Newsgroup: it.comp.reti.cisco
Titolo: PAT non funziona

Salve amici
il mio famoso cisco 837 configurato cosi:
Building configuration...
Current configuration : 7123 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname gateway
!
!
username maggiore privilege 15 password 7 06340A354D4C0E49
clock timezone CET 1
ip subnet-zero
no ip source-route
no ip domain lookup
ip domain name 
spadhausen.it
!
ip audit notify log
ip audit po max-events 100
ip ssh time-out 90
!
!
!
!
interface Ethernet0
 bandwidth 10000
 ip address 192.168.0.254 255.255.255.0 secondary
 ip address 62.110.131.41 255.255.255.248
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 no ip mroute-cache
 no cdp enable
 hold-queue 100 out
!
interface ATM0
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 atm vc-per-vp 64
 atm ilmi-keepalive
 dsl operating-mode auto
 dsl power-cutback 0
 hold-queue 224 in
!
interface ATM0.35 point-to-point
 ip address 80.23.68.238 255.255.255.252
 ip access-group 100 in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 pvc 8/35
  encapsulation aal5snap
 !
!
ip nat inside source list 102 interface Ethernet0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 80.23.68.237
no ip http server
!
!
access-list 100 deny   ip 0.0.0.0 0.255.255.255 any
access-list 100 deny   ip 10.0.0.0 0.255.255.255 any
access-list 100 deny   ip 127.0.0.0 0.255.255.255 any
access-list 100 deny   ip 169.254.0.0 0.0.255.255 any
access-list 100 deny   ip 172.16.0.0 0.15.255.255 any
access-list 100 deny   ip 192.0.2.0 0.0.0.255 any
access-list 100 deny   ip 192.168.0.0 0.0.255.255 any
access-list 100 deny   ip 224.0.0.0 15.255.255.255 any
access-list 100 deny   ip host 255.255.255.255 any
access-list 100 deny   ip host 62.110.131.40 host 62.110.131.40
access-list 100 deny   ip host 62.110.131.41 host 62.110.131.41
access-list 100 deny   ip host 62.110.131.42 host 62.110.131.42
access-list 100 deny   ip host 62.110.131.43 host 62.110.131.43
access-list 100 deny   ip host 62.110.131.44 host 62.110.131.44
access-list 100 deny   ip host 62.110.131.45 host 62.110.131.45
access-list 100 deny   ip host 62.110.131.46 host 62.110.131.46
access-list 100 deny   ip host 62.110.131.47 host 62.110.131.47
access-list 100 deny   ip host 62.110.131.40 any
access-list 100 deny   ip host 62.110.131.41 any
access-list 100 deny   ip host 62.110.131.42 any
access-list 100 deny   ip host 62.110.131.43 any
access-list 100 deny   ip host 62.110.131.44 any
access-list 100 deny   ip host 62.110.131.45 any
access-list 100 deny   ip host 62.110.131.46 any
access-list 100 deny   ip host 62.110.131.47 any
access-list 100 deny   ip any host 62.110.131.40
access-list 100 deny   ip any host 62.110.131.47
access-list 100 deny   ip any any fragments
access-list 100 permit icmp any host 62.110.131.41 echo
access-list 100 deny   icmp any host 62.110.131.42 echo
access-list 100 deny   icmp any host 62.110.131.43 echo
access-list 100 deny   icmp any host 62.110.131.44 echo
access-list 100 permit icmp any any
access-list 100 permit igmp any any
access-list 100 deny   udp any any range 33400 34400
access-list 100 permit tcp any host 62.110.131.41 eq 22
access-list 100 permit tcp any host 62.110.131.41 eq telnet
access-list 100 permit 0 any host 62.110.131.41
access-list 100 permit 41 any host 62.110.131.41
access-list 100 permit 58 any host 62.110.131.41
access-list 100 permit 59 any host 62.110.131.41
access-list 100 permit 60 any host 62.110.131.41
access-list 100 permit tcp any host 62.110.131.41 established
access-list 100 permit udp any eq domain host 62.110.131.41 range 1024 5000
access-list 100 deny   ip any host 62.110.131.41
access-list 100 permit tcp any host 62.110.131.42 eq ftp-data
access-list 100 permit tcp any host 62.110.131.42 eq ftp
access-list 100 permit tcp any host 62.110.131.42 eq domain
access-list 100 permit udp any host 62.110.131.42 eq domain
access-list 100 permit tcp any host 62.110.131.42 eq 1214
access-list 100 permit tcp any host 62.110.131.42 eq 2000
access-list 100 permit tcp any host 62.110.131.42 range 2010 2020
access-list 100 permit tcp any host 62.110.131.42 eq 3389
