Forwarding ICMP through a Cisco router

[nick]

You will not be able to "ping" (using ICMP) 4 private devices with a single public IP address. No amount of router jockeying will allow you to break the rules (unless of course you are Chuck Norris).

Sounds like a challenge! Now I just have to try it! Lab, here I come (well, I'm sitting in it, in a manner of speaking).

ETA: I believe, he's trying to ping one of the devices, the one without a NATed service, not all 4 of them, for he has the services he can connect to on the other three.

[DiscoBayJoe]

Sounds like a challenge! Now I just have to try it! Lab, here I come (well, I'm sitting in it, in a manner of speaking).

ETA: I believe, he's trying to ping one of the devices, the one without a NATed service, not all 4 of them, for he has the services he can connect to on the other three.

Oh! He only needs to ping one device.

That's not too hard.

ip nat inside source static tcp 10.0.0.100 80 1.2.3.4 80
ip nat inside source static tcp 10.0.0.101 22 1.2.3.4 22
ip nat inside source static tcp 10.0.0.102 3389 1.2.3.4 3389
ip nat inside source static 10.0.0.103 1.2.3.4

Just make sure you have a good external ACL, because all ports/protocols other than 80/22/3389 will be NAT'd to .103, including ICMP

You might be able to accomplish the same thing using the 'ip nat inside source list' command with an ACL that permits ICMP to the .103 and then the services needed to the other hosts. Either way, your only going to get "ping" to work against one of the hosts, not all 4.

[nick]

Wouldn't work, one of the conditions states that he can't do a 1-to-1 NAT (test mode).

[DiscoBayJoe]

Wouldn't work, one of the conditions states that he can't do a 1-to-1 NAT (test mode).

Even Mr. T couldn't work under those requirements! I can understand no 1-to-1 NAT because you don't have 4 public IP's, but not because you don't trust the interface ACL.

Your problem is at layer 8 of the OSI model.

[nick]

Would that be the fleshy layer?

[bigmike82]

"Unless there is a NAT rule for something, router is supposed to assume traffic as addressed to itself, and handle it."
Uhm...not in my experience with Cisco routers.

"It's ***-backwards in so many ways. "
It's not backwards at all. Ping is one of the ways I'm monitoring it, but that's what Zenoss wants in order to determine if it's up, so that's what Zenoss is going to get. The entire point of static NATing is to allow this kind of functionality with the amount of IPs as a constraint.

You did just jog my memory. I'm used to working on Windows machines, so ping for me means ICMP. I completely forgot that 'nix uses TCP/UDP...so forwarding port 7 should, in fact, work. That's my next step. Thank you.

"You might be able to accomplish the same thing using the 'ip nat inside source list' command with an ACL that permits ICMP to the .103"
This won't work. IP Nat doesn't allow ICMP as a protocol.

"Either way, your only going to get "ping" to work against one of the hosts, not all 4. "
That's fine, and is exactly what I want. Hmm....I wasn't aware that I could nat ports, and then the entire IP, and have those two work. I'll have to give that a shot as well.

I think the port 7 thing is going to be the final config. Thanks again for reminding me of that.

[bigmike82]

Damn it, I'm an idiot.

PING doesn't run on TCP. There's no option that I've seen, even in Linux, to ping using port 7. Ping is always ICMP. Tracert uses either ICMP or TCP, depending on the implementation.

Damn it.