Recently access outbound from all my LAN servers has stopped working. I have a 7206VXR running 12.3(4r)T3 which has a LAN interface using RFC 1918 IP addressing, and a WAN connection to our ISP using static routing. I'm trying to see if there is an error in the config that is causal, or if it's a recent ISP change.

The WAN interface is marked as "ip nat outside", and the LAN interface as "ip nat inside". For this example, let's assume our allocated external IP block is, which is being routed to our assumed WAN IP of


interface GigabitEthernet0/2
  description WAN connection. ISP is
  ip address
  ip access-group 120 in
  ip nat outside
  duplex full
  speed 1000
  media-type rj45
  no negotiation auto
  no keepalive
  no cdp enable
ip route


interface GigabitEthernet0/3
 description Primary LAN
 ip address
 ip nat inside
 duplex full
 speed 1000
 media-type rj45
 negotiation auto
 no cdp enable

I have quite a few lines for NAT. Here are a couple (IPs are representative):

ip nat inside source static
ip nat inside source static

And an outbound ACL:

access-list 120 permit ip any any established
access-list 120 permit ip any host eq 80
access-list 120 permit ip any host eq 22
access-list 120 deny   ip any any

My problem is that I can ssh and access the web server at just fine. However, once I'm ssh'ed in, I can't ping, traceroute or otherwise access anything outside of the LAN.

This was working fine a couple days ago, and no major changes have been made to the config. There was some work done by the ISP on disconnecting an old circuit, but I had already removed the routing for that CCT and the remaining couple NAT lines for it's network (we were running with 2 incoming ISPs).

So the meat of the question is, do I need to do anything else for NAT to work outbound? When this was working, I had made NAT entries in order for Internet access to services on my internal hosts. I could not get out to the WAN from a LAN device unless a NAT entry was there, and instead of creating a translation for every host, I have a proxy host to which the majority of my linux servers use for OS updates, installs, etc. But even on the few hosts that have the direct NAT translation in place, I can't ping, traceroute or otherwise access the Internet.

I'm pretty sure the ISP has done something, but I just wanted to ask the group if anything looks wrong or missing in the relevant pieces of the config I have published.


  • Can you run the below commands: 1.show ip route 2.debug ip nat 3.ping <external ip> 4.show log
    – Ravi
    Jun 20, 2017 at 19:13
  • the client side should be ip nat outside ?
    – john
    Jun 20, 2017 at 23:38
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Feb 21, 2018 at 19:10
  • ditch the ACL temporarily (no ip access-group 120 in) and see if the problem goes away? Apr 6, 2018 at 20:15

2 Answers 2


Could it be that your ACL is picking everything up?

permit ip any any established will allow traffic to go back out after an incoming connection is established, but doesn't permit outbound ICMP (ping or trace route) traffic. You would need to add rules to allow the ICMP traffic.

show access-list will show you which rules are being hit when you try to ping. You can also clear their counters with clear access-list counters or something similar (not in front of a router to test that is the correct command right now).

  • Isn't the absence of an outbound ACL the same as an implicit allow any?
    – AaplMike
    Dec 8, 2017 at 17:52
  • 1
    Sure - I think your traffic will go out, but I think in the case of ping and trace route, the returning echo-reply or timeout exceeded ICMP messages respectively will be blocked by access-list 120 because the established flag only applies to TCP sessions.
    – xirt
    Dec 9, 2017 at 4:07

Basically the nature of traffic flow of internet traffic is outbound .

Internet access required many to one natting policy in place . Outside to inside natting in other words many private IP address nat translation to one public IP address .

Assuming router egress interfàce G0/1

Ensure below mentioned nat translation command is configured and try.

Router(config)# access -list 10 permit

Assuming LAN subnet is

Router(config) #ip nat inside souce list 10 interface G0/1 overload

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.