Networks

Ask something
Question Locked

Another Cisco Port Forwarding Question...

0 helpful
18 replies

by kevin

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

My colleague with the Cisco router is now having problems with his Vonage service. They are telling him he needs to set up port forwarding for a range of ports (10000-20000) for it to work properly.

I have successfully used the following command for his SMTP and FTP traffic:

ip nat inside source static tcp 192.168.1.112 25 64.00.00.00 25 extendable

Can this same command be used for port ranges, as well? Could someone clue me in on how to do this?

Thanks in advance!

18 replies

by netman1958

It is possible to forward a range of ports, however, I use vonage at home and have a Cisco 831. I don't have that range of ports forwarded and my service works fine. What issues is your colleague experiencing?

by kevin

They can make and receive calls on all lines, but the voice component (RTP), either inbound or outbound, is intermittent on a per-call basis. Vonage says they use a random port between 10000 and 20000 for RTP, and that these ports should be forwarded to their device's IP address behind the NATing firewall.

by Former member

Do you have a firewall? Does the 831 serve as a firewall? It's just basically making the vonage device addresable from the Internet, over that port range.

by netman1958

ip nat pool VONAGE 192.168.1.1 192.168.1.1 netmask 255.255.255.0 type rotary
/* replace 192.168.1.1 with the ip address of your vonage device */

access-list 102 permit tcp any any range 10000 20000
and/or
access-list 102 permit udp any any range 10000 20000

ip nat inside destination list 102 pool VONAGE

Caveats:
(1) VOIP is usally udp but control traffic might be tcp, so it might be safer to include both lines in access-list 102.

(2) This assumes that the ip address of the vonage device is static. My Linksys PAP get's a dynamic ip and I don't know if/how you can access it to configure a static ip.

by Former member

Such as:
ip nat inside source static (TCPorUDP) (YourCompsIP) (PortToForward) interface (interface) (PortToForward)

So it sorta looks like this:
ip nat inside source static tcp 172.16.2.60 3389 interface eth1 3389

But if Vonage is saying to open up some high ports, that doesn't make sense. The incoming vonage port should be one number, and the same number, unless they me returning traffic, which usually is never blocked...

by netman1958

The problem is that he needs to forward a range of 1000 port numbers. The cisco IOs won't let you enter a range with the usual NAT statement like you mentioned; i.e.:
ip nat inside source static (TCPorUDP) (YourCompsIP) (PortToForward) interface (interface) (PortToForward)

So you have to do it the way I suggested in the other post.

Now, having said that, I think it's a moot point anyway because I use Vonage at home and have no such port forwarding configured on my 831.

Actually I wonder if what you said in another post isn't the problem. He didn't say whether he had an access list applied to his incoming interface or not, but if he does, that could be the problem. We really need to see his entire config to accurately trouble-shoot it.

by kevin

Actually, the Vonage device sits on the private network at 192.168.1.101. It has an HTML interface similar to a router that allows the user to configure IP addres and such. So it can be changed relatively easily.

That being said, he does still have his old router, and it would only take minimal work to put it back in place. We'll try one of these alternative configurations as soon as he has some time. I will also look at the "show interface" output, as you have suggested.

Thanks for the insight... I will keep you posted.

by kevin

My friend put his old Linksys router back in place of the Cisco, and he has had no problems with the audio on his Vonage lines dropping out. Before the switch, I also had him monitor the traffic between his Vonage device and the Cisco router using Wireshark. He saw UDP traffic in both directions on the random 10000-20000 ports even when he was on a "bad" call with no audio in one direction.

He has been unable to monitor traffic on the public side of his router due to the MAC address restriction of his ISP, and his ISP has not been very helpful as far as monitoring on their end. But I believe the monitoring he has done shows that the problem is not with the Vonage device. And the fact that the problem disappears with the Linksys router in place pretty much eliminates the ISP's blocking ports or addresses as a possible culprit. Everything points to the router.

Any other suggestions, anyone?

by Former member

Good call. Yeah, weird that they would call for a range. And probably won't help anyways, the ACL that is...

by kevin

My friend is still having trouble. He is a tech-savvy mech engineer but has about the same amount of Cisco experience as I do -- very little.

He used a Linksys router for three years with port forwarding set up as specified by Vonage and never had any problems. We set up the Cisco router five or six weeks ago, and Vonage worked all this time without forwarding the high port range. Now all of a sudden the voice data is being dropped intermittently.

I will try to get him to send me his config file so I can post it.

Thanks again for all your help. It is greatly appreciated!

by netman1958

Does your friend still have the Linksys router? If he does, he could put it back in place and see if the problem clears up or persists. If it persists with the old router, then you know it's not the router causing the issue.

If you can get the Cisco config from him, mask the username/passwords and go ahead and post it and I will be glad to take a look.

by kevin

The config file is posted here:

https://www.techrepublic.com.com/5208-6230-0.html?forumID=101&threadID=272734&messageID=2585165

Vonage's canned tech support response is to connect their device directly to the internet to rule out the router config. My buddy has a hub he can place on the public side, but I was hoping to save him the trouble if it was just a simple router config issue. If need be, though, I can have him do that in the morning.

by kevin

Here's the config file of the router in question. Thanks again for all your efforts!

