Contents

Mobile IP NAT Detect

Network Address Translation (NAT) allows an organization with nonglobally routable addresses to connect to the Internet by translating those addresses into globally routable address space. Traditional Mobile IP tunneling has been incompatible with NAT. The Mobile IP--NAT Detect feature is a new service on the home agent that allows it to tunnel traffic to Mobile IP clients with private IP addresses behind a NAT-enabled device. The home agent is now capable of detecting a registration request that has traversed a NAT-enabled device and applying a tunnel to reach the Mobile IP client.

Feature Specifications for the Mobile IP: NAT Detect Feature

Feature History

Release

Modification

12.2(13)T

This feature was introduced.

Supported Platforms

See Feature Navigator.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Restrictions for Mobile IP NAT Detect

This feature is supported for mobile nodes using a collocated care-of address only. Mobile nodes using a foreign agent care-of address behind a NAT gateway cannot be detected by the home agent.

How to Configure Mobile IP NAT Detect

Configuring NAT Detect

To configure NAT detect on the home agent, use the following commands:

SUMMARY STEPS

    1.    enable

    2.    configure {terminal | memory | network}

    3.    router mobile

    4.    exit

    5.    ip mobile home-agent [address ip-address][broadcast] [care-of-access access-list] [lifetime number] [nat-detect] [replay seconds] [reverse-tunnel-off] [roam-access access-list] [suppress-unreachable]


DETAILED STEPS
     Command or ActionPurpose
    Step 1 enable


    Example:
    Router> enable
     

    Enables higher privilege levels, such as privileged EXEC mode.

    • Enter your password if prompted.

     
    Step 2 configure {terminal | memory | network}


    Example:
    Router# configure terminal
     

    Enters global configuration mode.

     
    Step 3 router mobile


    Example:
    Router(config)# router mobile
     

    Enables Mobile IP on the router.

     
    Step 4 exit


    Example:
    Router(config-router)# exit
     

    Returns to global configuration mode.

     
    Step 5 ip mobile home-agent [address ip-address][broadcast] [care-of-access access-list] [lifetime number] [nat-detect] [replay seconds] [reverse-tunnel-off] [roam-access access-list] [suppress-unreachable]


    Example:
    Router(config)# ip mobile home-agent nat-detect
     

    Enables home agent services and NAT detect.

     

    Verifying the NAT Detect Configuration

    To verify that the Mobile IP--NAT Detect feature is working, perform the following steps:

    SUMMARY STEPS

      1.    show ip mobile globals

      2.    show ip mobile binding

      3.    show ip mobile traffic


    DETAILED STEPS
       Command or ActionPurpose
      Step 1 show ip mobile globals


      Example:
      Router# show ip mobile globals
       

      Displays global information for mobile agents.

       
      Step 2 show ip mobile binding


      Example:
      Router# show ip mobile binding
       

      Displays the mobility binding table.

       
      Step 3 show ip mobile traffic


      Example:
      Router# show ip mobile traffic
       

      Displays protocol counters.

      • This command will show the number of successful registration requests using NAT detect.

       

      Configuration Examples for Mobile IP NAT Detect

      Home Agent with NAT Detect Example

      In the following example, the home agent can detect registration requests from a mobile node behind a NAT-enabled router. The mobile node will use the NAT inside address as the collocated care-of address used in its registration requests.

      Home Agent

      ip routing 
! 
interface ethernet1 
 ip address 1.0.0.1 255.0.0.0 
! 
interface ethernet2 
 ip address 2.0.0.1 255.0.0.0 
! 
router mobile 
!
router ospf 100 
redistribute mobile subnets metric 1500 
network 1.0.0.0 0.255.255.255 area 0 
network 2.0.0.0 0.255.255.255 area 0 
! 
ip mobile home-agent lifetime 65535 nat-detect replay 255 
ip mobile virtual-network 65.0.0.0 255.0.0.0 
ip mobile host 65.1.1.1 65.1.1.10 virtual-network 65.0.0.0 255.0.0.0 
ip mobile secure host 65.1.1.1 65.1.1.10 spi 100 key hex 12345678123456781234567812345678 
!

      Router Configured with NAT

      ip routing 
! 
interface ethernet2 
 ip address 2.0.0.2 255.0.0.0 
 ip nat outside 
! 
interface e4 
 ip address 4.0.0.1 255.0.0.0 
 ip nat outside 
! 
! Outside address 2.0.0.101 used for any packet coming from inside 4.0.0.101
! 4.0.0.101 is the collocated care-of address used by MN to register
ip nat inside source static 4.0.0.101 2.0.0.101 
router mobile 
! 
router ospf 100 
network 2.0.0.0 0.255.255.255 area 0 
network 4.0.0.0 0.255.255.255 area 0 
!

      Additional References

      For additional information related to the Mobile IP--NAT Detect feature, refer to the following sections:

      Related Documents

      Related Topic

      Document Title

      Mobile IP configuration tasks

      "Configuring Mobile IP" chapter in theCisco IOS IP Configuration Guide,Release 12.2.

