Cisco ISR 4331 works but ping/ssh/web outside/GRE doesn`t

I have changed an old router to Cisco ISR4331. Have set up everything, nothing fancy, no VLANs/OSPF/redundancy, etc. Just a gateway for an office network.

So, I switched the boxes, and users are happy...Sort of. Internet works, DHCP gives out leases. But:

  • I can access the ISR via SSH/web over LAN interface, not over WAN.
  • I can't ping from the WAN interface (but a ping from LAN works!)
  • GRE tunnel to the other branches doesn't work properly. I see the tunnel as UP on both sides but I can't ping nor get access to resources on the other side. Haven't changed anything on the 2nd branch ISR, the same IP, everything is the same.

So it seems that something is blocked on the WAN interface but what exactly - I can't get my head around it. I have tried to off all the access-groups on WAN - no results. Thanks in advance for any help!

There is a piece of the conf related to the issue:

Current configuration : 8563 bytes
! Last configuration change at 13:31:28 UTC Fri Feb 18 2022
version 16.6
interface Tunnel1
 description *Tunnel to X*
 ip address
 ip access-group OurAccess in
 ip tcp adjust-mss 1420
 tunnel source GigabitEthernet0/0/0
 tunnel destination WAN_IP_of_2dn_branch
interface GigabitEthernet0/0/0
 description WAN Interface
 ip address
 ip nat outside
 ip access-group WAN in
 negotiation auto
interface GigabitEthernet0/0/1
 description LAN Interface
 ip address
 ip nat inside
 negotiation auto

ip nat inside source list LanForNAT interface GigabitEthernet0/0/0 overload
ip forward-protocol nd
ip http server
ip http authentication local
ip http client source-interface GigabitEthernet0

ip route ISP_gw
ip route Tunnel1
ip ssh port xxxx rotary 1
ip access-list extended OurAccess
 permit ip any any
ip access-list extended LanForNAT
 permit ip any
ip access-list extended WAN
 permit ip any any
 permit icmp any any
ip access-list extended denyssh
 deny   tcp any any eq 22
 permit tcp any any eq xxxx

line vty 0 4
 access-class denyssh in
 privilege level 15
 password zzz
 login local
 rotary 1
 length 0
 transport input ssh
 transport output ssh
  • Can you ping the gateway (ISP_gw) from the WAN interface? Have you tried setting the interface explicitly as the ping source?
    – Ron Trunk
    Feb 24 at 19:19
  • The ACL blocks SSH (port 22) from the WAN, and that is a good thing: ip access-group WAN in. You will not be able to establish an SSH connection from the WAN, and neither will the bad guys. Also, you really need a firewall, either use the Zone firewall with the right IOS version, or get a separate physical one between the router and Internet.
    – Ron Maupin
    Feb 24 at 22:42
  • When you're testing SSH, be aware that there is a rotary configured, so you need to SSH to port xxxx rather than 22 Feb 24 at 23:56
  • No, I cannot ping IPS_gw from WAN, and yes I tried it explicitly.
    – blackraven
    Feb 25 at 5:16
  • Yes, a rotary is configured. And I knock at xxxx port rather than 22. But with no luck still.
    – blackraven
    Feb 25 at 5:17


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.