magid

I have looked at the config that you posted and there are several things that I do not understand, some of which may relate to the cause of your problem.

It looks like interface FastEther0/0 is the logical inside interface where your end stations would be. I am puzzled about the function of FastEther0/1 whose addresses would appear to be public addresses. But it is configured as ip nat inside, which implies that it is a second inside address. And this is the interface where Policy Based Routing is configured.

So web traffic from the addresses on FA0/1 may be policy routed and traffic from addresses on FA0/0 will not be. Is this what you intended?

I also note that the route map for PBR uses access list 160 to identify traffic to be translated. The same access list identifies traffic to be Policy Routed. I find the use of the same access list for both functions a bit unusual. So only Policy Routed traffic will be translated. Is this what you intended?

And access list 160 permits traffic only from a specific host (permit tcp host 81.192.64.H ) so only web traffic from that specific host can be Policy Routed and only that traffic will be translated. Is that what you intended?

I also note that interface FA0/1 has this:

ip access-group 100 in

but the config that you posted does not have access list 100.

If you can clarify these issues perhaps we will be closer to finding the cause of your issue.

[edit] in reading the thread again I notice another inconsistency. In the original post you say "The HTTP stream go out on the ADSl interface and the all others on the T1 interface". But with 2 equal cost static routes configured:

ip route 0.0.0.0 0.0.0.0 Dialer0

ip route 0.0.0.0 0.0.0.0 Serial0/2/0

the router will send traffic over both of the interfaces. So there is traffic going over the dialer interface that is not web traffic.

HTH

Rick

Thank you very much Rick for your answer!

It looks like interface FastEther0/0 is the logical inside interface where your end stations would be. I am puzzled about the function of FastEther0/1 whose addresses would appear to be public addresses. But it is configured as ip nat inside, which implies that it is a second inside address. And this is the interface where Policy Based Routing is configured.

-->The FastEthet0/0 is only to configure and monitor the router and The FastEthet0/1 is the inside interface connected to the pix.

So web traffic from the addresses on FA0/1 may be policy routed and traffic from addresses on FA0/0 will not be. Is this what you intended?

--->Its intented by us.

I also note that the route map for PBR uses access list 160 to identify traffic to be translated. The same access list identifies traffic to be Policy Routed. I find the use of the same access list for both functions a bit unusual. So only Policy Routed traffic will be translated. Is this what you intended?

--->Its intented by us. But could you please give us an example of appropriate solution.

And access list 160 permits traffic only from a specific host (permit tcp host 81.192.64.H ) so only web traffic from that specific host can be Policy Routed and only that traffic will be translated. Is that what you intended?

--->Its intented by us. 81.192.64.H is the address of pix outside interface.

I also note that interface FA0/1 has this:

ip access-group 100 in

but the config that you posted does not have access list 100.

--->You're right it's an error.

If you can clarify these issues perhaps we will be closer to finding the cause of your issue.

[edit] in reading the thread again I notice another inconsistency. In the original post you say "The HTTP stream go out on the ADSl interface and the all others on the T1 interface". But with 2 equal cost static routes configured:

ip route 0.0.0.0 0.0.0.0 Dialer0

ip route 0.0.0.0 0.0.0.0 Serial0/2/0

the router will send traffic over both of the interfaces. So there is traffic going over the dialer interface that is not web traffic.

--->You're right.

if i configure like taht it's ok?:

ip route 0.0.0.0 0.0.0.0 Dialer0 100

ip route 0.0.0.0 0.0.0.0 Serial0/2/0

in advance thanks!

magid

Thanks for clarifying some aspects of the config that I asked about. It does make some better sense now that these are explained.

Yes if you apply the administrative distance on the static default route through dialer0 (as 100 in your post) then it will create a floating static default route. Normally the route out the serial interface will carry all traffic (except for the PBR traffic0 and if the serial link fails then traffic will be sent out the dialer.

There is one aspect of this that you might want to think about. The PIX is translating traffic to an address that seems to be associated with the serial link. If you send traffic out the dialer using the floating static route, will response traffic return through the dialer or will it attempt to return through the serial link (which would be down if you are using the floating static to the dialer)?

I am not clear whether fixing the static default route and fixing the access list 100 issues will change your original problem. After you fix these will you let us know if the problem still exists?

HTH

Rick

Hi rick,

Thank you very much for your help

I change the ip route like that:

ip route 0.0.0.0 0.0.0.0 Dialer0 100

and i delete the commande line :

ip access-group 100 in

For the moment, all it's ok.

But please could you answer me for this problem :

I also note that the route map for PBR uses access list 160 to identify traffic to be translated. The same access list identifies traffic to be Policy Routed. I find the use of the same access list for both functions a bit unusual. So only Policy Routed traffic will be translated. Is this what you intended?

--->Its intented by us. But could you please give us an example of appropriate solution.

magid

You know your situation much better than I do. And if things are working as expected now, then there may not be a need to change anything.

But I wonder if you may have a need to translate additional traffic going out the dialer interface. As it is configured now, using access list 160 for translation as well as PBR means that only web traffic from a specific host address will be translated. I wonder if the serial link fails and you begin using the floating static to send all traffic out the dialer interface whether you may need to translate that traffic to the dialer interface address. Using access list 160 would not allow that. Using a different access list would allow it - if you determine that additional traffic does need to be translated.

HTH

Rick

Dear Rick,

Thank you very much!

I resolved my problem!!

Congratulation Rick for your 10,000 points new start!

And kudos to be always willing to dig into obscure configurations that many times would benefit from a radical overhaul.

I gave you 5 points here and hope you can keep doing generous help here.

Paolo.

Paolo

Thanks for the points. Thanks even more for the compliment. It means a lot to me to have the respect of my colleagues who also contribute so much to NetPro.

HTH

Rick