Problem with NAT 1:1 translation

[adam]

Hello Everyone,

Recently I have discovered quite strange problem with NAT 1:1 translation.
It will only translate the public IP addresses up to a certain IP and every address beyond that range simply won't work.
It got stuck on the IP # 30 and up assigned to the main ethernet adapter facing the internet.
Since we are using proxy, the screwed range gets only port 80 and nothing else.
NAT 1:1 syntax is OK, I can ping the problematic public addresses from within our network, however while trying to ping them from the internet I get -Destination host unreachable- reply from the router but not Star OS itself.
I am suspecting that the router itself might be the culprit, but so far I wasnt able to find anything obvious in the config that would cause this kind of behavior. Our assigned public range is specified with the /25 net mask which obviously supports more than 30 addresses.
What could possibly cause this problem?

Any suggestions will be greatly appreciated.

Thank you,
Adam

[lonnie]

I would suspect that you have the /25 broken into some smaller chunks in the router. You have to be able to ping the StarOS box, so your efforts have to be on the router ahead of it to figure out what it is missing.

[adam]

I would suspect that you have the /25 broken into some smaller chunks in the router. You have to be able to ping the StarOS box, so your efforts have to be on the router ahead of it to figure out what it is missing.

Lonnie,

Would you think that router could have possible limitation problem with more than 30 IPs originating from single hardware address (star OS).
I am trying to think of anything that could lead me towards possible solution. I checked all the filters and firewalls, there's nothing enabled that could cause this behavior.
We are using Lucent Pipeline 130, so far without any problems.

Thanks again for your support.

Adam

[lonnie]

The addresses do not originate from the StarOS box. The Lucent Router is in control and the StarOS box never sees the traffic from the extra IP addresses.

You should run a traffic monitor and see if the pings are getting there but the reply is lost. If you see the pings then at least the Lucent is p[assing them on as it is supposed to do.

You can also do a tcpdump with command line of
not port 22 and host aaa.bbb.ccc.ddd

where aaa.bbb.ccc.ddd is the IP you wish to monitor.