Cisco ISR 4331 works but ping/ssh/web outside/GRE doesn`t
I have changed an old router to Cisco ISR4331. Have set up everything, nothing fancy, no VLANs/OSPF/redundancy, etc. Just a gateway for an office network.
So, I switched the boxes, and users are happy...Sort of. Internet works, DHCP gives out leases. But:
- I can access the ISR via SSH/web over LAN interface, not over WAN.
- I can't ping 220.127.116.11 from the WAN interface (but a ping from LAN works!)
- GRE tunnel to the other branches doesn't work properly. I see the tunnel as UP on both sides but I can't ping nor get access to resources on the other side. Haven't changed anything on the 2nd branch ISR, the same IP, everything is the same.
So it seems that something is blocked on the WAN interface but what exactly - I can't get my head around it. I have tried to off all the access-groups on WAN - no results. Thanks in advance for any help!
There is a piece of the conf related to the issue:
Current configuration : 8563 bytes ! ! Last configuration change at 13:31:28 UTC Fri Feb 18 2022 ! version 16.6 ! interface Tunnel1 description *Tunnel to X* ip address 10.2.20.18 255.255.255.252 ip access-group OurAccess in ip tcp adjust-mss 1420 tunnel source GigabitEthernet0/0/0 tunnel destination WAN_IP_of_2dn_branch ! interface GigabitEthernet0/0/0 description WAN Interface ip address 18.104.22.168 255.255.255.0 ip nat outside ip access-group WAN in negotiation auto ! interface GigabitEthernet0/0/1 description LAN Interface ip address 22.214.171.124 255.255.255.0 ip nat inside negotiation auto ! ip nat inside source list LanForNAT interface GigabitEthernet0/0/0 overload ip forward-protocol nd ip http server ip http authentication local ip http client source-interface GigabitEthernet0 ip route 0.0.0.0 0.0.0.0 ISP_gw ip route 126.96.36.199 255.255.255.0 Tunnel1 ! ip ssh port xxxx rotary 1 ! ! ip access-list extended OurAccess permit ip any any ip access-list extended LanForNAT permit ip 188.8.131.52 0.0.0.255 any ip access-list extended WAN permit ip any any permit icmp any any ip access-list extended denyssh deny tcp any any eq 22 permit tcp any any eq xxxx line vty 0 4 access-class denyssh in privilege level 15 password zzz login local rotary 1 length 0 transport input ssh transport output ssh !