Help with two ISP and internal public server access
I think this is a simple question but I cannot get it to work.
I have a Router that has two Internet connections (two ISPs).
So, I have it configured to use one ISP as primary and the other as a backup.
I have this configuration:
ip route 0.0.0.0 0.0.0.0 FIRST_ISP 10 track 100 ip route 0.0.0.0 0.0.0.0 SECOND_ISP 30 track 300
I have the users getting out to the Internet as well via both ISPs:
ip nat inside source route-map METRO interface GigabitEthernet0/1 overload ip nat inside source route-map SHDSL interface GigabitEthernet0/0.11 overload
route-map SHDSL permit 10 match ip address ACL_SHDSL match interface GigabitEthernet0/0.11
route-map METRO permit 10 match ip address ACL_METRO match interface GigabitEthernet0/1
Extended IP access list ACL_SHDSL 10 permit ip 192.168.1.0 0.0.0.255 any (570286 matches) 20 permit ip 192.168.2.0 0.0.0.255 any (1528684 matches) 30 permit ip 192.168.3.0 0.0.0.255 any (655 matches)
Extended IP access list ACL_METRO 20 permit ip 192.168.1.0 0.0.0.255 any (293732 matches) 30 permit ip 192.168.2.0 0.0.0.255 any (1110951 matches) 40 permit ip 192.168.3.0 0.0.0.255 any (467 matches)
Then, I have public servers, which I have static NAT rules for them to be accessed via both links and also get out:
ip nat inside source static 192.168.2.175 18.104.22.168 ip nat inside source static 192.168.2.177 22.214.171.124 ip nat inside source static 192.168.2.178 126.96.36.199 ip nat inside source static 192.168.2.179 188.8.131.52
ip nat inside source static 192.168.2.75 184.108.40.206 route-map METRO_75 ip nat inside source static 192.168.2.77 220.127.116.11 route-map METRO_77 ip nat inside source static 192.168.2.78 18.104.22.168 route-map METRO_78 ip nat inside source static 192.168.2.79 22.214.171.124 route-map METRO_79
route-map METRO_79 permit 10 match ip address ACL_METRO_79 match interface GigabitEthernet0/1 route-map METRO_78 permit 10 match ip address ACL_METRO_78 match interface GigabitEthernet0/1 route-map METRO_75 permit 10 match ip address ACL_METRO_75 match interface GigabitEthernet0/1 route-map METRO_77 permit 10 match ip address ACL_METRO_77 match interface GigabitEthernet0/1
IT_2821_Primario#sh access-l ACL_METRO_79 Extended IP access list ACL_METRO_79 10 deny ip host 192.168.2.79 192.168.32.0 0.0.0.255 20 permit ip host 192.168.2.79 any (89966 matches) IT_2821_Primario#sh access-l ACL_METRO_78 Extended IP access list ACL_METRO_78 10 deny ip host 192.168.2.78 192.168.32.0 0.0.0.255 20 permit ip host 192.168.2.78 any (885581 matches) IT_2821_Primario#sh access-l ACL_METRO_77 Extended IP access list ACL_METRO_77 10 deny ip host 192.168.2.77 192.168.32.0 0.0.0.255 20 permit ip host 192.168.2.77 any IT_2821_Primario#sh access-l ACL_METRO_75 Extended IP access list ACL_METRO_75 10 deny ip host 192.168.2.75 192.168.32.0 0.0.0.255 20 permit ip host 192.168.2.75 any (139666 matches)
I have only 4 servers (.75 is .175, .77 is .177 and so on), so that every server can have an IP assigned from both ISPs.
The problem that I'm having is that I want the server to be accesible from any of the two Internet connections (DNS is replicated to both public IPs), but the servers get out to the Internet getting PAT'ed to the outside IP address of the Router.
Let's take for example server 192.168.2.79
When someone try to reach this server, it will use any IP 126.96.36.199 or 188.8.131.52
But when the server gets out to the Internet, it gets translated as part of the inside computers to the outside IP of the router.
Is this causing the problem? How do I let the servers to be reachable from both links and make them response through the appropiate link as well?
This document gives several answers on frequently asked questions for PFRv3 channel state behavior.
Q1: What are all the channel operational states from a BR (border role) perspective and what are the rules/conditions to be in each st...
The need was to reach an host inside a LAN through a VPN connection managed by the LAN gateway (Cisco 1921).
The LAN gateway performs NAT and there was a dedicate nat rule for the host i wanted to reach through VPN.
I couldn't connect to the hos...
We have 3 identical switches configured by someone else and would like to claim some of the Gigabit ports(G1/G2/G3/G4) for use on servers. When we try to change the wiring and configuration, we run in to connectivity issues. Attached is a des...