1

I'm trying to let computer from Internet to get access to the external DMZ(Server Mail and Server FTP) so I translated the address of the internet network like :

ip nat inside source static 172.16.1.4 209.165.201.1 
ip nat inside source static 172.16.1.3 209.165.201.2 

but it doesn't work, i always got :

Reply from 200.14.5.1: Destination host unreachable. Reply from 200.14.5.1: Destination host unreachable. Reply from 200.14.5.1: Destination host unreachable. Reply from 200.14.5.1: Destination host unreachable.

Ping statistics for 209.165.201.1: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

1

Your outside interface will block anything destined for your server addresses. The ACL on that interface only specifically allows traffic to hosts 199.14.5.1, 199.14.5.10, and 199.14.5.11.

Remember, an ACL will have an implicit deny all at the end, so you are denying all other inbound traffic.

  • So i should add permission access-list 101 permit ip any host 209.165.201.1 and access-list 101 permit ip any host 209.165.201.2 ? – google Jul 3 '16 at 2:35
  • If you want to be able to access the servers from the outside, you will need to permit traffic destined to the 209.165.201.1 and 209.165.201.2 addresses to enter the interface. – Ron Maupin Jul 3 '16 at 2:38
0

You need to put in a permit any on your standard list and if you need more granular information then use an extended list four specific ports.

  • I just add these 2 and and it worked access-list 101 permit ip any host 209.165.201.1 and access-list 101 permit ip any host 209.165.201.2 – google Jul 3 '16 at 2:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.