Newbie Question; Cisco 837

Andrew Neillans · Guest

Hi all,

I have a Cisco 837 that I'm having trouble getting Port Mapping working
as expected. My config is:

!version 12.3
no service pad
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
service password-encryption
service compress-config
!
hostname c830
!
boot-start-marker
boot-end-marker
!
no logging buffered
enable secret 5 Blah
!
username ajn privilege 15 secret 5 Blah
clock timezone GMT 0
clock summer-time BST recurring last Sun Mar 2:00 last Sun Oct 2:00
no aaa new-model
ip subnet-zero
ip domain name internal.neillans.co.uk
ip name-server 217.169.20.20
ip name-server 217.169.20.21
ip dhcp excluded-address 10.0.0.101 10.0.0.254
ip dhcp excluded-address 10.0.0.1
!
ip dhcp pool LAN
network 10.0.0.0 255.255.255.0
default-router 10.0.0.1
dns-server 217.169.20.20 217.169.20.21
!
!
ip inspect name DEFAULT100 cuseeme
ip inspect name DEFAULT100 ftp
ip inspect name DEFAULT100 h323
ip inspect name DEFAULT100 netshow
ip inspect name DEFAULT100 rcmd
ip inspect name DEFAULT100 realaudio
ip inspect name DEFAULT100 rtsp
ip inspect name DEFAULT100 smtp
ip inspect name DEFAULT100 sqlnet
ip inspect name DEFAULT100 streamworks
ip inspect name DEFAULT100 tftp
ip inspect name DEFAULT100 tcp
ip inspect name DEFAULT100 udp
ip inspect name DEFAULT100 vdolive
ip inspect name DEFAULT100 icmp
ip audit notify log
ip audit po max-events 100
ip ssh version 2
no ftp-server write-enable
!
!
!
no crypto isakmp enable
!
!
!
!
interface Ethernet0
description $ETH-LAN$$FW_INSIDE$Local Network
ip address 10.0.0.1 255.255.255.0
ip access-group 100 in
ip nat inside
no cdp enable
hold-queue 100 out
!
interface ATM0
no ip address
no atm ilmi-keepalive
pvc 0/38
encapsulation aal5mux ppp dialer
dialer pool-member 10
!
dsl operating-mode auto
!
interface Dialer0
description $FW_OUTSIDE$Point-to-Point to AAISP Customer Aggregation
ip address negotiated
ip access-group 101 in
ip nat outside
ip inspect DEFAULT100 out
encapsulation ppp
dialer pool 10
ppp authentication chap callin
ppp chap hostname blah
ppp chap password 7 blah
!
ip nat inside source list 1 interface Dialer0 overload
ip nat inside source static udp 10.0.0.108 9991 interface Dialer0 9991
ip nat inside source static tcp 10.0.0.107 22 interface Dialer0 9922
ip nat inside source static tcp 10.0.0.108 9991 interface Dialer0 9991
ip nat inside source static 10.0.0.101 1.1.1.1 extendable
ip nat inside source static 10.0.0.102 2.2.2.2 extendable
ip nat inside source static 10.0.0.103 3.3.3.3 extendable
ip nat inside source static 10.0.0.104 4.4.4.4 extendable
ip nat inside source static 10.0.0.105 5.5.5.5 extendable
ip nat inside source static 10.0.0.106 6.6.6.6 extendable
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0
no ip http server
ip http authentication local
ip http secure-server
!
!
access-list 1 permit 10.0.0.0 0.0.0.255
access-list 100 remark auto generated by SDM firewall configuration
access-list 100 remark SDM_ACL Category=1
access-list 100 deny ip host 255.255.255.255 any
access-list 100 deny ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
access-list 101 remark auto generated by SDM firewall configuration
access-list 101 remark SDM_ACL Category=1
access-list 101 permit icmp any any echo-reply
access-list 101 permit icmp any any time-exceeded
access-list 101 permit icmp any any unreachable
access-list 101 remark BitTorrent
access-list 101 permit udp any host 200.200.200.200 eq 9991
access-list 101 permit tcp any host 200.200.200.200 eq 9991
access-list 101 remark SSH to Dev
access-list 101 permit tcp any host 200.200.200.200 eq 9922 log
access-list 101 remark SSH to Router
access-list 101 permit tcp any any eq 22 log
access-list 101 deny ip 172.16.0.0 0.15.255.255 any
access-list 101 deny ip 192.168.0.0 0.0.255.255 any
access-list 101 deny ip 127.0.0.0 0.255.255.255 any
access-list 101 deny ip host 255.255.255.255 any
access-list 101 deny ip host 0.0.0.0 any
access-list 101 deny ip any any log
snmp-server community public RO
snmp-server enable traps tty
no cdp run
!
control-plane
!
!
line con 0
logging synchronous
login local
no modem enable
transport preferred all
transport output all
line aux 0
transport preferred all
transport output all
line vty 0 4
exec-timeout 15 0
login local
transport preferred all
transport input ssh
transport output all
!
scheduler max-task-time 5000
!
end

I am assigned a number of static IP's by my isp (1.1.1.1 to 6.6.6.6 in
the above), along side my standard static ADSL ip (200.200.200.200 in
the above). I have the additional static IP's mapped to internal IP's
via static NAT.
Also in the above, you can see that I have tried to map a number of
other ports - 9991 and 9922 to other IP's on my network, however, these
are to be bound to the same public IP address as my ADSL connection.

But the above does not work - and I can't see why.... 9922 and 9991
remain closed.

Anyone care to give me a pointer?

Regards,

Andy Neillans