[c-nsp] Don't NAT a Subset of Traffic

[Sridhar Ayengar]

Octavio Alvarez wrote:
>> I have a Verizon FiOS connection with 5 IP addresses attached to my 7505.
>>
>> So because it's excluded from the access-list, traffic from my private
>> network 172.16.16.0 to my public IP addresses is not NATed. I still
>> can't figure out how to pass this traffic without NATing it. If I
>> remove the deny line from the access-list, the traffic is correctly
>> passed NATed. Anyone have any ideas for me?
>
> I would go for: it is passing but you don't have return routes on your
> external hosts.

That's what I thought I had, but when I just tried it, it didn't work.

My current configuration:

bridge irb
!
interface FastEthernet2/0/0
  no ip address
  no ip redirects
  no ip unreachables
  no ip proxy-arp
  ip virtual-reassembly
  no ip mroute-cache
  half-duplex
  no cdp enable
  no mop enabled
  bridge-group 1
!
interface FastEthernet2/1/0
  ip address 172.16.16.1 255.255.255.0
  no ip redirects
  no ip unreachables
  no ip proxy-arp
  ip nat inside
  ip virtual-reassembly
  full-duplex
  no cdp enable
  no mop enabled
!
interface FastEthernet3/0/0
  no ip address
  no ip redirects
  no ip unreachables
  no ip proxy-arp
  ip virtual-reassembly
  no ip mroute-cache
  half-duplex
  no cdp enable
  no mop enabled
  bridge-group 1
!
interface BVI1
  ip address 173.50.165.26 255.255.255.0
  ip nat outside
  ip virtual-reassembly
!
ip classless
ip route 0.0.0.0 0.0.0.0 173.50.165.1
!
ip nat translation max-entries 300
ip nat inside source list 101 interface BVI1 overload
!
access-list 101 deny   ip 172.16.16.0 0.0.0.255 173.50.165.24 0.0.0.7
access-list 101 deny   ip 173.50.165.24 0.0.0.7 172.16.16.0 0.0.0.255
access-list 101 permit ip 172.22.22.0 0.0.0.255 any
access-list 101 deny   ip any any

Peace...  Sridhar