<html>
<body>
I know that NAT is working with a single address as well but this is
based on later software releases which are not available for the XL (the
XL stopped at 7.5 which is the release you are using).<br><br>
R, Oliver<br><br>
At 20:56 24.03.2008, Gregori Parker wrote:<br>
<blockquote type=cite class=cite cite="">All hosts use the virtual
interface 10.4.20.1 on the SI XL.<br>
<br>
I solved the problem by making the following changes:<br>
<br>
· server router-ports 1
(removed ve 2)<br>
· ip nat pool OutAdds
10.99.1.3 10.99.1.4 netmask 255.255.255.0 (NAT apparently only works with
at least 2 ip addresses in the global pool)<br>
<br>
So, here is my working-good config (for the benefit of those with similar
problems, Active-Standby, ip routing & NAT all work now)<br>
<br>
Current configuration:<br>
!<br>
ver 07.5.00fT12<br>
global-protocol-vlan<br>
!<br>
!<br>
server backup ethe 13 00e0.5201.0c72 vlan-id 2<br>
server backup-preference 5<br>
server backup-group 1<br>
<br>
server port 3389<br>
tcp<br>
server router-ports 1<br>
!<br>
server real test1 10.4.20.11<br>
port 3389<br>
!<br>
server virtual test1 10.99.1.11<br>
port 3389<br>
bind 3389 test1 3389<br>
!<br>
vlan 1 name DEFAULT-VLAN by port<br>
no spanning-tree<br>
!<br>
vlan 2 by port<br>
untagged ethe 13<br>
no spanning-tree<br>
!<br>
vlan 11 by port<br>
untagged ethe 1<br>
router-interface ve 1<br>
!<br>
vlan 12 by port<br>
untagged ethe 2<br>
router-interface ve 2<br>
!<br>
ip forward<br>
ip address 10.99.1.5 255.255.255.0<br>
ip nat inside<br>
ip nat inside source list 1 pool OutAdds overload<br>
ip nat pool OutAdds 10.99.1.3 10.99.1.4 netmask 255.255.255.0<br>
ip default-gateway 10.99.1.1<br>
ip dns domain-name xxxxx.com<br>
ip policy 1 cache tcp 0 global<br>
ip policy 2 cache udp 0 global<br>
interface e 13<br>
no spanning-tree<br>
!<br>
interface ve 1<br>
ip standby-address 10.99.1.2 255.255.255.0<br>
!<br>
interface ve 2<br>
ip standby-address 10.4.20.1 255.255.255.0<br>
!<br>
access-list 1 permit 10.4.20.0 0.0.0.255<br>
!<br>
end<br>
<br>
<br>
<b>From:</b> Oliver Adam
[<a href="mailto:oadam@madao.de" eudora="autourl">
mailto:oadam@madao.de</a>] <br>
<b>Sent:</b> Monday, March 24, 2008 11:55 AM<br>
<b>To:</b> Gregori Parker; foundry-nsp@puck.nether.net<br>
<b>Subject:</b> Re: [f-nsp] Serveriron NAT ?<br>
<br>
Looking at the config below I am pretty sure this is not a configuration
problem. I guess it is more a problem of the traffic flow. You have
mentioned that the private address space is 10.4.20.0/24. Clients out of
this subnet want to communicate with the outside world and this is the
traffic you would like to NAT - the traffic needs to pass the SI XL to
get NAT'ed - so what is the default gateway of the clients out of the
10.4.20.x subnet? Is it possible that the traffic is just bypassing the
XL which would imply that it is not going to get NAT'ed?<br><br>
R, Oliver<br><br>
At 21:56 20.03.2008, Gregori Parker wrote:<br><br>
I really need some help here - I am a Cisco/F5 engineer that has
been<br>
thrown into a situation with a pair of Foundry Serveriron XLs, and I<br>
have little to no knowledge or resources for configuring them.<br><br>
I have a test environment that can be simplified to this:<br><br>
[/24 public]----[SI XL Active / NAT]----[/24 private]<br><br>
<br>
Public address space is 10.99.1.0/24, with the Active LB acting as a<br>
default gateway (10.4.20.1)<br><br>
Private address space is 10.4.20.0/24, with cisco 3560s doing HSRP
to<br>
act<br>
as a default gateway (10.99.1.1)<br><br>
I have a test VIP going, and it works fine - but I cant get outgoing
NAT<br>
to work. I want to be able to simply initiate a connection from
private<br>
address space, NAT to a single overloaded address on the LB, and<br>
interact with a 'public' address. Here is my configuration from
the<br>
Active LB, I appreciate any guidance.<br>
<br><br>
Current configuration:<br>
!<br>
ver 07.4.00T12<br>
global-protocol-vlan<br>
!<br>
!<br>
server backup ethe 13 00e0.5201.0c72<br>
server backup-preference 5<br>
server backup-group 1<br>
!<br>
server port 3389<br>
tcp<br>
!<br>
server router-ports 1 2<br>
!<br>
!<br>
server real test01 10.4.20.11<br>
port 3389<br>
!<br>
server virtual vtest01 10.99.1.11<br>
port 3389<br>
bind 3389 test01 3389<br>
!<br>
!<br>
vlan 1 name DEFAULT-VLAN by port<br>
no spanning-tree<br>
!<br>
vlan 2 by port<br>
untagged ethe 13<br>
no spanning-tree<br>
!<br>
vlan 11 by port<br>
untagged ethe 1<br>
router-interface ve 1<br>
!<br>
vlan 12 by port<br>
untagged ethe 2<br>
router-interface ve 2<br>
!<br>
hostname TESTLB01<br>
ip forward<br>
ip address 10.99.1.3 255.255.255.0<br>
ip nat inside<br>
ip nat inside source list 1 pool OutAdds overload<br>
ip nat pool OutAdds 10.99.1.2 10.99.1.2 netmask 255.255.255.0<br>
ip default-gateway 10.99.1.1<br>
ip policy 1 cache tcp 0 global<br>
ip policy 2 cache udp 0 global<br>
interface e 13<br>
no spanning-tree<br>
!<br>
interface ve 1<br>
ip standby-address 10.99.1.2 255.255.255.0<br>
!<br>
interface ve 2<br>
ip standby-address 10.4.20.1 255.255.255.0<br>
!<br>
access-list 1 permit 10.4.20.0 0.0.0.255<br><br>
<br><br>
_______________________________________________<br>
foundry-nsp mailing list<br>
foundry-nsp@puck.nether.net<br>
<a href="http://puck.nether.net/mailman/listinfo/foundry-nsp">
http://puck.nether.net/mailman/listinfo/foundry-nsp</a><br><br>
</blockquote>
<x-sigsep><p></x-sigsep>
<font face="Times New Roman, Times" size=2><br>
</font></body>
</html>