NAT on SRP527W (distant)

Similar Questions

• Nat SRP527W-U problem

  Hello

  I have nat rules for the troubled peripheral parameter SRP527W-U with the latest firmware 1.2.4 (003). The latest firmware 1.2.4 introduced the ability to create rules specific nat through "ACL policy rules. I try to use this 'new' not available in older versions to get my network configuration made. The configuration I want to do is to have two vlan different. In the vlan1 I want nat point_to_point interface and PC in the vlan2 I want to use Tar so each computer will be accessible via the public ip address.

  I configured two different PVC on the device we are going to say:

  ADSL_PVC0:

  Encapsulation: PAI

  multiplexing: LLC

  type of QoS: UBR

  Automatic detection VPI/VCI: disable

  virtual circuit VPI:8 VCI:35

  IP settings:

  IP: 2.2.2.2 (it isn't my real ip address that's just an example)

  subnet mask: 255.255.255.252

  Gateway: 2.2.2.1

  MTU: automatic

  ADSL_PVC1:

  Encapsulation: PPPoA

  multiplexing: VC

  type of QoS: UBR

  Automatic detection VPI/VCI: disable

  virtual circuit VPI:8 VCI:40

  PPPoA settings:

  user name: [email protected] / * /

  past: xxxxxxx

  connection: keep alive

  MTU: automatic

  in the Internet_setup_menu, I chose:

  Default system via ADSL_PVC0 route

  voice by default ADSL_PVC1 road

  After that I enabled under menu interface_setup-> LAN-> VLAN_settings two different VLANS:

  vlan1 (default vlan):

  private_lan:

  ID: 1

  subscription_type: DHCP_server_pool

  DHCP pool: DHCPRule_1 (VLAN1)

  voice: off

  Members: LAN_port1, LAN_port3, LAN_port4, SSID1

  VLAN2 (vlan public):

  public:

  ID: 2

  subscription_type: DHCP_server_pool

  DHCP pool: DHCPRule_2_public_ip (VLAN2)

  voice: off

  Members: LAN_port2, SSID2

  and I put two different rules of the DHCP:

  DHCPRule_1

  VLAN 1

  ip address local address/subnet 192.168.1.1/24

  mode DHCP: dhcp server

  GW: 192.168.1.1

  DNS proxy: enabled

  DHCPRule_2_public_ip

  VLAN 2

  local ip address/subnet 3.3.3.1/27

  mode DHCP: dhcp server

  GW: 3.3.3.1

  DNS proxy: disabled

  DNS1: 8.8.8.8

  After that, I put under menu network_setup-> nat-> global_nat:

  address translation:

  NAT: disabled

  Instead, I added this policy under nat_bypass:

  policy nat_lan

  activated: Yes

  inside the interface: vlan1

  outside interface: ADSL_PVC0

  IP address: 2.2.2.2/30

  If I try to join a pc on the lan port 1 I am able to get the ip via DHCPRule_1 configuration I can ping 192.168.1.1 gw but I'm not able to ping 8.8.8.8.

  If I try to join a pc on the lan port 2 I am able to get the ip via DHCPRule_2_public_ip configuration I ping 3.3.3.1 gw and I am ABLE to ping 8.8.8.8 and safe surfing on the web.

  Side wan I am able to reach the router via the ip address different pubblic two assigned to the PVC ADSL_PVC0, ADSL_PVC1

  If I try to activate the nat under global_nat of course, I am able to browse the web, and the device uses the public ip address of the pvc ADSL_PVC0 NAT 'myself. "

  I tried configuration multiple times and I tried to apply many different configurations "flavor", but I'm still having trouble getting the configuration made. From my point of view, there is some sort of bug related to nat or something missing in this configuration.

  Any help will be really appreciated.

  Thanks in advance for your answer.

  Hi Paolo,.

  The default mode of operation for the RPS is to have active NAT.  If the global NAT setting is disabled, then the RPS will run in mode routing only (no NAT never).

