1

I have a network similar to the one shown at the picture below. The main aim is to get connectivity between antivirus server (10.100.10.9) and hosts placed behind their LAN-gateway (network 10.200.1.32/28).

enter image description here

So, the simplest ping-shooting shows the following (step-by-step):

Pinging from the server: 1. Ping from server (10.100.10.9) to Cisco-1921 WAN-interface (10.200.1.50) - successful; 2. Ping from server (10.100.10.9) to Cisco-1921 LAN-interface (10.200.1.33) - successful; 3. Ping from server (10.100.10.9) to LAN-hosts (10.200.1.34, etc.) - no ping!

It would be logical to think that hosts' Windows firewall blocks icmp-requests by default, but the following check breaks this suppose:

Pinging at the Cisco-1921: 1. Ping from Cisco-1921 WAN-interface (10.200.1.50) to Cisco-1921 LAN-interface (10.200.1.33) - successful; 2. Ping from Cisco-1921 LAN-interface (10.200.1.33) to LAN-hosts (10.200.1.34, etc.) - successful; 3. Ping from Cisco-1921 WAN-interface (10.200.1.50) to LAN-hosts (10.200.1.34, etc.) - no ping!

So, I consider that having ping-access from anywhere to hosts' gateway (10.200.1.33) means, that there should be a ping-access to hosts too, isn't it? But there is not.

Addictively, there are no ACL-s at the Cisco-1921 which are able to make influence at LAN-hosts being accessible.

Cisco-1921 routing table is:

*Gateway of last resort is 10.200.1.49 to network 0.0.0.0*

Cisco-1921 config is:

r01.rts.nkl#
r01.rts.nkl#
r01.rts.nkl#sh run
Building configuration...

Current configuration : 5791 bytes
!
! Last configuration change at 17:19:16 VLAD Wed Mar 11 2020 by beritsky
! NVRAM config last updated at 10:00:36 VLAD Thu Mar 12 2020 by beritsky
! NVRAM config last updated at 10:00:36 VLAD Thu Mar 12 2020 by beritsky
version 15.3
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname r01.rts.nkl
!
boot-start-marker
boot-end-marker
!
!
enable secret 4 NBPjn9wnrPeJVbPzwqsrzEd4jkrMA5w3hySKFR.Y6Bc
enable password 7 013B5D025F1837
!
aaa new-model
!
!
aaa group server tacacs+ tac-int
 server 10.100.0.3
!
aaa authentication login admin group tac-int local
aaa authorization console
aaa authorization exec admin group tac-int local 
aaa authorization commands 15 admin group tac-int local 
aaa accounting update newinfo
aaa accounting commands 15 admin start-stop group tac-int
!
!
!
!
!
aaa session-id common
clock timezone VLAD 11 0
!
!
!
!
ip dhcp excluded-address 172.16.0.2 172.16.0.5
ip dhcp excluded-address 10.200.1.34 10.200.1.36
ip dhcp ping packets 1
!
ip dhcp pool LAN
 network 10.200.1.32 255.255.255.240
 default-router 10.200.1.33 
 dns-server 10.100.0.5 188.72.74.3 
 lease 0 12
 update arp
   remember
!
ip dhcp pool Tukachev
 host 10.200.1.35 255.255.255.240
 client-identifier 018c.89a5.e719.ed
 default-router 10.200.1.33 
 dns-server 10.100.0.5 188.72.74.3 
 lease infinite
   remember
!
ip dhcp pool Aleksashkin
 host 10.200.1.34 255.255.255.240
 client-identifier 0100.1cc0.19c3.5a
 default-router 10.200.1.33 
 dns-server 10.100.0.5 188.72.74.3 
 lease infinite
   remember
!
!
!
ip domain name dvrc.ru
ip name-server 188.72.74.3
ip name-server 188.72.75.23
ip name-server 10.100.0.5
ip cef
no ipv6 cef
multilink bundle-name authenticated
!
!
!
license udi pid CISCO1921/K9 sn FCZ1806C2WU
!
!
username ROOT privilege 15 secret 4 Ue3RcTGnMSk6gfOFywXbnttEkXRNK3N5kgdBpUOVN3.
!
redundancy
!
!
ip ssh version 2
!
class-map match-any voip
 match access-group 102
!
policy-map voip-tos
 class voip
  set ip precedence 5
!
!
!
!
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 description #_iDirect_to_r01.rts.nkl_#
 ip address 10.200.1.50 255.255.255.240
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 no ip address
 duplex auto
 speed auto
!
interface GigabitEthernet0/1.19
 description to dataminer-GD
 encapsulation dot1Q 19
 ip address 10.100.95.34 255.255.255.252
 ip nat outside
 ip nat enable
 ip virtual-reassembly in
!
interface GigabitEthernet0/1.20
 description #mgt#
 encapsulation dot1Q 20
 ip address 10.21.14.1 255.255.255.240
!
interface GigabitEthernet0/1.32
 description CTV-net
 encapsulation dot1Q 32
 ip address 10.27.99.30 255.255.255.240
 ip nat inside
 ip nat enable
 ip virtual-reassembly in
!
interface GigabitEthernet0/1.210
 description _LAN_&_voip-phones_
 encapsulation dot1Q 210
 ip address 172.16.0.1 255.255.255.240 secondary
 ip address 10.200.1.33 255.255.255.240
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip nat enable
 ip virtual-reassembly in
 rate-limit input access-group 2001 512000 96000 192000 conform-action transmit exceed-action drop
 service-policy input voip-tos
!
interface GigabitEthernet0/1.250
 description _for_VoIP_Nateks_
 encapsulation dot1Q 250
 ip address 10.1.2.121 255.255.255.248
 service-policy input voip-tos
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip dns server
ip nat inside source list 2002 interface GigabitEthernet0/1.19 overload
ip route 0.0.0.0 0.0.0.0 10.200.1.49
ip route 10.100.2.14 255.255.255.255 10.100.95.33
!
logging host 10.100.0.22
!
route-map CTV permit 10
 match ip address 2002
 set ip next-hop 10.27.99.17
!
!
snmp-server community zaebix$ RO 66
snmp-server community getConf777 RW 77
snmp-server location CUS
snmp-server contact CUS
snmp-server enable traps snmp linkdown linkup
snmp-server host 10.100.0.2 version 2c zaebix$ 
tacacs-server host 10.100.0.3 key 7 073B3343425F4E55181E24
tacacs-server timeout 10
tacacs-server directed-request
access-list 60 permit 10.100.0.0 0.0.0.255
access-list 60 permit 10.21.189.0 0.0.0.255
access-list 66 permit 10.21.189.62
access-list 66 permit 10.100.0.0 0.0.0.255
access-list 101 remark iDirect
access-list 101 permit ip 10.200.1.32 0.0.0.15 any
access-list 101 remark iDirect
access-list 102 permit ip 10.1.2.120 0.0.0.7 host 192.168.13.30
access-list 102 permit ip 10.1.2.120 0.0.0.7 host 192.168.13.38
access-list 102 permit ip 10.200.1.32 0.0.0.15 host 192.168.13.30
access-list 102 permit ip 10.200.1.32 0.0.0.15 host 192.168.13.38
access-list 2001 remark trueconf
access-list 2001 deny   ip 10.200.1.32 0.0.0.15 host 10.100.0.21
access-list 2001 permit ip any any
access-list 2001 remark truecon
access-list 2002 remark ip nat CTV0out
access-list 2002 permit ip any 10.27.0.0 0.0.255.255
access-list 2002 permit ip any 10.100.0.0 0.0.255.255
access-list 2002 remark ip nat CTV0out
!
!
!         
control-plane
!
!
banner login ^C

