Able to ping internet sites from router but not when using source as lan

Unanswered Question
Apr 5th, 2009


We have weird issue here where i am able to ping internet sites from the router but not when i give source as lan interface of router.

we have many sers effected with this they are able to access company network but not internet sites

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
mahesh18 Sun, 04/05/2009 - 23:56


Here is output ping to ip


Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to, timeout is 2 seconds:


Success rate is 100 percent (5/5), round-trip min/avg/max = 780/784/788 ms

below is the extended ping


Protocol [ip]:

Target IP address:

Repeat count [5]: 30

Datagram size [100]:

Timeout in seconds [2]:

Extended commands [n]: Y

Source address or interface: fastethernet0/1*************lan connection interface

Type of service [0]:

Set DF bit in IP header? [no]:

Validate reply data? [no]:

Data pattern [0xABCD]:

Loose, Strict, Record, Timestamp, Verbose[none]:

Sweep range of sizes [n]:

Type escape sequence to abort.

Sending 30, 100-byte ICMP Echos to, timeout is 2 seconds:

Packet sent with a source address of


Many thanks


JamesLuther Mon, 04/06/2009 - 00:16


This sounds like a NAT issue. Are you NATing your internal IPs to an internet routable address?

Please post your router configuration showing the interaces, NAT and ACLs applied.


mahesh18 Mon, 04/06/2009 - 02:08

Hi james,

issue is on and off.

it workks for few hours and then it stops.

I have attached router conifg.


Edison Ortiz Mon, 04/06/2009 - 06:02

Hi Mahesh,

You have several issues on this router.

1) Your IPSec configuration has an incorrect ACL. You configured for any packets sourcing from your LAN to be encrypted as it leaves the router on the WAN. You need to include just the interesting traffic on this ACL. If you need a guideline, use the ACL listed under 'NO-NAT' and the deny ACEs should be the permit ACEs under the IPSec ACL.

2) Your inside and outside interface have the 'ip nat outside|inside' commands missing.

As a side note, are you planning to have 2 IPSec Peers or just 1?

By creating a crypto map with a different name, your configuration will only allow you to have one IPSec peer.





This Discussion