      Mobile IP commands

      "Mobile IP Commands" chapter in theCisco IOS IP Command Reference, Volume 1 of 3: Addressing and Services , Release 12.2

      NAT configuration tasks

      "Configuring IP Addressing" chapter in the Cisco IOS IP Configuration Guide,Release 12.2

      NAT commands

      "IP Addressing Commands" chapter in theCisco IOS IP Command Reference, Volume 1 of 3: Addressing and Services , Release 12.2

      Standards

      Standards

      Title

      No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.

      --

      MIBs

      MIBs

      MIBs Link

      No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

      To obtain lists of supported MIBs by platform and Cisco IOS release, and to download MIB modules, go to the Cisco MIB website on Cisco.com at the following URL:

      http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml

      To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

      http:/​/​tools.cisco.com/​ITDIT/​MIBS/​servlet/​index

      If Cisco MIB Locator does not support the MIB information that you need, you can also obtain a list of supported MIBs and download MIBs from the Cisco MIBs page at the following URL:

      http:/​/​www.cisco.com/​public/​sw-center/​netmgmt/​cmtk/​mibs.shtml

      To access Cisco MIB Locator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to cco-locksmith@cisco.com. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions found at this URL:

      http:/​/​www.cisco.com/​register

      RFCs

      RFCs

      Title

      No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.

      --

      Technical Assistance

      Description

      Link

      Technical Assistance Center (TAC) home page, containing 30,000 pages of searchable technical content, including links to products, technologies, solutions, technical tips, tools, and lots more. Registered Cisco.com users can log in from this page to access even more content.

      http:/​/​www.cisco.com/​public/​support/​tac/​home.shtml

      Command Reference

      The following commands are introduced or modified in the feature or features documented in this module. For information about these commands, see the Cisco IOS IP Mobility Command Reference at http://www.cisco.com/en/US/docs/ios/ipmobility/command/reference/imo_book.html. For information about all Cisco IOS commands, go to the Command Lookup Tool at http:/​/​tools.cisco.com/​Support/​CLILookup or to the Cisco IOS Master Commands List .

      • ip mobile home-agent

      • show ip mobile binding

      • show ip mobile globals

      • show ip mobile traffic

      Glossary

      care-of address --The termination point of the tunnel to a mobile node or mobile router. This can be a collocated care-of address, by which the mobile node or mobile router acquires a local address and detunnels its own packets, or a foreign agent care-of address, by which a foreign agent detunnels packets and forwards them to the mobile node or mobile router.


      Note

      Refer to the Internetworking Terms and Acronyms for terms not included in this glossary.

      Mobile IP NAT Detect

      Mobile IP NAT Detect

      Network Address Translation (NAT) allows an organization with nonglobally routable addresses to connect to the Internet by translating those addresses into globally routable address space. Traditional Mobile IP tunneling has been incompatible with NAT. The Mobile IP--NAT Detect feature is a new service on the home agent that allows it to tunnel traffic to Mobile IP clients with private IP addresses behind a NAT-enabled device. The home agent is now capable of detecting a registration request that has traversed a NAT-enabled device and applying a tunnel to reach the Mobile IP client.

      Feature Specifications for the Mobile IP: NAT Detect Feature

      Feature History

      Release

      Modification

      12.2(13)T

      This feature was introduced.

      Supported Platforms

      See Feature Navigator.

      Finding Feature Information

      Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

      Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

      Restrictions for Mobile IP NAT Detect

      This feature is supported for mobile nodes using a collocated care-of address only. Mobile nodes using a foreign agent care-of address behind a NAT gateway cannot be detected by the home agent.

      How to Configure Mobile IP NAT Detect

      Configuring NAT Detect

      To configure NAT detect on the home agent, use the following commands:

      SUMMARY STEPS

        1.    enable

        2.    configure {terminal | memory | network}

        3.    router mobile

        4.    exit

        5.    ip mobile home-agent [address ip-address][broadcast] [care-of-access access-list] [lifetime number] [nat-detect] [replay seconds] [reverse-tunnel-off] [roam-access access-list] [suppress-unreachable]


      DETAILED STEPS
         Command or ActionPurpose
        Step 1 enable


        Example:
        Router> enable
         

        Enables higher privilege levels, such as privileged EXEC mode.

        • Enter your password if prompted.

         
        Step 2 configure {terminal | memory | network}


        Example:
        Router# configure terminal
         

        Enters global configuration mode.

         
        Step 3 router mobile


        Example:
        Router(config)# router mobile
         

        Enables Mobile IP on the router.

         
        Step 4 exit


        Example:
        Router(config-router)# exit
         

        Returns to global configuration mode.

         
        Step 5 ip mobile home-agent [address ip-address][broadcast] [care-of-access access-list] [lifetime number] [nat-detect] [replay seconds] [reverse-tunnel-off] [roam-access access-list] [suppress-unreachable]


        Example:
        Router(config)# ip mobile home-agent nat-detect
         

        Enables home agent services and NAT detect.