  For your configuration, leave the global NAT setting as active and create a rule to bypass NAT for traffic in VLAN 2 (effectively ensure that this traffic is routed and not translated).

  Rules-based routing policy allows you to set your local traffic PVC must use.

  Hope that helps.

  Andy

• [SRP527w] NAT Traversal unavailable options VPN!

  Hello

  I'm so disappointed to find such a light and incomplete VPN on the SRP527w menu.

  Cisco certified network engineer, I test because my company needs about twenty ADSL + Router 3G backup and Cisco seems to offer the best solution.

  We must create a VPN in 3G if the ADSL link fails. Unfortunately, access 3G in France are routed through a large private network before you get to the Internet. This isn't a question for one of our routers Zyxel, that include the feature NAT Traversal (or NAT - T). But with this Cisco, it is impossible to traffic through the VPN.

  Please tell me that this feature should be included in the next version of the firmware!

  Kind regards

  Gaultier

  Hello

  Yes, late NAT - T is included in MR3.  (Unfortunately end NAT - T missed this version, but will be in the next).

  Kind regards

  Andy

• VPN - SRP527W <>Cisco 857 established but no tx fraffic side SRP

  I have now established between SRP527w and cisco 857 ACE, but if I ping from a multitude of Cisco to a host on the side of the PRS I get only rx traffic in the tunnel, the stats keep tx 0 and ping is not answered.

  My tunnel is to send a voice call in IPSEC tunnel keeping DSCP bits, it communicates vlan voice SRP with Cisco lan.

  I have the SRP 2 VLAN:

  1 vlan for data on ports 1, 2, and 4

  1 voice vlan ports 1,2,3,4.

  I connect a netbook to port 3 and I can connect to the internet, but I can't reach by ping across the tunnel

  Perhaps the traffic of the vlan is voice natted with the ip address of data vlan?

  I need all traffic must go through the tunnel without being natted on the cisco side I have a policy to avoid the nat but don't know if SRP have no problem about it too.

  All gateways are ok

  Any idea greatly appreciated, thank you very much

  Hi, manual,.

  The RPS not NAT via the tunnel, which shouldn't be a problem.

  You try to ping a client in the remote subnet, or IP address to the VLAN RPS at the other end of the tunnel?  (Could you try both please?)

  See you soon

  Andy

• Problem creating a VPN IPSec with SRP527W

  Hello.

  I have a Setup like this:

  192.168.15.0/24 SRP527W <->internet <->ROUTER [172.16.16.1] <1:1 nat="">pfSense (raccoon vpn server) [172.16.16.2] 192.168.55.0/24

  I set up a VPN between the SRP and pfsense connection but the connection is not established because that timeout of the phase 1. According to racoon on the remote side does not.

  Before that, I've properly established a VPN between the SRP and another box of pfsense, but with a public IP address. The same host, I have an another vpn to the pfsense box (172.16.16.1) works correctly.

  These parameters of the PRS:

  IKE policy:

  Exchange mode: aggressive

  Permit ID: manual

  Remote ID: 172.16.16.2

  Encryption: 3DES

  Authentication: MD5

  DH: Group 2

  PSK: mysharedkey

  DPD: disabled

  IPSec policy:

  Policy type: police car

  Remote end point: IP ADDRESS

  IP: 172.16.16.2

  Life expectancy: 7800

  Set local subnet and remote according to the above (192.168.x.x) Network Setup.

  How can I check what is the problem? I struggled for several hours now and have failed to go out again! Any help really welcome!

  Thank you

  Lorenzo,

  The router to 172.16.16.1 allows all traffic to the pfsense VPN server when specific NAT is enabled or you have create access rules? My guess is that the router is blocking the traffic.

  -Marty

• [Solved] RV082 - SRP527W site-to-site VPN - routing table?

  Hello

  I am trying to create a VPN IPSEC link between 2 offices. The VPN connection is created, and I can connect but only one way.

  Customers in the Office B seems to have a routing problem. Can you help me?

  Details :

  Office:

  -Router SRP527W.

