3

Recently access outbound from all my LAN servers has stopped working. I have a 7206VXR running 12.3(4r)T3 which has a LAN interface using RFC 1918 IP addressing, and a WAN connection to our ISP using static routing. I'm trying to see if there is an error in the config that is causal, or if it's a recent ISP change.

The WAN interface is marked as "ip nat outside", and the LAN interface as "ip nat inside". For this example, let's assume our allocated external IP block is 100.100.100.0/24, which is being routed to our assumed WAN IP of 20.20.20.194.

WAN:

interface GigabitEthernet0/2
  description WAN connection. ISP is 20.20.20.193
  ip address 20.20.20.194 255.255.255.248
  ip access-group 120 in
  ip nat outside
  duplex full
  speed 1000
  media-type rj45
  no negotiation auto
  no keepalive
  no cdp enable
 [...]
ip route 0.0.0.0 0.0.0.0 20.20.20.193

LAN:

interface GigabitEthernet0/3
 description Primary LAN
 ip address 192.168.49.1 255.255.255.0
 ip nat inside
 duplex full
 speed 1000
 media-type rj45
 negotiation auto
 no cdp enable

I have quite a few lines for NAT. Here are a couple (IPs are representative):

ip nat inside source static 192.168.49.10 100.100.100.10
ip nat inside source static 192.168.49.117 100.100.100.117
[...]

And an outbound ACL:

access-list 120 permit ip any any established
access-list 120 permit ip any host 100.100.100.117 eq 80
access-list 120 permit ip any host 100.100.100.117 eq 22
[...]
access-list 120 deny   ip any any

My problem is that I can ssh and access the web server at 100.100.100.117 just fine. However, once I'm ssh'ed in, I can't ping, traceroute or otherwise access anything outside of the LAN.

This was working fine a couple days ago, and no major changes have been made to the config. There was some work done by the ISP on disconnecting an old circuit, but I had already removed the routing for that CCT and the remaining couple NAT lines for it's network (we were running with 2 incoming ISPs).

So the meat of the question is, do I need to do anything else for NAT to work outbound? When this was working, I had made NAT entries in order for Internet access to services on my internal hosts. I could not get out to the WAN from a LAN device unless a NAT entry was there, and instead of creating a translation for every host, I have a proxy host to which the majority of my linux servers use for OS updates, installs, etc. But even on the few hosts that have the direct NAT translation in place, I can't ping, traceroute or otherwise access the Internet.

I'm pretty sure the ISP has done something, but I just wanted to ask the group if anything looks wrong or missing in the relevant pieces of the config I have published.

Thanks.

  • Can you run the below commands: 1.show ip route 2.debug ip nat 3.ping <external ip> 4.show log – Ravi Jun 20 '17 at 19:13
  • the client side should be ip nat outside ? – john Jun 20 '17 at 23:38
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 21 '18 at 19:10
  • ditch the ACL temporarily (no ip access-group 120 in) and see if the problem goes away? – htmlcoderexe Apr 6 '18 at 20:15
1

Could it be that your ACL is picking everything up?

permit ip any any established will allow traffic to go back out after an incoming connection is established, but doesn't permit outbound ICMP (ping or trace route) traffic. You would need to add rules to allow the ICMP traffic.

show access-list will show you which rules are being hit when you try to ping. You can also clear their counters with clear access-list counters or something similar (not in front of a router to test that is the correct command right now).

  • Isn't the absence of an outbound ACL the same as an implicit allow any? – AaplMike Dec 8 '17 at 17:52
  • 1
    Sure - I think your traffic will go out, but I think in the case of ping and trace route, the returning echo-reply or timeout exceeded ICMP messages respectively will be blocked by access-list 120 because the established flag only applies to TCP sessions. – xirt Dec 9 '17 at 4:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.