Recently access outbound from all my LAN servers has stopped working. I have a 7206VXR running 12.3(4r)T3 which has a LAN interface using RFC 1918 IP addressing, and a WAN connection to our ISP using static routing. I'm trying to see if there is an error in the config that is causal, or if it's a recent ISP change.
The WAN interface is marked as "ip nat outside", and the LAN interface as "ip nat inside". For this example, let's assume our allocated external IP block is 100.100.100.0/24, which is being routed to our assumed WAN IP of 188.8.131.52.
interface GigabitEthernet0/2 description WAN connection. ISP is 184.108.40.206 ip address 220.127.116.11 255.255.255.248 ip access-group 120 in ip nat outside duplex full speed 1000 media-type rj45 no negotiation auto no keepalive no cdp enable [...] ip route 0.0.0.0 0.0.0.0 18.104.22.168
interface GigabitEthernet0/3 description Primary LAN ip address 192.168.49.1 255.255.255.0 ip nat inside duplex full speed 1000 media-type rj45 negotiation auto no cdp enable
I have quite a few lines for NAT. Here are a couple (IPs are representative):
ip nat inside source static 192.168.49.10 100.100.100.10 ip nat inside source static 192.168.49.117 100.100.100.117 [...]
And an outbound ACL:
access-list 120 permit ip any any established access-list 120 permit ip any host 100.100.100.117 eq 80 access-list 120 permit ip any host 100.100.100.117 eq 22 [...] access-list 120 deny ip any any
My problem is that I can ssh and access the web server at 100.100.100.117 just fine. However, once I'm ssh'ed in, I can't ping, traceroute or otherwise access anything outside of the LAN.
This was working fine a couple days ago, and no major changes have been made to the config. There was some work done by the ISP on disconnecting an old circuit, but I had already removed the routing for that CCT and the remaining couple NAT lines for it's network (we were running with 2 incoming ISPs).
So the meat of the question is, do I need to do anything else for NAT to work outbound? When this was working, I had made NAT entries in order for Internet access to services on my internal hosts. I could not get out to the WAN from a LAN device unless a NAT entry was there, and instead of creating a translation for every host, I have a proxy host to which the majority of my linux servers use for OS updates, installs, etc. But even on the few hosts that have the direct NAT translation in place, I can't ping, traceroute or otherwise access the Internet.
I'm pretty sure the ISP has done something, but I just wanted to ask the group if anything looks wrong or missing in the relevant pieces of the config I have published.