  -Network client: 192.168.0.0 / 24

  -Internal address: 192.168.0.254 / 24

  B office:

  -RV082 router (behind another router)

  -Network client: 192.168.6.0 / 24

  -Internal address: 192.168.6.253 / 24

  -Internal address that goes to the Router 1: 192.168.5.253

  internal address of the Router - 1: 192.168.5.254

  Page layout:

  Office---> SRP527W---> INTERNET<----- global="" router=""><------ rv082="">< office="">

  192.168.0.254 192.168.5.254 5,253 6.254

  Details VPN:

  Office:

  -remote type SUBNET = 192.168.6.0 group / 24

  -local group = SUBNET 192.168.0.0/24

  -Address ID = 82.127.XXX.XXX

  B office:

  -remote type = SUBNET 192.168.0.0/24 Group

  -local group = SUBNET 192.168.6.0 / 24

  -IP address = 192.168.5.253 (accessed from the Internet through the 1st router with the IP 37.1.XXX.XXX)

  Facts:

  A desktop, I can ping everything in 6.0 addresses.

  Office B, I cannot ping anything in 0.0 subnet addresses. The router itself with the diagnostic page, works of ping 192.168.0.1? But no other ping. Curious...

  The desktop computer B routing table shows the following:

  Active routes:

  Destination network mask network Adr. Gateway Adr. interface metric

  0.0.0.0 0.0.0.0 192.168.6.253 192.168.6.10 10

  127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1

  192.168.6.0 255.255.255.0 192.168.6.10 192.168.6.10 10

  192.168.6.10 255.255.255.255 127.0.0.1 127.0.0.1 10

  192.168.6.255 255.255.255.255 192.168.6.10 192.168.6.10 10

  224.0.0.0 240.0.0.0 192.168.6.10 192.168.6.10 10

  255.255.255.255 255.255.255.255 192.168.6.10 192.168.6.10 1

  255.255.255.255 255.255.255.255 192.168.6.10 3 1

  255.255.255.255 255.255.255.255 192.168.6.10 1 40005

  Default gateway: 192.168.6.253

  ===========================================================================

  Persistent routes:

  None

  Tracert from computers to Office B shows that the packages have arrived at 192.168.6.253, and then it never achieved anything.

  The problem is related to the architecture of Office B?

  See the files attached to a layout of Office B and the routing of the router table to Office B.

  Thank you.

  Enable NAT - T on the RPS and configure the remote ID as 192.168.5.253 in the IKE policy.

  Not sure about the RV and if supporting NAT - T.  It can automatically detect the NAT - T, or need to be configured (in this case, you configure the local identification)

  Andy.

• Application of VPN S2S (with NAT)

  Hello experts,

  ASA (8.2) and standard Site 2 Site Internet access related configs.

  Outside: 1.1.1.1/24-> peer IP VPN S2S.

  Inside: Pvt subnets

  Standard "Nat 0' orders and crypto ACL for our remote offices, local networks with IP whp program.

  Requirement:

  Need to connect the PC to external clients (3.3.3.3 & 4.4.4.4) on tcp/443 via vpn S2S on our LAN. Client only accepts only the host with public IPs.

  I need NAT to my internal IP to the public IP say 1.1.1.2 and establish the VPN tunnel between 1.1.1.1-> PRi Client-side & secondary IPs (Cisco router).

  (without losing connectivity to remote offices). No policy NAT work here?

  ex:

  My Intern: 10.0.0.0/8 and 192.168.0.0/16
  Assigned IP available for NAT (some time to connect to the client only): 1.1.1.5

  External client LAN IPs: 3.3.3.3 & 4.4.4.4

  PAT: permit TOCLIENT object-group MYLAN object-group CUSTOMER LAN ip extended access-list

  NAT (inside) 5-list of access TOCLIENT

  5 1.1.1.5 (outside) global
      
   Crypto: tcp host 1.1.1.5 allowed extended CRYPTO access list object-group CUSTOMER LAN eq 443

  Outsidemap 1 crypto card matches the address CRYPTO
   
  Customer will undertake to peer with IP 1.1.1.1 only.

