy-class Private
allow list self self
! This allows traffic sourced from the Adtran to pass, such as ALG traffic.
nat source list ics interface eth 0/2.1 overload
! Allows outbound NAT to the public Internet interface
Now, on the switch connected to eth 0/2 you would create VLAN 20 which will have the routed /29 block.
Alternatively, use eth 0/1 for the WAN to the provider and VLAN 10 and 20 on eth 0/2 for your public LAN and phones.
