3

I have a Cisco 1841 router with an HWIC-4ESW switchport module attached to it. Fa0/0 is connected to ISP1 and Fa0/1 to ISP2 and both are "ip nat outside", the switchports are in interface Vlan 1, which has an IP address 192.168.0.1/24 and is "ip nat inside". Here is the config. (I have changed the IP addresses for posting here).

Current configuration : 3495 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
!
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.0.1
ip dhcp excluded-address 192.168.0.22
ip dhcp excluded-address 192.168.0.6
ip dhcp excluded-address 192.168.0.5
ip dhcp excluded-address 192.168.0.7
ip dhcp excluded-address 192.168.0.3
ip dhcp excluded-address 192.168.0.101
ip dhcp excluded-address 192.168.0.19
ip dhcp excluded-address 192.168.0.18
ip dhcp excluded-address 192.168.0.23
ip dhcp excluded-address 192.168.0.24
ip dhcp excluded-address 192.168.0.35
ip dhcp excluded-address 192.168.0.17
!
ip dhcp pool HSI
network 192.168.0.0 255.255.255.0
default-router 192.168.0.1
dns-server 1.1.1.1 192.168.0.1 1.1.3.7 1.1.2.233 1.1.2.129 8.8.8.8
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
multilink bundle-name authenticated
!
!
!
!
archive
log config
hidekeys
!
!
!
track 1 rtr 1 reachability
!
!
!
interface FastEthernet0/0
description Primary Route
ip address 1.1.1.165 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet0/1
description Backup Route
ip address 1.1.2.132 255.255.255.128
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet0/0/0
!
interface FastEthernet0/0/1
!
interface FastEthernet0/0/2
!
interface FastEthernet0/0/3
!
interface Vlan1
ip address 192.168.0.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 1.1.1.3 track 1
ip route 0.0.0.0 0.0.0.0 1.1.2.130 3
!
!
ip http server
no ip http secure-server
ip nat inside source list 10 interface FastEthernet0/0 overload
ip nat inside source list 20 interface FastEthernet0/1 overload
ip nat inside source static tcp 192.168.0.22 80 1.1.1.160 80 extendable
ip nat inside source static tcp 192.168.0.6 80 1.1.1.163 80 extendable
ip nat inside source static tcp 192.168.0.5 21 1.1.1.165 21 extendable
ip nat inside source static tcp 192.168.0.5 22 1.1.1.165 22 extendable
ip nat inside source static tcp 192.168.0.5 80 1.1.1.165 80 extendable
ip nat inside source static tcp 192.168.0.7 80 1.1.1.165 83 extendable
ip nat inside source static tcp 192.168.0.3 80 1.1.1.165 86 extendable
ip nat inside source static tcp 192.168.0.101 80 1.1.1.165 87 extendable
ip nat inside source static tcp 192.168.0.19 80 1.1.1.168 80 extendable
ip nat inside source static tcp 192.168.0.18 80 1.1.1.169 80 extendable
ip nat inside source static tcp 192.168.0.23 9100 1.1.1.183 9100 extendable
ip nat inside source static tcp 192.168.0.24 9100 1.1.1.184 9100 extendable
ip nat inside source static tcp 192.168.0.35 80 1.1.1.187 80 extendable
ip nat inside source static tcp 192.168.0.7 80 1.1.1.200 80 extendable
ip nat inside source static tcp 192.168.0.17 80 1.1.1.201 80 extendable
!
ip sla 1
icmp-echo 1.1.1.3
timeout 6000
frequency 10
ip sla schedule 1 life forever start-time now
access-list 10 permit 192.168.0.0 0.0.0.255
access-list 20 permit 192.168.0.0 0.0.0.255
!
!
!
!
!
!
control-plane
!
!
!
line con 0
line aux 0
line vty 0 4
login
!
scheduler allocate 20000 1000
end

The "ip nat inside source static" statements are for websites that are hosted on a server in VLAN 1.

The problem is that this configuration didn't work - I could ping the Internet from the router, but not from the PCs in Vlan 1. From them I could ping the router's outside interfaces and no further. I removed the "ip nat outside" from Fa0/1 (the backup route) and this fixed that problem, but then I didn't have failover functionality. I thought there may be some problem with the NAT, so I tried with a route-map:

access-list 100 permit ip 192.168.0.0 0.0.0.255 any

route-map isp1 permit 10
match ip address 100
match interface FastEthernet0/0

route-map isp2 permit 10
match ip address 100
match interface FastEthernet0/1

ip nat inside source route-map isp1 interface FastEthernet0/0 overload
ip nat inside source route-map isp2 interface FastEthernet0/1 overload

However, after that there is no connectivity at all (can't ping Fa0/0 or Fa0/1 from the router itself). Help will be greatly appreciated.

7
  • can you paste the output of : show ip route and also show ip nat translations
    – Mr.lock
    Mar 7 '17 at 9:57
  • You are missing access-list 100 which is used in route-map Mar 7 '17 at 11:07
  • Also, in your original configuration, access lists 10 and 20 are identical. You only need one. You can use the same access list in multiple places; you could even assign it to an interface while using it on both NATs.
    – Ron Maupin
    Mar 7 '17 at 11:37
  • @Datagram.Network I have it, it's above the first route-map. The router is disconnected from the network now (since it doesn't work properly), so "show ip route" doesn't show anything, but with my original configuration it showed 192.168.0.0/24 as directly connected and the network from the first default route with an S*. "show ip translations" showed only static translations from the websites on the server, which seemed to work fine.
    – peter_s
    Mar 7 '17 at 12:21
  • @peter_s if you have resolved your issue you should post the solution as an answer and then mark it as "Accepted". Cisco appears to have this very scenario documented here: docwiki.cisco.com/wiki/…
    – TDurden
    Mar 11 '17 at 23:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.