         

        Verifying the NAT Detect Configuration

        To verify that the Mobile IP--NAT Detect feature is working, perform the following steps:

        SUMMARY STEPS

          1.    show ip mobile globals

          2.    show ip mobile binding

          3.    show ip mobile traffic


        DETAILED STEPS
           Command or ActionPurpose
          Step 1 show ip mobile globals


          Example:
          Router# show ip mobile globals
           

          Displays global information for mobile agents.

           
          Step 2 show ip mobile binding


          Example:
          Router# show ip mobile binding
           

          Displays the mobility binding table.

           
          Step 3 show ip mobile traffic


          Example:
          Router# show ip mobile traffic
           

          Displays protocol counters.

          • This command will show the number of successful registration requests using NAT detect.

           

          Configuration Examples for Mobile IP NAT Detect

          Home Agent with NAT Detect Example

          In the following example, the home agent can detect registration requests from a mobile node behind a NAT-enabled router. The mobile node will use the NAT inside address as the collocated care-of address used in its registration requests.

          Home Agent

          ip routing 
! 
interface ethernet1 
 ip address 1.0.0.1 255.0.0.0 
! 
interface ethernet2 
 ip address 2.0.0.1 255.0.0.0 
! 
router mobile 
!
router ospf 100 
redistribute mobile subnets metric 1500 
network 1.0.0.0 0.255.255.255 area 0 
network 2.0.0.0 0.255.255.255 area 0 
! 
ip mobile home-agent lifetime 65535 nat-detect replay 255 
ip mobile virtual-network 65.0.0.0 255.0.0.0 
ip mobile host 65.1.1.1 65.1.1.10 virtual-network 65.0.0.0 255.0.0.0 
ip mobile secure host 65.1.1.1 65.1.1.10 spi 100 key hex 12345678123456781234567812345678 
!

          Router Configured with NAT

          ip routing 
! 
interface ethernet2 
 ip address 2.0.0.2 255.0.0.0 
 ip nat outside 
! 
interface e4 
 ip address 4.0.0.1 255.0.0.0 
 ip nat outside 
! 
! Outside address 2.0.0.101 used for any packet coming from inside 4.0.0.101
! 4.0.0.101 is the collocated care-of address used by MN to register
ip nat inside source static 4.0.0.101 2.0.0.101 
router mobile 
! 
router ospf 100 
network 2.0.0.0 0.255.255.255 area 0 
network 4.0.0.0 0.255.255.255 area 0 
!

          Additional References

          For additional information related to the Mobile IP--NAT Detect feature, refer to the following sections:

          Related Documents

          Related Topic

          Document Title

          Mobile IP configuration tasks

          "Configuring Mobile IP" chapter in theCisco IOS IP Configuration Guide,Release 12.2.

          Mobile IP commands

          "Mobile IP Commands" chapter in theCisco IOS IP Command Reference, Volume 1 of 3: Addressing and Services , Release 12.2

          NAT configuration tasks

          "Configuring IP Addressing" chapter in the Cisco IOS IP Configuration Guide,Release 12.2

          NAT commands

          "IP Addressing Commands" chapter in theCisco IOS IP Command Reference, Volume 1 of 3: Addressing and Services , Release 12.2

          Standards

          Standards

          Title

          No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.

          --

          MIBs

          MIBs

          MIBs Link

          No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

          To obtain lists of supported MIBs by platform and Cisco IOS release, and to download MIB modules, go to the Cisco MIB website on Cisco.com at the following URL:

          http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml

          To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

          http:/​/​tools.cisco.com/​ITDIT/​MIBS/​servlet/​index

          If Cisco MIB Locator does not support the MIB information that you need, you can also obtain a list of supported MIBs and download MIBs from the Cisco MIBs page at the following URL:

          http:/​/​www.cisco.com/​public/​sw-center/​netmgmt/​cmtk/​mibs.shtml

          To access Cisco MIB Locator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to cco-locksmith@cisco.com. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions found at this URL:

          http:/​/​www.cisco.com/​register

          RFCs

          RFCs

          Title

          No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.

          --

          Technical Assistance

          Description

          Link

          Technical Assistance Center (TAC) home page, containing 30,000 pages of searchable technical content, including links to products, technologies, solutions, technical tips, tools, and lots more. Registered Cisco.com users can log in from this page to access even more content.

          http:/​/​www.cisco.com/​public/​support/​tac/​home.shtml

          Command Reference

          The following commands are introduced or modified in the feature or features documented in this module. For information about these commands, see the Cisco IOS IP Mobility Command Reference at http://www.cisco.com/en/US/docs/ios/ipmobility/command/reference/imo_book.html. For information about all Cisco IOS commands, go to the Command Lookup Tool at http:/​/​tools.cisco.com/​Support/​CLILookup or to the Cisco IOS Master Commands List .

          • ip mobile home-agent

          • show ip mobile binding

          • show ip mobile globals

          • show ip mobile traffic

          Glossary

          care-of address --The termination point of the tunnel to a mobile node or mobile router. This can be a collocated care-of address, by which the mobile node or mobile router acquires a local address and detunnels its own packets, or a foreign agent care-of address, by which a foreign agent detunnels packets and forwards them to the mobile node or mobile router.


          Note

          Refer to the Internetworking Terms and Acronyms for terms not included in this glossary.