Jump to content
Калькуляторы

ASR-ROUTER NAT

Reply to this topic

detmany   

detmany
Posted (edited)

Друзья подскажите пожалуйста, вопрос вроде простой, но непонятно как сделать.
Пытаемся сделать обычный нат.

192.168.1.1 <==> ASR 901(10.7.2.1) <==> C2960(10.7.2.4) <==> Ноут(10.7.2.11)

 - Есть ASR 901 у него GigabitEthernet0/4 смотрит во внешнюю сеть и TenGigabitEthernet0/1 к C2960.
 - Подняли нат но трафик от абонента на коммутаторе и с самого 2960 в него не попадает, хотя все vlans поднялись и все друг-друга видят.

 

ASR#p 10.7.2.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.7.2.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

ASR#p 10.7.2.11
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.7.2.11, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

 

 - С2960 тоже видит всех кроме внешней сети

С2960#ping 10.7.2.1 source vlan 4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.7.2.1, timeout is 2 seconds:
Packet sent with a source address of 10.7.2.4
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms


С2960#ping 192.168.1.1 source vlan 4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.7.2.4
.....
Success rate is 0 percent (0/5)


 - Сам роутер со своего интерфейса внешнюю сеть видит, а трафик который приходит с коммутатора в нат не попадает.

ASR#ping 192.168.1.1 source vlan4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.7.2.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

 

 - Когда абонент 10.7.2.11 пингует внешний шлюз 192.168.1.1, то в sh ip nat translations пусто.

 - Похоже дело где-то в bridge на ASR. Как-то надо их связать незнаю.

 

 

 

version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
service unsupported-transceiver
!
hostname ASR
!
boot-start-marker
boot system flash asr901sec-universalk9-mz.156-2.SP8.bin
boot-end-marker
!
!
!
!
no errdisable detect cause gbic-invalid
ip cef
!
!
ip name-server 8.8.8.8

ip domain name test.com
no ipv6 cef
!
!
!
!
!
!
!
multilink bundle-name authenticated
l3-over-l2 flush buffers
asr901-storm-control-bpdu 1000
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
license udi pid A901-6CZ-F-A sn CAT1734U0K3
license accept end user agreement
bridge-domain 2
bridge-domain 3
bridge-domain 4
bridge-domain 5
bridge-domain 6
!
cdp run
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet0/1
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet0/2
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet0/3
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet0/4
 description -==TO-192.168.1.0
 no ip address
 negotiation auto
 cdp enable
 service instance 2 ethernet
  encapsulation untagged
  bridge-domain 2
 !
!
interface GigabitEthernet0/5
 no ip address
 media-type auto-select
 negotiation auto
!
interface GigabitEthernet0/6
 no ip address
 shutdown
 media-type sfp
 no negotiation auto
 cdp enable
 spanning-tree portfast trunk
!
interface GigabitEthernet0/7
 no ip address
 media-type auto-select
 negotiation auto
!
interface GigabitEthernet0/8
 no ip address
 shutdown
 negotiation auto
 qos-config scheduling-mode min-bw-guarantee
!
interface GigabitEthernet0/9
 no ip address
 shutdown
 negotiation auto
 qos-config scheduling-mode min-bw-guarantee
!
interface GigabitEthernet0/10
 no ip address
 shutdown
 negotiation auto
 qos-config scheduling-mode min-bw-guarantee
!
interface GigabitEthernet0/11
 no ip address
 shutdown
 negotiation auto
 qos-config scheduling-mode min-bw-guarantee
!
interface TenGigabitEthernet0/0
 no ip address
 qos-config scheduling-mode min-bw-guarantee
!
interface TenGigabitEthernet0/1
 no ip address
 no negotiation auto
 cdp enable
 no qos-config scheduling-mode min-bw-guarantee
 spanning-tree portfast trunk
 service instance 3 ethernet
  encapsulation dot1q 3
  rewrite ingress tag pop 1 symmetric
  bridge-domain 3
 !
 service instance 4 ethernet
  encapsulation dot1q 4
  rewrite ingress tag pop 1 symmetric
  bridge-domain 4
 !
 service instance 5 ethernet
  encapsulation dot1q 5
  rewrite ingress tag pop 1 symmetric
  bridge-domain 5
 !
 service instance 6 ethernet
  encapsulation dot1q 6
  rewrite ingress tag pop 1 symmetric
  bridge-domain 6
 !
!
interface FastEthernet0/0
 no ip address
 shutdown
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan2
 description -==TO-192.168.1.0
 ip address dhcp
 ip nat outside
!
interface Vlan3
 ip address 10.7.1.1 255.255.255.192
 ip nat inside
!
interface Vlan4
 ip address 10.7.2.1 255.255.254.0
 ip nat inside
!
interface Vlan5
 ip address 10.7.5.1 255.255.255.0
!
interface Vlan6
 ip address 10.7.6.1 255.255.254.0
 ip nat inside
!
ip nat inside source list 155 interface Vlan2 overload
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 Vlan2 dhcp
ip ssh rsa keypair-name ASR.test.com
ip ssh version 2
!
!
access-list 155 permit ip 10.7.1.0 0.0.0.63 any
access-list 155 permit ip 10.7.2.0 0.0.1.255 any
access-list 155 permit ip 10.7.6.0 0.0.1.255 any
!
!
!
!
control-plane
!
!
line con 0
line vty 0 4
 session-timeout 60
 exec-timeout 60 0
 privilege level 15
 session-limit 5
 length 0
 transport preferred ssh
 transport input ssh
 transport output all
!
exception crashinfo buffersize 128
!
end