!This is the running config of the router: 192.168.1.1
!----------------------------------------------------------------------------
!version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname cisco
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 debugging
logging console critical
enable secret 5
!
no aaa new-model
!
resource policy
!
clock timezone PCTime -5
clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
ip subnet-zero
no ip source-route
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.1.1 192.168.1.109
!
ip dhcp pool sdm-pool1
import all
network 192.168.1.0 255.255.255.0
dns-server 207.172.3.8 207.172.3.9
default-router 192.168.1.1
!
!
ip tcp synwait-time 10
no ip bootp server
ip domain name
ip name-server 207.172.3.8
ip name-server 207.172.3.9
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
crypto pki trustpoint TP-self-signed-1169253770
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1169253770
revocation-check none
rsakeypair TP-self-signed-1169253770
!
!
crypto pki certificate chain TP-self-signed-1169253770
certificate self-signed 01
30820251 308201BA A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31313639 32353337 3730301E 170D3032 30333031 30343232
31355A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 31363932
35333737 3030819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100CDCF D01FE149 ABE9F0D7 A76EB175 FA2F7D23 1730B7C9 DD000F42 95EBB788
667315B4 9B225A30 83D1D703 C60641DA 1FAF6691 1D60AC8C C72A08D0 FD1B069B
294BBA5C C10C2853 1AD329AD F3A9CE31 8EFF78FA 13BB7EEA 0A75047A D655198F
A32191E5 23B171A6 2BF7268F 76A0CB8B 661A14E7 44CAC7B2 F1A03A95 9A1EB08F
D96D0203 010001A3 79307730 0F060355 1D130101 FF040530 030101FF 30240603
551D1104 1D301B82 19636973 636F2E70 756D7069 6E746567 72617469 6F6E2E63
6F6D301F 0603551D 23041830 1680140B 13ADB594 B89C4F05 C0B72FC3 2390C14F
1ABACA30 1D060355 1D0E0416 04140B13 ADB594B8 9C4F05C0 B72FC323 90C14F1A
BACA300D 06092A86 4886F70D 01010405 00038181 009E75FC 979F7E08 0933F317
14CE97BC 8DAEBF9A 2247BBA0 EB732731 9E39D2E9 6D803CCF AE777615 0085C8F5
D56C4AB0 B0C33C4B FD039BBD 805DAC74 E994863E A38C09B1 1A74FF9B 83E4C581
74745296 37D75415 06642C49 2B27ACCC 6EF41E4E 2F3D5361 C18BB6AA D91EE457
213E75F2 E86D685E F4DD1E52 54106E9F 1AD873FF FB
quit
username xxx privilege 15 secret 5 !
!
!
bridge irb
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description $FW_OUTSIDE$$ETH-WAN$$ES_WAN$
ip address 216.164.160.226 255.255.255.224
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
!
interface Dot11Radio0
no ip address
!
ssid PIIWNET2
authentication open
guest-mode
!
speed basic-1.0 basic-2.0 basic-5.5 basic-6.0 basic-9.0 basic-11.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0
station-role root
no dot11 extension aironet
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$FW_INSIDE$
no ip address
ip tcp adjust-mss 1452
bridge-group 1
!
interface BVI1
description $ES_LAN$
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1412
!
ip classless
ip route 0.0.0.0 0.0.0.0 FastEthernet4
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat pool VONAGE 192.168.1.101 192.168.1.101 netmask 255.255.255.0 type rotary
ip nat inside source list 100 interface FastEthernet4 overload
ip nat inside source static tcp 192.168.1.100 21 216.164.160.226 21 extendable
ip nat inside source static tcp 192.168.1.100 25 216.164.160.226 25 extendable
ip nat inside source static tcp 192.168.1.100 1352 216.164.160.226 1352 extendable
ip nat inside source static tcp 192.168.1.100 5631 216.164.160.226 5631 extendable
ip nat inside source static tcp 192.168.1.100 5632 216.164.160.226 5632 extendable
ip nat inside destination list 102 pool VONAGE
ip nat inside destination list 103 pool VONAGE
!
logging trap debugging
access-list 100 remark SDM_ACL Category=2
access-list 100 permit ip 192.168.1.0 0.0.0.255 any
access-list 102 permit udp any any range 10000 20000
access-list 103 permit udp any any range 5060 5061
no cdp run
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
banner login ^CAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!^C
!
line con 0
login local
no modem enable
transport output telnet
line aux 0
login local
transport output telnet
line vty 0 4
privilege level 15
login local
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end

by netman1958

I've looked through the config you posted and nothing jumps out at me. I don't think you can connect your Vonage device directly to the internet as it looks like he has a static IP from his ISP and I don't think you can configure a static IP on the Vonage device. It would be helpful to substitute another router for the Cisco though to make sure we're working on the right thing.

Aside from substituting another router, something you can check is:
(1) run the "show interfaces" command and look for errors. The output for each interface will look like this:
*************************************
Cisco-831#sh int
FastEthernet1 is up, line protocol is up
Hardware is FastEthernet, address is 0000.0000.0000 (bia 0000.0000.0000)
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Auto-duplex, Auto Speed, 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/0 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
41558 packets input, 0 bytes
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog
0 input packets with dribble condition detected
11434 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out

Take a look at that and if you can substitute the Cisco router with another, post the results.

Netman

by netman1958

I would suggest putting the cisco back in place and clearing the interface counters then try using the vonage service and check the the interface counters to see if you are getting a lot of interface errors. You may have a mismatch in the speed/duplex settings between the vonage device and the router.

To clear the counters:
Router#clear counters
(it will ask you to confirm)

To check for errors after you use vonage:
Router#show interfaces

Sample output:
Router-831#sh int
FastEthernet1 is up, line protocol is up
Hardware is FastEthernet, address is 0000.0000.0000 (bia 0000.0000.000
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Auto-duplex, Auto Speed, 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/0 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
30416 packets input, 0 bytes
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog
0 input packets with dribble condition detected
57323 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier

This discussion is closed to new replies.