Able to ping internet sites from router but not when using source as lan

Unanswered Question
Apr 5th, 2009
User Badges:


We have weird issue here where i am able to ping internet sites from the router but not when i give source as lan interface of router.

we have many sers effected with this they are able to access company network but not internet sites

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
mahesh18 Sun, 04/05/2009 - 23:56
User Badges:


Here is output ping to ip


Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to, timeout is 2 seconds:


Success rate is 100 percent (5/5), round-trip min/avg/max = 780/784/788 ms

below is the extended ping


Protocol [ip]:

Target IP address:

Repeat count [5]: 30

Datagram size [100]:

Timeout in seconds [2]:

Extended commands [n]: Y

Source address or interface: fastethernet0/1*************lan connection interface

Type of service [0]:

Set DF bit in IP header? [no]:

Validate reply data? [no]:

Data pattern [0xABCD]:

Loose, Strict, Record, Timestamp, Verbose[none]:

Sweep range of sizes [n]:

Type escape sequence to abort.

Sending 30, 100-byte ICMP Echos to, timeout is 2 seconds:

Packet sent with a source address of


Many thanks


JamesLuther Mon, 04/06/2009 - 00:16
User Badges:
  • Silver, 250 points or more


This sounds like a NAT issue. Are you NATing your internal IPs to an internet routable address?

Please post your router configuration showing the interaces, NAT and ACLs applied.


mahesh18 Mon, 04/06/2009 - 02:08
User Badges:

Hi james,

issue is on and off.

it workks for few hours and then it stops.

I have attached router conifg.


Edison Ortiz Mon, 04/06/2009 - 06:02
User Badges:
  • Super Bronze, 10000 points or more
  • Hall of Fame,

    Founding Member

Hi Mahesh,

You have several issues on this router.

1) Your IPSec configuration has an incorrect ACL. You configured for any packets sourcing from your LAN to be encrypted as it leaves the router on the WAN. You need to include just the interesting traffic on this ACL. If you need a guideline, use the ACL listed under 'NO-NAT' and the deny ACEs should be the permit ACEs under the IPSec ACL.

2) Your inside and outside interface have the 'ip nat outside|inside' commands missing.

As a side note, are you planning to have 2 IPSec Peers or just 1?

By creating a crypto map with a different name, your configuration will only allow you to have one IPSec peer.





This Discussion