Hello all, I have had a hard time trying to get this figured out. Here is what I have. A 1841 router and a 3560g L2 switch. I have a block of 12 IP's from my ISP that I can use. What I want to accomplish is each of the 11 external ip's will be mapped to a user subnet. I am utilizing FA0/0 as my outside interface with the first external IP. then I have fa0/1.xx for sub interfaces. These sub interfaces match up with a vlan on the switch which is then trunked down to a server.
Cisco 1841
logging buffered 16384 debugging
!
aaa new-model
!
!
aaa authentication login default local
!
aaa session-id common
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 10.10.10.1 10.10.10.49
!
ip dhcp pool 66
import all
network 10.66.66.0 255.255.255.0
default-router 10.66.66.1
dns-server 10.10.66.1 8.8.8.8
!
ip dhcp pool 10
import all
network 10.10.10.0 255.255.255.0
default-router 10.10.10.1
dns-server 10.10.10.1 8.8.8.8
!
ip dhcp pool 43
import all
network 10.10.43.0 255.255.255.0
default-router 10.10.43.1
dns-server 202.67.222.222 8.8.8.8
!
ip dhcp pool 44
import all
network 10.10.44.0 255.255.255.0
default-router 10.10.44.1
dns-server 202.67.222.222 8.8.8.8
!
!
ip ssh version 2
!
!
!
username strato.adm password 7 142406192C107A282B252371
archive
path flash:
maximum 5
write-memory
time-period 10
!
!
!
!
!
interface FastEthernet0/0
description Outside
ip address xx.xx.xx.178 255.255.255.240
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet0/1
description Inside
no ip address
no ip route-cache cef
no ip route-cache
duplex auto
speed auto
no cdp enable
!
interface FastEthernet0/1.5
encapsulation dot1Q 5
ip address 10.10.5.1 255.255.255.0
ip nat inside
ip virtual-reassembly
no ip route-cache
!
interface FastEthernet0/1.8
encapsulation dot1Q 8
ip address 10.10.8.1 255.255.255.0
no ip route-cache
!
interface FastEthernet0/1.10
encapsulation dot1Q 10
ip address 10.10.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly
no ip route-cache
!
interface FastEthernet0/1.43
encapsulation dot1Q 43
ip address 10.10.43.1 255.255.255.0
ip nat inside
ip virtual-reassembly
no ip route-cache
!
interface FastEthernet0/1.44
encapsulation dot1Q 44
ip address 10.10.44.1 255.255.255.0
ip nat inside
ip virtual-reassembly
no ip route-cache
!
interface FastEthernet0/1.66
encapsulation dot1Q 66
ip address 10.66.66.1 255.255.255.0
ip nat inside
ip virtual-reassembly
no ip route-cache
!
interface Serial0/0/0
no ip address
shutdown
!
ip route 0.0.0.0 0.0.0.0 xx.xx.xx.177
!
!
no ip http server
no ip http secure-server
ip nat pool MGMT-HOME xx.xx.xx.178 xx.xx.xx.178 prefix-length 28
ip nat pool VNC 10.10.10.201 10.10.10.201 netmask 255.255.255.0 type rotary
ip nat pool client-44 xx.xx.xx.179.xx.xx.xx.179 prefix-length 28
ip nat inside source list MGMT-HOME interface FastEthernet0/0 overload
ip nat inside source route-map client-44-rmap pool client-44 overload
ip nat inside source static udp 10.66.66.47 1194 interface FastEthernet0/0 1194
ip nat inside source static tcp 10.10.10.201 3128 interface FastEthernet0/0 3128
ip nat inside source static tcp 10.10.10.201 8006 interface FastEthernet0/0 8006
ip nat inside source static tcp 10.10.10.201 22 interface FastEthernet0/0 22
ip nat inside destination list MGMT-HOME pool VNC
!
ip access-list extended MGMT-HOME
deny ip host 10.10.44.6 any
permit ip 10.10.10.0 0.0.0.255 any
permit ip 10.66.66.0 0.0.0.255 any
permit tcp any any range 5900 5999
ip access-list extended client-44-acl
permit ip host 10.10.44.6 any
route-map client-44-rmap permit 10
match ip address client-44-acl
I am able to ping 10.10.44.1 from the virtual machine inside the physical host that is trunked to the switch with vlan tag of 44 that routes to sub interface fa0/1.44 But I can not ping out to google. If I add
p access-list extended MGMT-HOME
permit ip 10.10.44.0 0.0.0.255 any
permit ip 10.10.10.0 0.0.0.255 any
permit ip 10.66.66.0 0.0.0.255 any
permit tcp any any range 5900 5999
then i can access google fine but i have always thought setting rmaps would work for something like I have and that traffic should hit the first acl, see it denied then go to the next and see it allowed for the other nat pool and allow it out.
Any help is greatly appreciated.
