hello guys thanks for your replies. Manuel, you are right. you exactly explained what happened. i have two freebsd system which are connected to a 2800 cisco router directly. i check packets in freebsd systems by wireshark that is a network protocol analyzer. in wireshark i see packets as i mentioned and request packets have type 8 (Echo ping request) and reply packets have type 0 (Echo ping reply).
i know this behavior is unusual but it really happens to me!!! you mean that cisco act normally? i mean when nai is defined from inside to outside, outside systems should be able to ping inside systems? and packets should be similar to below? request packets: src:192.168.2.1----> dst: 192.168.1.1 reply packets: src: 192.168.2.50----> dst:192.168.2.1 you know, first of all it is so important for me to understand what is the correct behavior and then try to fix my problem in freebsd box. thanks On Mon, Apr 1, 2013 at 7:01 PM, Manuel Berrocal (mberroca) < [email protected]> wrote: > Hi Sam, > This shouldn't be happening (as you are mentioning it). So > probably there are some details missing from your description that will > explain this. > How are you seeing the source and destination addresses of the > ping packets? (debug in router? Sniffer in each host? Etc) > What type are the ICMP packets? (you should be able to see this > either on the sniffer or the debug... the types are: > http://www.nthelp.com/icmp.html) > Are the source and destination hosts PC's connected to the router? > (or are you using loopback interfaces, etc) > > The following link might help you > http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080094c32.shtml > > By the way, I understand that when you change the Cisco router by > a freebsd system the host (192.168.2.1) seems to receive the same packet > reply but now the host acts differently... this is not possible... the host > shouldn't be able to tell whether the packet was sent from a cisco router > or a freebsd system (in both cases it receives src: 192.168.2.50----> > dst:192.168.2.1 type=0 if it is a reply)... so we have something missing... > if the host act differently the this are different packets... (The only > difference would be the MAC address of the freebsd system and the this > should remind us of ARP but I won't go there if not required... this > dependes on your answers to the questions above) > > Regards, > Manuel > > -----Original Message----- > From: [email protected] [mailto: > [email protected]] On Behalf Of Matt Thompson > mthompson-at-brightsolid.com |puck.nether.net nsp| > Sent: Sunday, March 31, 2013 7:00 AM > To: Manuel Berrocal (mberroca); s m > Cc: [email protected] > Subject: Re: [c-nsp] how NAt works from outside to inside > > Date: Sat, 30 Mar 2013 13:17:00 +0430 > From: s m <[email protected]<mailto:[email protected]>> > To: [email protected]<mailto:[email protected]> > Subject: [c-nsp] how NAt works from outside to inside > Message-ID: > < > caa_1sgggnvk-dpbs+2ostnlsedpubxszs3yttfvfy0kn3+k...@mail.gmail.com<mailto: > caa_1sgggnvk-dpbs%2b2ostnlsedpubxszs3yttfvfy0kn3%[email protected]>> > Content-Type: text/plain; charset=ISO-8859-1 > > hello all > > i am newbie in NAT and i have some problem. i want to have a dynamic nat > and this is my topology: > > 192.168.1.1-----> cisco 2800 ------> 192.168.2.1 > > and this is my configuration in cisco 2800: > > interface GigabitEthernet 0/0 > ip address 192.168.2.2 255.255.255.0 > ip nat outside > ip virtual-reassebly in > duplex auto > speed auto > > interface GigabitEthernet 0/1 > ip address 192.168.1.2 255.255.255.0 > ip nat inside > ip virtual-reassebly in > duplex auto > speed auto > > ip nat pool t 192.168.2.50 192.168.2.60 netmask 255.255.255.0 ip nat > inside source list 1 pool t access-list 1 permit any > > when i ping 192.168.2.1 from 192.168.1.1 (from inside to outside), every > thing is ok and nat is done correctly but when i ping > 192.168.1.1 from 192.168.2.1 (from outside to inside), packets that > received in 192.168.2.1 are as below: > > request packets: src:192.168.2.1----> dst: 192.168.1.1 > reply packets: src: 192.168.2.50----> dst:192.168.2.1 > > and 192.168.2.1 system accept these packets as its reply!!! i think this > behavior is wrong, isn't it? how it is happen? moreover, if i put a freebsd > system instead of cisco, everything is the same except that > 192.168.2.1 does not accept the reply packets as its reply (as i > expected!!). please let me know if the cisco behavior is correct or not and > if it is correct, how cisco router do that? > > please help me if i am misunderstanding. > thanks in advance > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
