Cisco ISR 4331 works but ping/ssh/web outside/GRE doesn`t
I have changed an old router to Cisco ISR4331. Have set up everything, nothing fancy, no VLANs/OSPF/redundancy, etc. Just a gateway for an office network.
So, I switched the boxes, and users are happy...Sort of. Internet works, DHCP gives out leases. But:
- I can access the ISR via SSH/web over LAN interface, not over WAN.
- I can't ping 8.8.8.8 from the WAN interface (but a ping from LAN works!)
- GRE tunnel to the other branches doesn't work properly. I see the tunnel as UP on both sides but I can't ping nor get access to resources on the other side. Haven't changed anything on the 2nd branch ISR, the same IP, everything is the same.
So it seems that something is blocked on the WAN interface but what exactly - I can't get my head around it. I have tried to off all the access-groups on WAN - no results. Thanks in advance for any help!
There is a piece of the conf related to the issue:
Current configuration : 8563 bytes
!
! Last configuration change at 13:31:28 UTC Fri Feb 18 2022
!
version 16.6
!
interface Tunnel1
description *Tunnel to X*
ip address 10.2.20.18 255.255.255.252
ip access-group OurAccess in
ip tcp adjust-mss 1420
tunnel source GigabitEthernet0/0/0
tunnel destination WAN_IP_of_2dn_branch
!
interface GigabitEthernet0/0/0
description WAN Interface
ip address 1.1.1.1 255.255.255.0
ip nat outside
ip access-group WAN in
negotiation auto
!
interface GigabitEthernet0/0/1
description LAN Interface
ip address 2.2.2.2 255.255.255.0
ip nat inside
negotiation auto
!
ip nat inside source list LanForNAT interface GigabitEthernet0/0/0 overload
ip forward-protocol nd
ip http server
ip http authentication local
ip http client source-interface GigabitEthernet0
ip route 0.0.0.0 0.0.0.0 ISP_gw
ip route 6.6.6.0 255.255.255.0 Tunnel1
!
ip ssh port xxxx rotary 1
!
!
ip access-list extended OurAccess
permit ip any any
ip access-list extended LanForNAT
permit ip 2.2.2.0 0.0.0.255 any
ip access-list extended WAN
permit ip any any
permit icmp any any
ip access-list extended denyssh
deny tcp any any eq 22
permit tcp any any eq xxxx
line vty 0 4
access-class denyssh in
privilege level 15
password zzz
login local
rotary 1
length 0
transport input ssh
transport output ssh
!
ip access-group WAN in. You will not be able to establish an SSH connection from the WAN, and neither will the bad guys. Also, you really need a firewall, either use the Zone firewall with the right IOS version, or get a separate physical one between the router and Internet.