1

I'm trying to let computer from Internet to get access to the external DMZ(Server Mail and Server FTP) so I translated the address of the internet network like :

ip nat inside source static 172.16.1.4 209.165.201.1 
ip nat inside source static 172.16.1.3 209.165.201.2

but it doesn't work, i always got :

Reply from 200.14.5.1: Destination host unreachable. Reply from 200.14.5.1: Destination host unreachable. Reply from 200.14.5.1: Destination host unreachable. Reply from 200.14.5.1: Destination host unreachable.

Ping statistics for 209.165.201.1: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

Improve this question

2 Answers 2

Reset to default
1

Your outside interface will block anything destined for your server addresses. The ACL on that interface only specifically allows traffic to hosts 199.14.5.1, 199.14.5.10, and 199.14.5.11.

Remember, an ACL will have an implicit deny all at the end, so you are denying all other inbound traffic.

Improve this answer
2
  • So i should add permission access-list 101 permit ip any host 209.165.201.1 and access-list 101 permit ip any host 209.165.201.2 ?
    – google
    Commented Jul 3, 2016 at 2:35
  • If you want to be able to access the servers from the outside, you will need to permit traffic destined to the 209.165.201.1 and 209.165.201.2 addresses to enter the interface.
    – Ron Maupin ♦
    Commented Jul 3, 2016 at 2:38
0

You need to put in a permit any on your standard list and if you need more granular information then use an extended list four specific ports.

Improve this answer
1
  • I just add these 2 and and it worked access-list 101 permit ip any host 209.165.201.1 and access-list 101 permit ip any host 209.165.201.2
    – google
    Commented Jul 3, 2016 at 2:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.