  Do I need a ' Nat 0' configs here?

  Also, for the specifications of the phase 2, it is not transform-set options gives. Info given was

  Phase2: AH: people with mobility reduced, life: 3 600 s, PFS: disabled, LZS Compression: disabled.
  This works with options of the phase 2?

  Thanks in advance

  MS

  Hello

  «Existing NAT (inside) 1 & global (outside) does not interfere with NAT 5 when users try to reach the ClientLAN.»

  Your inside nat index is '1', while the dynamic policy-nat is index '5 '.

  "" For the phase 2 in general, we define Crypto ipsec transform-set TEST ".

  Sure, the remote tunnel peers even accept transform set, everything you put up with the example below and distant homologous put the same tunnel.

  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

  "In this scenario, no need to define any what and just add empty transform don't set statement under card crypto?

  No you need a defined transformation.

  "3. If we want to limit the destination port 443, I need to use separate VPN filters?

  That's right, use a vpn-filter.

  "4. we have several phase 1 configs, but wanted to use AES256 & DH5 (new policy)"... for s2s, these options work fine. ""

  Of course, you have set the phase 1, as required.

  Thank you

  Rizwan James

• Disorder of SRP527W forming the VPN with 1841

  I'm currently trying to set up a site to site VPN between a SRP527W and a Cisco 1841 but am not negotiate a connection at level 1.  The isakmp seems fails with the formidable MM_NO_STATE message in the debug output on the 1841 crypto isakmp.  No matter what are the parameters to be set on the SRP527W it seems to me, I can't negotiate a connection when the parameters of mirroring on the 1841.  The only variable I can think of that 'may' be different between the two (PSK, group Diffie-Hellman encryption type) is the association of life related to the isakmp parameter.  While you can set on the 1841 isakmp policy, there nowhere on the GUI of SRP527W it can be defined; at least as far as I can tell.  I have tried to change the types of AES encryption, THE and 3DES variations (corresponding to both ends) but continue to get errors MM_NO_STATE as by the isakmp debug output below:

  6 Dec 14:40:20 AEDT: ISAKMP: ke received message (1/1)

  6 Dec 14:40:20 AEDT: ISAKMP: (0:0:N / A:0): THE application profile is (NULL)

  6 Dec 14:40:20 AEDT: ISAKMP: created a struct to peer, peer port 500

  6 Dec 14:40:20 AEDT: ISAKMP: new position created post = 0x635C57B0 peer_handle = 0x8000003E

  6 Dec 14:40:20 AEDT: ISAKMP: lock struct 0x635C57B0, refcount IKE peer 1 for isakmp_initiator

  6 Dec 14:40:20 AEDT: ISAKMP: 500 local port, remote port 500

  6 Dec 14:40:20 AEDT: ISAKMP: set new node 0 to QM_IDLE

  6 Dec 14:40:20 AEDT: ISAKMP: find a dup her to the tree during the isadb_insert his 62EB7888 = call BVA

  6 Dec 14:40:20 AEDT: ISAKMP: (0:0:N / A:0): cannot start aggressive mode, try the main mode.

  6 Dec 14:40:20 AEDT: ISAKMP: (0:0:N / A:0): pair found pre-shared key matching 203.217.8.56

  6 Dec 14:40:20 AEDT: ISAKMP: (0:0:N / A:0): built the seller-07 ID NAT - t

  6 Dec 14:40:20 AEDT: ISAKMP: (0:0:N / A:0): built of NAT - T of the seller-03 ID

  6 Dec 14:40:20 AEDT: ISAKMP: (0:0:N / A:0): built the seller-02 ID NAT - t

  6 Dec 14:40:20 AEDT: ISAKMP: (0:0:N / A:0): entry = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM

  6 Dec 14:40:20 AEDT: ISAKMP: (0:0:N / A:0): former State = new State IKE_READY = IKE_I_MM1

  6 Dec 14:40:20 AEDT: ISAKMP: (0:0:N / A:0): early changes of Main Mode

  6 Dec 14:40:20 AEDT: ISAKMP: (0:0:N / A:0): package my_port 500 peer_port 500 (I) sending MM_NO_STATE

  6 Dec 14:40:30 AEDT: ISAKMP: (0:0:N / A:0): retransmission phase 1 MM_NO_STATE...

  6 Dec 14:40:30 AEDT: ISAKMP (0:0): increment the count of errors on his, try 1 5: retransmit the phase 1

  6 Dec 14:40:30 AEDT: ISAKMP: (0:0:N / A:0): retransmission phase 1 MM_NO_STATE

  Is there something that I am on here or are there compatibility problems with certain types of encryption / settings of config trying to implement a VPN site to site with a 1841?  Incidentally, here is the 1841 configuration excerpt, I'm trying to use:

  crypto ISAKMP policy 10

  BA 3des! have also tried aes at both ends too

  preshared authentication

  Group 2! have you tried the Group 1 on both ends too

  life 43200! have also tried to remove this

  ISAKMP crypto key address

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac RMCG-RFC! have tried many variations here too

  !

  11 RMCG-RFC ipsec-isakmp crypto map

  defined by peers

  security-association kilobytes 2000000 of life value

  Set security-association second life 7800! matches at the end of config IPSEC SRP527W

  game of transformation-RMCG-RFC

  the pfs group2 value! have also tried disabling PFS at both ends

  match address VPN

  QoS before filing

  !

  list of IP - VPN access scope

  ip licensing 10.0.1.0 0.0.0.255 192.15.0 0.0.0.255

  !

  int dialer1

  card crypto RMCG-RFC

  I am at a loss here and if someone could offer suggestions, I would be very grateful.

  Sorry for the comment to end here.

  You can collect a configuration readable the PRS in XML, by collecting the following: http://192.168.15.1/admin/config.xml&xuser=admin&xpassword=.  The backup file is a binary image that is really intended for the recovery of the aircraft.

  Where you can make any progress by opening a case of pension?

  I just tried a configuration similar to the following:

  SRP521W (1.01.19)-> IPSec / IKE-> Cisco870 (15.1 (1) T)

  Who works with the config you list above.

  What version of firmware you are using with the RPS?  If you need a copy of 1.1.19 before it is displayed in a few weeks, please let me know.

  For reference, here's the IOS configuration I used:

  crypto ISAKMP policy 1
  BA 3des
  preshared authentication
  Group 2
  lifetime 28800
  KEY SECRET key crypto isakmp 192.168.200.162 address
  !
  Crypto ipsec transform-set esp-3des esp-sha-hmac SETNAME
  !
  crypto map CISCO ipsec-isakmp 1
  defined by peer 192.168.200.162
  game of transformation-SETNAME
  PFS group2 Set
  match address 110
  !
  interface FastEthernet4
  IP 192.168.200.146
  CISCO crypto card
  !
  interface Vlan1
  IP 192.168.9.1 255.255.255.0
  !
  access-list 110 permit ip 192.168.9.0 0.0.0.255 192.168.15.0 0.0.0.255

  SRP Configs are:

  

  

  Hope that helps.

  Andy

• How can I change the base station Airport of NAT mode?

  I'm trying to set up an Airport base station and stuck because I have the following message is displayed, but no idea how do what he asks...

  Status is showing as Double NAT and then asking me to move on to the base station in bridge DHCP/NAT mode.

  But where do I do this?

  Thank you

  It can be difficult to get the router to bridge sometimes... but if all goes well... Click on the airport icon in airport utility and then click on edit.

  

  Go to the network tab and change DHCP and NAT to bridge.

  

  Click Update at the bottom of the page... Then, everything should be good.

  If you are having problems follow these steps.

  Reset factory airport and then do a manual installation. I recommend that you connect with ethernet which is much more reliable, but your MBPr is not the most important network port that exists... Although there is a bolt of lightning at low cost for the ethernet card.