        You have entered $(hostname) at $(domain) network.
    Disconnect immediately if you are not an authorized user!

^C
!
line con 0
 exec-timeout 30 0
 password 7 045A0F0B062F
 authorization commands 15 admin
 authorization exec admin
 accounting commands 15 admin
 login authentication admin
line aux 0
 exec-timeout 30 0
 authorization commands 15 admin
 authorization exec admin
 accounting commands 15 admin
 login authentication admin
line 2
 no activation-character
 no exec
 transport preferred none
 transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
 stopbits 1
line vty 0 4
 exec-timeout 30 0
 password 7 11081D081E1C
 authorization commands 15 admin
 authorization exec admin
 accounting commands 15 admin
 login authentication admin
 transport input all
!
scheduler allocate 20000 1000
ntp server 10.100.0.1
!
end

And one more remarkable thing is: ping from LAN-hosts (10.200.1.34, etc.) to server (10.100.10.9) are succesessfull!

Any ideas, what may be a reason? Remember, I need full connectivity between antivirus server (10.100.10.9) and hosts (10.200.1.34, etc.).

12
  • Please edit your question to include the network device configurations. We cannot simply guess where the problem may be. – Ron Maupin Jun 8 '20 at 4:06
  • 1
    Why are you running NAT? You should simply route. NAT prevents traffic originated from the outside to travel inside. NAT should only be used if you have public<->-private addressing or overlapping networks, but all your addressing is private with no overlapping networks. – Ron Maupin Jun 8 '20 at 4:32
  • 1
    Your problem is the NAT. Hosts on the inside of the NAT can ping hosts on the outside because inside-initiated traffic will create an entry in the NAT ICMP table for return traffic, but trying the opposite will not work because there will be no entry for outside-initiated traffic. This is exactly what you are observing, and it is how NAT works. I see no reason for the NAT in your diagram or configuration. – Ron Maupin Jun 8 '20 at 4:43
  • 1
    There are no public addresses or overlapping networks, so there is no reason for NAT. Also, simply removing the command from the interface may not actually disable it without some type of reset (I have seen that before), either shutdown and restart the interface, or, better, reload the router. The NAT table for the interface will exist as long as it has any entries. You could first try clearing the NAT. – Ron Maupin Jun 8 '20 at 4:49
  • 1
    @IgorBeritsky See? That's why it's essential to provide all relevant information in your question, even if you don't think it's relevant. – Zac67 Jun 18 '20 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.