Static NAT problem preventing internet access from LAN

Question

Recently access outbound from all my LAN servers has stopped working. I have a 7206VXR running 12.3(4r)T3 which has a LAN interface using RFC 1918 IP addressing, and a WAN connection to our ISP using static routing. I'm trying to see if there is an error in the config that is causal, or if it's a recent ISP change.

The WAN interface is marked as "ip nat outside", and the LAN interface as "ip nat inside". For this example, let's assume our allocated external IP block is 100.100.100.0/24, which is being routed to our assumed WAN IP of 20.20.20.194.

WAN:

interface GigabitEthernet0/2
  description WAN connection. ISP is 20.20.20.193
  ip address 20.20.20.194 255.255.255.248
  ip access-group 120 in
  ip nat outside
  duplex full
  speed 1000
  media-type rj45
  no negotiation auto
  no keepalive
  no cdp enable
 [...]
ip route 0.0.0.0 0.0.0.0 20.20.20.193

LAN:

interface GigabitEthernet0/3
 description Primary LAN
 ip address 192.168.49.1 255.255.255.0
 ip nat inside
 duplex full
 speed 1000
 media-type rj45
 negotiation auto
 no cdp enable

I have quite a few lines for NAT. Here are a couple (IPs are representative):

ip nat inside source static 192.168.49.10 100.100.100.10
ip nat inside source static 192.168.49.117 100.100.100.117
[...]

And an outbound ACL:

access-list 120 permit ip any any established
access-list 120 permit ip any host 100.100.100.117 eq 80
access-list 120 permit ip any host 100.100.100.117 eq 22
[...]
access-list 120 deny   ip any any

My problem is that I can ssh and access the web server at 100.100.100.117 just fine. However, once I'm ssh'ed in, I can't ping, traceroute or otherwise access anything outside of the LAN.

This was working fine a couple days ago, and no major changes have been made to the config. There was some work done by the ISP on disconnecting an old circuit, but I had already removed the routing for that CCT and the remaining couple NAT lines for it's network (we were running with 2 incoming ISPs).

So the meat of the question is, do I need to do anything else for NAT to work outbound? When this was working, I had made NAT entries in order for Internet access to services on my internal hosts. I could not get out to the WAN from a LAN device unless a NAT entry was there, and instead of creating a translation for every host, I have a proxy host to which the majority of my linux servers use for OS updates, installs, etc. But even on the few hosts that have the direct NAT translation in place, I can't ping, traceroute or otherwise access the Internet.

I'm pretty sure the ISP has done something, but I just wanted to ask the group if anything looks wrong or missing in the relevant pieces of the config I have published.

Thanks.

Answer 1

Could it be that your ACL is picking everything up?

permit ip any any established will allow traffic to go back out after an incoming connection is established, but doesn't permit outbound ICMP (ping or trace route) traffic. You would need to add rules to allow the ICMP traffic.

show access-list will show you which rules are being hit when you try to ping. You can also clear their counters with clear access-list counters or something similar (not in front of a router to test that is the correct command right now).

Answer 2

Basically the nature of traffic flow of internet traffic is outbound .

Internet access required many to one natting policy in place . Outside to inside natting in other words many private IP address nat translation to one public IP address .

Assuming router egress interfàce G0/1

Ensure below mentioned nat translation command is configured and try.

Router(config)# access -list 10 permit 192.168.2.0 255.255.255.0

Assuming LAN subnet is 192.168.2.0/24

Router(config) #ip nat inside souce list 10 interface G0/1 overload