• The settings DHCP Airport extreme &amp; NAT - cannot change default of NAT IPs?

  Hello

  I'm trying to configure Airport extreme, the most convenient to use for our office.

  Our Office IP is 10.255.x.x

  When I'm trying to Setup DHCP and NAT, in NAT options, there is only 10.0.x.x, 172.16.x.x and 192.168.x.x

  How can I get NAT to have 10.255.x.x?

  Without the NAT settings, I can not get this Airport Extreme to assign valid IP addresses and so unnecessary

  Sorry, but Apple will only accept the 10.0.x.x addresses to be assigned by the AirPort Extreme.

• NAT with Snow Leopard issue

  For the poster who will say "Google is your friend", no it is not, or I wouldn't be here.

  I tried for a while now to solve the only problem I have with Snow Leopard Server.

  MySql has fallen lion and, apparently, no one knows how to use postgrl so I installed MySql and plundered with her for a few hours to get this working.  There were various other issues with Lion.  Finally, I went to Yosemite.  Hey Apple, where is the GUI?  Then at el Capitan and finally tried Sierra (no server app at all yet).

  For me, each 'step-up' taking things and running weaker than the last.

  Welcome to Snow Leopard.  I'll stick with it for a while to come.

  The only problem I have with Snow Leopard, it's that when it restarts, the NAT will not start upward.  Other than that, it does a magnificent job to maintain my home network.  I searched high and low for an answer without success.  A few posters who have addressed this problem specifically here never got a response.

  As this seems to be about three years or more, since this question was asked and it seems that some have migrated to the SLS, I was wondering if anyone has found a solution.

  As it is now, as soon as there is a need to reboot, I just disable the NAT service, restart and turn it back on.  In the case of a failure of current (longer than the inverter can maintain) or just a random crash, I have to kill the firewall and NAT then the configuration of the gateway of new service that requires fixing the various omissions and errors and I'm good to go again.

  Any help would be greatly appreciated.

  You have posted in the forum of Snow Leopard Client.  I ask that to move this post.  In the meantime, you can see the various forums about this trick:

  http://discussions.Apple.com/docs/doc-2463

• Garage double NAT &amp; DHCP - bridge Possible issue error

  Help...

  So it's my game on a yacht...

  I have a MacMini (run bootcamp Windows 7 Pro), so actually it's a PC.

  • I use internal WiFi adapter of the MacMini to get my internet connection of various different Marina I could stay in
  • I then share the connection with the internal LAN adapter WiFi adapter WiFi
  • This allows me to share the WiFi port with other devices on the yacht

  Then I have an AirPort Extreme-

  • I then run an Ethernet on the MacMini Port CAT6 cable
  • on port WAN on AirPort Extreme
  • AirPort Extreme now has an internet connection (from the marina, WiFi)
  • I then activated the WiFi on AirPort Extreme to create a WiFi network on the yacht
  • and it gets its internet connection from the WAN port, which comes in turn the MacMini, which in turn comes from the Marina WiFi

  Connected to the AirPort Extreme are-

  -iPhones, iPads, MacBook, Apple TV, Smart TV, etc etc.

  -Some devices are connected using the LAN ports and AirPort Extreme cable

  -Some devices are connected by WiFi using WiFi airports

  I want DHCP to be handled by the AirPort Extreme-, mode I set as "DHCP and NAT".

  What is the problem-

  • AirPort Extreme shows an error
  • "double NAT and DHCP.
  • and suggested I turn it in Bridge mode
  • but I don't want to do that

  Any thoughts?

  Concerning

  Tim

  Would help if we could get the exact message you see.  You will probably need to change the DHCP-range on the AirPort Extreme to a different value, and then use the option 'Ignore' the Double NAT then the airport will show a green light.

  You will have to live with the Double NAT if you want AirPort Extreme to act as a remote router that provides a private network.

