Skip to main content

XBOX Live with Cisco NAT

When you connecting your XBOX 360 to XBOX Live through a CISCO router you are likely to get told that your NAT type is strict. This is because the CISCO routers do not support UPnP like most home routers.

In order to resolve this issue you will need to configure your router to allow certain ports through and create some static NAT entries. Whilst a lot of games will work quite happily with NAT type strict you will notice finding other players for multiplayer matches is very slow. Gears of War 2 however will simply never find any other players if you have NAT type strict.

There are 3 important ports needed for XBOX Live and they are TCP 3074 (used to connect to XBOX live and transfer data i.e. marketplace downloads, new content etc...) UDP 3074 which is used for delay sensitive traffic (multiplayer game sessions use this port) and UDP 88 (which is used for Kerberos. This is how you authenticate to the Microsoft XBOX Live servers)

The first thing you need to do is to create a static NAT entry which maps your XBOX's IP address (which you will need to statically configure) to each of the ports on your external IP.

ip nat inside source static tcp 192.168.3.10 3074 interface Dialer1 3074

ip nat inside source static udp 192.168.3.10 3074 interface Dialer1 3074

ip nat inside source static udp 192.168.3.10 88 interface Dialer1 88

You would think that this would be enough to improve the NAT type but it appears that you also need allow these specific ports on your external ACL like so...

ip access-list extended INTERNET_IN

permit tcp any host x.x.x.x eq 3074

permit udp any host x.x.x.x eq 3074

permit udp any host x.x.x.x eq 88

(Where x.x.x.x is your external IP)

Once you have this configuration in place your XBOX Live will now show a NAT type of moderate. This will allow all games to work with XBOX Live. Most importantly Gears of War 2 will now work so you can get your multiplayer horde fix.

Labels:

Comments

Post a Comment

Popular posts from this blog

Error Message %DUAL-6-NBRINFO: EIGRP-IPv4 34256

If you see the error  %DUAL-6-NBRINFO: EIGRP-IPv4 xxxx  is blocked: not on common subnet then it simply means that there are EIGRP devices sending multicast hellos on an interface which have a different IP Range configured to the receiving router.  160617: .Feb 22 15:11:05.194 GMT: %DUAL-6-NBRINFO: EIGRP-IPv4 34256: Neighbor 17 2.31.253.1 (Vlan43) is blocked: not on common subnet                                                     (172.31.252.1/31) 160618: .Feb 22 15:11:12.770 GMT: %DUAL-6-NBRINFO: EIGRP-IPv4 34256: Neighbor 19 2.168.205.0 (Vlan44) is blocked: not on common subnet (192.168.204.1/31)                                                                                          This is most likely to occur by accident when two subnets are configured on the same VLAN, with EIGRP running on the interface.
Post a Comment
Read more

Moving the SSH port on a CISCO router

If you admin your routers over the internet you probably know you should be using SSH. Telnet being sent in clear text is easily sniffed and your passwords captured. However Cisco routers use the standard TCP port 22 for their SSH service. As soon as you open this up to the world and turn on SSH access logging you will start to see hundreds of IP's connecting to your device and running dictionary attacks against you using standard username and password combinations. The majority of these IP's seem to originate from China or Russia and they find your open port extremely quickly. This is very anoying it fills up your log files with these attacks and uses up your system resources dealing with them. I believe they are simply running scans for any open TCP port 22. For this reason I decided I could cut down the amount of attacks by moving the SSH port to a different number. One thing you should know before we start is that there is no way to actually change the SSH port number o
Post a Comment
Read more

Shutting Cisco 3750 Stackwise ports

Today I came across a customers 3750 switch stack which had a flapping stackwise link. The stackwise link was transitioning up/down around 3 times a second and causing massive issues with connectivity and EIGRP routing for the site. Previously I believed that I would need to physically remove the Stackwise cable in order to restore service by shutting the flapping link. It seems it is possible to shut the Stackwise port from the CLI although it is done from enable mode rather than Configure terminal. The command is.. Switch#switch 1 stack port 1 ? disable Disable stack port enable Enable stack port The first number 1 would indicate the switch number in the stack and the second number 1 after the port is the Stackwise port number you want to shut. Make a note of which switch and port you shut as it will not show up in the config or the show outputs which could prove tricky when you want to reenable it.. You can determine the status of the ports using the command below but not how
Post a Comment
Read more