access-list 100 permit tcp any host 62.110.131.42 eq 4662
access-list 100 permit udp any host 62.110.131.42 eq 4672
access-list 100 permit tcp any host 62.110.131.42 eq 4899
access-list 100 permit udp any host 62.110.131.42 eq 6257
access-list 100 permit tcp any host 62.110.131.42 eq 6699
access-list 100 permit tcp any host 62.110.131.42 eq 6667
access-list 100 permit tcp any host 62.110.131.42 eq 7100
access-list 100 permit tcp any host 62.110.131.42 established
access-list 100 permit 0 any host 62.110.131.42
access-list 100 permit 41 any host 62.110.131.42
access-list 100 permit 58 any host 62.110.131.42
access-list 100 permit 59 any host 62.110.131.42
access-list 100 permit 60 any host 62.110.131.42
access-list 100 permit udp any eq domain host 62.110.131.42 range 1024 5000
access-list 100 deny   ip any host 62.110.131.42
access-list 100 permit tcp any host 62.110.131.43 eq ftp-data
access-list 100 permit tcp any host 62.110.131.43 eq ftp
access-list 100 permit tcp any host 62.110.131.43 eq smtp
access-list 100 permit tcp any host 62.110.131.43 eq www
access-list 100 permit tcp any host 62.110.131.43 eq 81
access-list 100 permit tcp any host 62.110.131.43 eq 90
access-list 100 permit tcp any host 62.110.131.43 eq pop3
access-list 100 permit tcp any host 62.110.131.43 eq 1433
access-list 100 permit tcp any host 62.110.131.43 eq 2000
access-list 100 permit tcp any host 62.110.131.43 range 2010 2020
access-list 100 permit tcp any host 62.110.131.43 eq 4899
access-list 100 permit tcp any host 62.110.131.43 established
access-list 100 permit 0 any host 62.110.131.43
access-list 100 permit 41 any host 62.110.131.43
access-list 100 permit 58 any host 62.110.131.43
access-list 100 permit 59 any host 62.110.131.43
access-list 100 permit 60 any host 62.110.131.43
access-list 100 permit udp any eq domain host 62.110.131.43 range 1024 5000
access-list 100 deny   ip any host 62.110.131.43
access-list 100 permit tcp any host 62.110.131.44 eq ident
access-list 100 permit tcp any host 62.110.131.44 range 2010 2020
access-list 100 permit tcp any host 62.110.131.44 eq 63000
access-list 100 permit tcp any host 62.110.131.44 eq 63050
access-list 100 permit tcp any host 62.110.131.44 eq 63100
access-list 100 permit 0 any host 62.110.131.44
access-list 100 permit 41 any host 62.110.131.44
access-list 100 permit 58 any host 62.110.131.44
access-list 100 permit 59 any host 62.110.131.44
access-list 100 permit 60 any host 62.110.131.44
access-list 100 permit tcp any host 62.110.131.44 established
access-list 100 permit udp any eq domain host 62.110.131.44 range 1024 5000
access-list 100 deny   ip any host 62.110.131.44
access-list 100 deny   ip any any
access-list 101 permit ip 192.168.0.0 0.0.255.255 any
access-list 101 permit ip 80.21.107.2 0.0.0.252 any
access-list 101 deny   ip any any
access-list 102 permit ip 192.168.0.0 0.0.0.255 any
no cdp run
!
line con 0
 exec-timeout 120 0
 no modem enable
 stopbits 1
line aux 0
 stopbits 1
line vty 0 4
 access-class 101 in
 exec-timeout 120 0
 login local
 transport input telnet
!
scheduler max-task-time 5000
end
-----------------
se io metto questa riga:
ip nat inside source static tcp 192.168.0.10 4899 62.110.131.41 4899
extendable
in pratica la porta del ip 41 (che è quella del mio GW, con il quale tutti i
client NAT escono fuori)
viene forwardata all'ip lan 192.168.0.10 -
infatti sulla 4899 ci sta Remote Administrator 2.1 e funziona correttamente
nelle ACL 100 metto anche
ip access-list 100 permit tcp any host 62.110.131.41 eq 4899
e funziona tutto.
non funzionan niente se io permetto con 10 righe come quelle sopra, un range
che va dalla 2010 alla 2020
sempre sull'ip privato .10
nelle ACL 100  inserisco:
access-list 100 permit tcp any host 62.110.131.41 range 2010 2020
ma non funziona.
Mi riferisco alle DCC CHAT di mIRC32.
imposto dentro al mIRC il range 2010-2020 per le DCC ma non funzionano in
uscita.
Premetto che con i forwarding di sistema se avevo server NAT un win 200x
funzionavano.
come posso fare?
dove sbaglio nel cisco?
grazie

senza stare a vedere tutta la config, ti dico subito che per far andare la
DCC devi fare static nat anche per la 113 (identd)