• poor iPhone fuzzy of SE distorted distant sound

  Actually talking on the phone with receiver in the ear of the other person sounds dull and distant, even the ring on outgoing call is blurred and the clips. There as a blur behind each heard Word. Consistent on every call made for almost 2 weeks straight. Does anyone know a fix? Brand new SE 64 GB with the last update. Have tested with several people and have tried mono, sound cancellation etc. Even when I get a text while talking, the sound of which is still distant. Tried 2 different cases and no case, the same thing.

  Try to restore to factory settings and test without any backup data. If you still encounter these problems, contact Apple support for repair, your camera is still under warranty.

  Use iTunes to restore your device to factory settings - Support Apple iOS

  Apple iPhone - contact Support - support

• Strange double NAT, although there is only a single router

  My ISP (RCN) changed my modem at a speed greater than one.  Although a router built-in, I told them that I didn't use their router, only my Time Capsule, so they disabled.  However, my Time Capsule kept gives me an error message Double NAT and amber flashing against Green, even though everything seemed to work (wireless and wired) and said that I should switch DHCP and NAT to bridge mode.  Correction of the error, but I do not understand what caused the Double NAT if there is only a single router.  The ISP Technical Support people confirmed their control center is not the router feature on in the new modem, I ask.  They also said that their network supports DHCP, although they have other who use the Bridge Mode, although they do not support.   And they knew nothing about it, he said to ask Apple.  They also offered to switch back, but because this modem is faster at the same price.  (He called a bypass gateway 3-in-1).  Many people online told not to use his router, it's why I unplug it and only use the time Capsule.

  So if someone can give me feedback, I'd appreciate it. I must:

  1. keep running the new modem and my Time Capsule in Bridge Mode.

  2. run the new modem in DHCP mode, as they put in place and do not worry Time Capsule seeing amber / flashing Double NAT error.

  3 swap back to the previous modem, which was 50 Mbps against it with (theoretically) 155 Mbit/s (it's only works in 50-70).

  I'm not really all that, but I hope that one of you maybe.  Thank you!!!

  Although a router built-in, I told them that I didn't use their router, only my Time Capsule, so they disabled.

  ISPS often make the mistake of simply turn off the radio on a modem/router...which service does not disable the router function of the device. You still have a wired router when ISPS are making this mistake.

  However, my Time Capsule kept giving me an error message Double NAT

  This confirms again that the ISP has not disabled the function of the router to your modem/router.  On some modems/routers or gateways, it is not possible to get the device to act as a simple modem.

  The ISP Technical Support people confirmed their control center is not the router feature on in the new modem, I ask.

  The fact remains that you wouldn't see a Double NAT error unless the ISP system acted as a router... Despite what people of PSI say. You may need to get a 2nd or 3rd person-level support, who knows what they are doing.

  1. keep running the new modem and my Time Capsule in Bridge Mode.

  Yes, if you want to avoid the mistake of NAT Double... what you are doing. But, the time Capsule will not be your router.  The device of the ISP will be.

  2. run the new modem in DHCP mode, as they put in place and do not worry Time Capsule seeing amber / flashing Double NAT error.

  This only if you willing to accept the fact that the ISP did not correctly change your gateway to make it work as a simple modem only.  You might be able to get away with a Double NAT error on a simple network, but there is no reason more complicate things with a misconfiguration in unless whether there are a few reasons to do it and it can't be avoided.

  3 swap back to the previous modem, which was 50 Mbps against it with (theoretically) 155 Mbit/s (it's only works in 50-70).

  Your decision if you want to run a simple modem with time Capsule, or accept the fact that the time Capsule won't have your router when it is configured in Bridge Mode, or you see a Double NAT error on the network.

  If it were me, I would go back to what I know will work properly... the simple modem and time Capsule as the router.

• How can I enable UPnP (Universal Plug and Play) or NAT - PMP (NAT Port Mapping Protocol) Protocol?

  I'm trying to set up the screen Edovia and they say that I need to enable UPnP (Universal Plug and Play) or NAT - PMP (NAT Port Mapping Protocol) Protocol.

  How can I do this?

  In Airport utility. The form is in your router.