 

 

Edited by detmany

Share this post

Link to post
Share on other sites

detmany   

detmany
Posted (edited)

 

ASR#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is 192.168.1.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 192.168.1.1, Vlan2
      10.0.0.0/8 is variably subnetted, 8 subnets, 4 masks
C        10.7.1.0/26 is directly connected, Vlan3
L        10.7.1.1/32 is directly connected, Vlan3
C        10.7.2.0/23 is directly connected, Vlan4
L        10.7.2.1/32 is directly connected, Vlan4
C        10.7.5.0/24 is directly connected, Vlan5
L        10.7.5.1/32 is directly connected, Vlan5
C        10.7.6.0/23 is directly connected, Vlan6
L        10.7.6.1/32 is directly connected, Vlan6
      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.1.0/24 is directly connected, Vlan2
L        192.168.1.164/32 is directly connected, Vlan2
ASR#

 

 

 

 

 

без дефолтного маршрута тоже самое

 

если мы отправляем icmp с самого ASR с его vlan nat-трансляция идет, а со свича даже не попадает.

 

ASR#p 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
ASR#sh ip nat translations
ASR#
ASR#p 192.168.1.1 source vlan 4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.7.2.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
ASR#sh ip nat translations
Pro Inside global         Inside local          Outside local         Outside global
icmp 192.168.1.164:1024   10.7.2.1:31           192.168.1.1:31        192.168.1.1:1024
ASR#

 

Edited by detmany

Share this post

Link to post
Share on other sites

detmany   

detmany
Posted (edited)

на нем написано cisco ASR901 series router

 

nat-трансляции же идут, но только с внутреннего vlan.

такое ощущение, что bridge как-то должны быть настроены

 

 

знаете что заметили), когда добавлям или убираем дефолтный маршрут

ASR(config)#ip route 0.0.0.0 0.0.0.0 Vlan2
ASR(config)#no ip route 0.0.0.0 0.0.0.0 Vlan2
ASR(config)#ip route 0.0.0.0 0.0.0.0 Vlan2

 

один icmp-пакет с ноутбука успершо проходит в сеть 192.168.1.0, а потом опять все глохнет.

Edited by detmany

Share this post

Link to post
Share on other sites

UglyAdmin   

UglyAdmin
Posted
В 30.11.2022 в 21:09, detmany сказал:

на нем написано cisco ASR901 series router

https://www.cisco.com/c/en/us/td/docs/wireless/asr_901/Configuration/Guide/b_asr901-scg/b_asr901-scg_chapter_01000000.html

Действительно, умеет. :)

 

Статический маршрут "в интерфейс" точно нужен? По идее DHCP-клиент должен получать DG по DHCP.

Share this post

Link to post
Share on other sites

detmany   

detmany
Posted

да, сабы пробовали первым делом, но в ASR есть ограничения

 

ASR(config)#interface TenGigabitEthernet0/1.4
ASR(config-subif)#ip address 10.7.2.1 255.255.254.0
 IP address config under this interface is not supported on ASR901
ASR(config-subif)#

 

Этот затык трафика похож на какое-то специальное ограничение, типа лицензионное или что-то подобное.

Лицензия на nat, такое вообще бывает?

 

наши вот

ASR#sh lic
Index 1 Feature: AdvancedMetroIPAccess
        Period left: Life time
        License Type: Permanent
        License State: Active, In Use
        License Count: Non-Counted
        License Priority: Medium
Index 2 Feature: IPBase
        Period left: Life time
        License Type: Permanent
        License State: Active, Not in Use
        License Count: Non-Counted
        License Priority: Medium
Index 3 Feature: Gige4portflexi
Index 4 Feature: 10gigUpgrade
Index 5 Feature: 1588BC

 

 

Share this post

Link to post
Share on other sites

rz3dwy   

rz3dwy
Posted (edited)

У вас A901-6CZ-F-A:

 

https://community.cisco.com/t5/routing/asr-901-nat-not-working/td-p/2553642

 

A901-6CZ-F-A

Cisco ASR 901 Series Aggregation Services Router Chassis, Ethernet-only interfaces, 10 GE, AC power, USB

 

A901-6CZ-FS-A

Cisco ASR 901 Series Aggregation Services Router Chassis, Ethernet-only interfaces, 10 GE, IPSec/NAPT, AC power, USB

 

 

https://www.cisco.com/c/en/us/products/collateral/routers/asr-901-series-aggregation-services-routers/data_sheet_c78-686453.html

Edited by rz3dwy
upd!

Share this post

Link to post
Share on other sites

sol   

sol
Posted
В 01.12.2022 в 16:06, detmany сказал:

но применить его нет возможности?

Почему же нет? Есть такая возможность. Она называется SL-A901-I

 

Share this post

Link to post
Share on other sites

UglyAdmin   

UglyAdmin
Posted

А точно только в лицензии дело, а не железо другое?

Цитата

Prerequisites for Configuring NAT for IP Address Conservation

This feature is supported only on the following PIDs of the Cisco ASR 901 Router: A901-6CZ-FS-D and A901-6CZ-FS-A.

A901-6CZ-FS-XXX потребляют больше, чем аналогичные A901-6CZ-F-XXX, и флэша в них больше. Может, ещё и процессор другой?

Share this post

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
Go to topic listing Активное оборудование Ethernet, IP, MPLS, SDN/NFV...