Got it

PPPoE client cannot be reached outside router

Created: Jul 10, 2020 19:46:28Latest reply: Aug 28, 2020 12:27:32 711 5 0 0 0
  Rewarded HiCoins: 1 (problem resolved)

Hi

I am migrating a pppoe server from a Cisco router to an NE40E-M2K-B. On router NE40E-M2K-B I can't ping the client connected via pppoe outside the router.

A tracert shows that the packet goes to the NE40E-M2K-B but no response. We can reach the customer inside the NE40E-M2K-B.We saw that NE40E-M2K-B requires a gateway in the dhcp pool, and we also saw that the network mask delivered to the client is / 32. Is there a parameter that we have not configured to allow this traffic or how to deliver another network mask to the customer?

Featured Answers

Recommended answer

Popeye_Wang
Admin Created Jul 13, 2020 02:59:32

Hi daniele,

According to my understanding, your purpose is to perform NAT on the packets whose destination address is not 189.XXX.XXX.0.  

So I think the configuration should be as follows:

#

acl 3001

 rule 100 permit ip source 100.66.0.0 0.0.255.255 destination 189.XXX.XXX.0 0.0.15.255

#

acl 3002

 rule 100 permit ip source 100.66.0.0 0.0.255.255 

#

traffic classify NoNAT

  If match acl 3001

#

traffic classify NAT

 If match acl 3002

#

traffic behavior NoNAT

 permit

#

traffic behavior NAT

  nat bind instance NAT-1

#

traffice policy NAT

 Classify NoNAT behavior NoNAT

 Classify NAT behavior NAT

#

Interface Gx/x/x 

 traffic-policy NAT outbound

#


I hope this helps.

View more
  • x
  • convention:

All Answers
Hello User. We are reviewing your question and we will answer you shortly. Thanks.
View more
  • x
  • convention:

I have found the problem. Is my nat config. if i get the pool out of nat, then i can reach.
My nat acl is very simple, i have tried to deny traffic to local address on acl but do not work.
my nat rule is:

service-location 1
location slot 3
#
service-instance-group NAT-1
service-location 1
#
nat instance NAT-1 id 1
service-instance-group NAT-1
nat address-group NAT-1 group-id 1
section 1 189.XXX.XXX.0 mask 26
section 2 189.XXX.XXX.0 mask 25
nat statistics address-pool-usage enable
nat log send-mode session-end-only
#

acl number 3001
rule 100 permit ip source 100.66.0.0 0.0.255.255
#
# on the interface
nat bind acl 3001 instance NAT-1 precedence 0

on cisco router i do something like this:

!
ip access-list extended nat-acl
deny ip 100.66.0.0 0.0.63.255 189.XXX.XXX.0 0.0.15.255
permit ip 100.66.0.0 0.0.63.255 any
!

and works, i have tried on ne40 without success.
View more
  • x
  • convention:

Hi danielechizenm,
The ACL configuration on the Cisco device is different from that on the Huawei device. On the Huawei device, you allow 100.66.0.0/16 to pass through, but on the Cisco device, the ACL configuration is not.
View more
  • x
  • convention:

Hi daniele,

According to my understanding, your purpose is to perform NAT on the packets whose destination address is not 189.XXX.XXX.0.  

So I think the configuration should be as follows:

#

acl 3001

 rule 100 permit ip source 100.66.0.0 0.0.255.255 destination 189.XXX.XXX.0 0.0.15.255

#

acl 3002

 rule 100 permit ip source 100.66.0.0 0.0.255.255 

#

traffic classify NoNAT

  If match acl 3001

#

traffic classify NAT

 If match acl 3002

#

traffic behavior NoNAT

 permit

#

traffic behavior NAT

  nat bind instance NAT-1

#

traffice policy NAT

 Classify NoNAT behavior NoNAT

 Classify NAT behavior NAT

#

Interface Gx/x/x 

 traffic-policy NAT outbound

#


I hope this helps.

View more
  • x
  • convention:

Hi, thanks for de answer, o got already in another way but i will give a try on this. This will work for sure.
View more
  • x
  • convention:

Comment

You need to log in to comment to the post Login | Register
Comment

Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:
  • Politically sensitive content
  • Content concerning pornography, gambling, and drug abuse
  • Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy
Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see " User Agreement."

My Followers

Login and enjoy all the member benefits

Login

Block
Are you sure to block this user?
Users on your blacklist cannot comment on your post,cannot mention you, cannot send you private messages.
Reminder
Please bind your phone number to obtain invitation bonus.