Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

NAT on sub-interface with no internet access

Good morning,

Please I have a router 2901, which I configured tow sub-interfaces for Voice and Data. Everything seems to be working fine but I can't access the internet after configuring NAT.

Config below


Router1#sh config
Using 5392 out of 262136 bytes
!
! No configuration change since last restart
! NVRAM config last updated at 16:15:07 UTC Wed Jul 2 2014 by aadmin
! NVRAM config last updated at 16:15:07 UTC Wed Jul 2 2014 by aadmin
version 15.2
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname A
!
boot-start-marker
boot-end-marker
!
!
! card type command needed for slot/vwic-slot 0/0
logging buffered 51200 warnings
enable secret 4 U3/EVMmZsx9ys3vbB8aDhHy.5h4qh2V8/DkTGNsxvTA
enable password 7 06150E2C5F5B071E
!
aaa new-model
!
!
aaa authentication login default local
!
!
!
!
!
aaa session-id common
memory-size iomem 25
!
ip cef
!
!
!
ip dhcp excluded-address 10.10.36.1 10.10.36.25
ip dhcp excluded-address 10.10.36.200 10.10.36.254
!
ip dhcp pool DATA
 network 10.10.36.0 255.255.255.0
 default-router 10.10.36.1
 dns-server 8.8.8.8 4.2.2.2
!
ip dhcp pool VOICE
 network 10.1.1.0 255.255.255.0
 default-router 10.1.1.1
 option 150 ip 10.10.36.4
!
!
!
no ipv6 cef
multilink bundle-name authenticated
!
!
!
!
!
!
crypto pki trustpoint TP-self-signed-3112445314
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-3112445314
 revocation-check none
 rsakeypair TP-self-signed-3112445314
!
!
crypto pki certificate chain TP-self-signed-3112445314
 certificate self-signed 01 nvram:IOS-Self-Sig#1.cer
voice-card 0
!
!
!
!
!
!
!
!
license udi pid CISCO2901/K9 sn FCZ1808C4L8
hw-module pvdm 0/0
!
!
!
username a password 7 1416111F05557C
username e privilege 15 password 7 1437455E0E2A25382525260B67
username c password 7 030B580E0701284F165B5C
username a password 7 01000709481E0808
!
redundancy
!
!
!
!
!
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$
 ip address #.#.#.58 255.255.255.248
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
 no keepalive
!

!
interface GigabitEthernet0/1
 no ip address
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto
 no keepalive
!
interface GigabitEthernet0/1.1
 encapsulation dot1Q 1 native
 ip address 10.10.36.1 255.255.255.0
 ip verify unicast reverse-path
 ip nat inside
 ip virtual-reassembly in

!
interface GigabitEthernet0/1.100
 encapsulation dot1Q 100
 ip address 10.1.1.1 255.255.255.0
!
ip forward-protocol nd
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat inside source list LAN_NAT_POLICY interface GigabitEthernet0/1.1 ov
ip route 0.0.0.0 0.0.0.0 #.#.#.57
!
ip access-list extended LAN_NAT_POLICY
 permit ip 10.0.0.0 0.255.255.255 any
!
access-list 23 permit 10.10.36.0 0.0.0.255
access-list 23 permit 10.10.0.0 0.0.0.255
access-list 23 permit 10.10.0.0 0.0.255.255
access-list 101 permit tcp 10.10.36.0 0.0.0.255 host 10.10.36.1 eq telnet
!
!
!
!
!
control-plane
!
 !
 !
 !
!
!
!
mgcp profile default
!
!
!
!
!
gatekeeper
 shutdown
!
!
banner exec ^C
% Password expiration warning.
-----------------------------------------------------------------------

Cisco Configuration Professional (Cisco CP) is installed on this device
and it provides the default username "cisco" for  one-time use. If you hav
already used the username "cisco" to login to the router and your IOS imag
supports the "one-time" user option, then this username has already expire
You will not be able to login to the router with this username after you e
this session.

It is strongly suggested that you create a new username with a privilege l
of 15 using the following command.

username <myuser> privilege 15 secret 0 <mypassword>

Replace <myuser> and <mypassword> with the username and password you want
use.

-----------------------------------------------------------------------
^C
banner login ^C
-----------------------------------------------------------------------
Cisco Configuration Professional (Cisco CP) is installed on this device.
This feature requires the one-time use of the username "cisco" with the
password "cisco". These default credentials have a privilege level of 15.

YOU MUST USE CISCO CP or the CISCO IOS CLI TO CHANGE THESE  PUBLICLY-KNOWN
CREDENTIALS

Here are the Cisco IOS commands.

username <myuser>  privilege 15 secret 0 <mypassword>
no username cisco

Replace <myuser> and <mypassword> with the username and password you want
to use.

IF YOU DO NOT CHANGE THE PUBLICLY-KNOWN CREDENTIALS, YOU WILL NOT BE ABLE
TO LOG INTO THE DEVICE AGAIN AFTER YOU HAVE LOGGED OFF.

For more information about Cisco CP please follow the instructions in the
QUICK START GUIDE for your router or go to http://www.cisco.com/go/ciscocp
-----------------------------------------------------------------------
^C
!
line con 0
 password 7 13041406025D52
line aux 0
 exec-timeout 0 1
 no exec
line 2
 no activation-character
 no exec
 transport preferred none
 transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
 stopbits 1
line vty 0 4
 access-class 23 in
 privilege level 15
 password 7 094D4D1D105441
 transport input telnet ssh
line vty 5 15
 access-class 23 in
 privilege level 15
 transport input telnet ssh
!
scheduler allocate 20000 1000
ntp master
ntp server 10.10.36.1
!
end

 

 

Please I need a quick response

Thank you.

5 REPLIES
Silver

Replace in here:ip nat inside

Replace in here:

ip nat inside source list LAN_NAT_POLICY interface GigabitEthernet0/1.1 ov

this gi 0/1.1 with gi 0/0

BR,

Dragan

HTH, Dragan
Community Member

Thanks Dragan llic,It worked

Thanks Dragan llic,

It worked fine, I also enabled nat on the sub_interface

Community Member

Can you change the interface

Can you change the interface to outside interface in this command

ip nat inside source list LAN_NAT_POLICY interface GigabitEthernet0/1.1 ov

can you try this below command

ip nat inside source list LAN_NAT_POLICY interface GigabitEthernet0/0 ov

 

Regards

PrajithTR

Community Member

Thanks

Thanks

Community Member

Please rate the comments if

Please rate the comments if it helped you

618
Views
8
Helpful
5
Replies
CreatePlease to create content