Network ( routing and switching) , security

Question

In my company network i am installing new cisco2811 router but i have problem, my LAN network can not ping and access network. i get point to point internet from ISP.

PTP IP is 192.186.86.200/24 and its switch port is 15 shown in picture.

LAN network IP 172.16.16.200/24 DHCP.

I have configured virtual interfaces in router.

Also implemented NAT rule but i don't now how to access internet.

My internet IP is 192.186.86.200/24.

I think I need to configure a NAT rule but don't know which type.

This is the router config:

Router#show running-config
Building configuration...


Current configuration : 3700 bytes
!
! Last configuration change at 18:10:56 UTC Thu Sep 20 2018
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
enable password Ylinx
!
no aaa new-model
!
!
dot11 syslog
ip source-route
!
!
ip cef
!
ip dhcp excluded-address 172.16.16.200
ip dhcp excluded-address 10.2.60.55
!
ip dhcp pool YLINX_LAN
 network 172.16.16.0 255.255.255.0
 dns-server 8.8.8.8
 default-router 172.16.16.200
 lease 10
 update arp
!
ip dhcp pool YLINX_SERVERS
 network 10.2.60.0 255.255.255.0
 dns-server 8.8.8.8
 default-router 10.2.60.200
 lease 10
 update arp
!
!
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
voice-card 0
!
crypto pki token default removal timeout 0
!
crypto pki trustpoint TP-self-signed-2879905090
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-2879905090
 revocation-check none
 rsakeypair TP-self-signed-2879905090
!
!

    quit
!
!
license udi pid CISCO2811 sn FHK0902F4V6
username naseer secret 5 $1$w6HC$W9eoccnVIhNDKbMr91f2e0
!
redundancy
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet0/0.400
 encapsulation dot1Q 400
 ip address 192.168.86.200 255.255.255.0
 ip nat outside
 ip virtual-reassembly in
!
interface FastEthernet0/0.401
 encapsulation dot1Q 401
 ip address 192.168.1.200 255.255.255.0
!
interface FastEthernet0/0.402
 encapsulation dot1Q 402
 ip address 172.16.16.200 255.255.255.0
!
interface FastEthernet0/0.403
 encapsulation dot1Q 403
 ip address 10.2.60.200 255.255.255.0
!
interface FastEthernet0/1
 ip address 1.1.1.1 255.255.255.0
 duplex auto
 speed auto
!
interface BRI0/1/0
 no ip address
 encapsulation hdlc
 shutdown
!
ip forward-protocol nd
ip http server
no ip http secure-server
!
!
ip nat outside source static 192.168.86.200 172.16.16.200
ip route 0.0.0.0 0.0.0.0 192.168.86.1 10
ip route 0.0.0.0 0.0.0.0 192.168.1.1 50
!
!
!
!
!
!
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
!
!
line con 0
 password Ylinx
 login
line aux 0
line vty 0 4
 password Ylinx
 login
 transport input all
line vty 5 15
 password Ylinx
 login
 transport input all
!
scheduler allocate 20000 1000
end

Switch interfaces config:

interface GigabitEthernet1/0/15 
 description YLINX_PTP
 switchport access vlan 400
 switchport trunk encapsulation dot1q
 switchport mode access

interface GigabitEthernet1/0/16
 description YLINX_161_DIRECT
 switchport access vlan 402
 switchport trunk encapsulation dot1q
 switchport mode access

interface GigabitEthernet1/0/18
 description YLINX_CISCO_ROUTER
 switchport trunk encapsulation dot1q 
 switchport mode trunk

interface GigabitEthernet1/0/21 
 description YLINX_SERVERS
 switchport access vlan 403
 switchport trunk encapsulation dot1q
 switchport mode access

Answer 1

Welcome to Network Engineering! There are a few things wrong here:

1. There is no inside nat statement. You have the outside NAT statement on fa 0/0.401. On your internal LAN interface (whichever that is), you need

   ip nat inside

2. If you simply want internal hosts to reach the internet, change your NAT statement to:

   ip nat inside source list 1 interface FastEthernet0/0.401 overload

   access-list 1 0.0.0.0 255.255.255.255

If you want external hosts to make connections to internal hosts (like a web server), you need a different NAT statement, but you need to provide more information before we can recommend a configuration.

Answer 2

Configure ISP allocated public ip address to router egress interfàce . And further configured Port address translation (PAT) for internet access (outbound traffic)

Static NAT one to one for inbound traffic

For PAT configuration

Router(config) # access-list 10 permit 172.16.16.0 0.0.0.0.255 any

Router(config) # ip nat inside source list 1 interfàce F0/1 overload