Unable to NAT to Internet (Cisco 2901)

GW M · ‎03-12-2012

I currently replaced my Cisco 831 with a Cisco 2901 running 151-4M1. On the LAN side, I can ping google and yahoo as well as others but I can't HTTP or FTP to them using IE. Is there something that I'm doing wrong? The config is the same as it was on the Cisco 831 and it worked fine.

!

! Last configuration change at 15:06:04 PCTime Mon Feb 20 2012

! NVRAM config last updated at 15:06:08 PCTime Mon Feb 20 2012

version 15.1

no service pad

service tcp-keepalives-in

service tcp-keepalives-out

service timestamps debug datetime msec localtime show-timezone

service timestamps log datetime msec localtime show-timezone

service password-encryption

service sequence-numbers

!

boot-start-marker

boot-end-marker

!

security authentication failure rate 3 log

security passwords min-length 6

logging buffered 51200

logging console critical

enable secret 5 $1$O3zs$8FK2nk1UL6qWNHigdl5GX.

!

aaa new-model

!

aaa authentication login vpnclientauth local

aaa authorization network vpngroupauth local

!

aaa session-id common

!

clock timezone PCTime -5 0

clock summer-time EDT recurring

!

no ipv6 cef

no ip source-route

ip cef

!

ip dhcp excluded-address 192.168.2.1 192.168.2.189

!

ip dhcp pool sdm-pool1

import all

network 192.168.2.0 255.255.255.0

default-router 192.168.2.1

!

interface GigabitEthernet0/0

description Outside GigabitEthernet0/0

ip address dhcp client-id GigabitEthernet0/0

ip access-group 103 in

no ip redirects

no ip unreachables

no ip proxy-arp

ip nat outside

ip virtual-reassembly in

duplex auto

speed auto

no cdp enable

no mop enabled

!

interface GigabitEthernet0/1

description Inside GigabitEthernet0/1 Default Gateway

ip address 192.168.2.1 255.255.255.0

ip access-group 102 in

no ip redirects

no ip unreachables

no ip proxy-arp

ip flow ingress

ip nat inside

ip virtual-reassembly in

duplex auto

speed auto

no cdp enable

no mop enabled

!

ip nat inside source route-map SDM_RMAP_1 interface GigabitEthernet0/0 overload

!

logging trap debugging

logging source-interface GigabitEthernet0/1

access-list 101 permit ip 192.168.2.0 0.0.0.255 any

no cdp run

!

route-map SDM_RMAP_1 permit 1

match ip address 101

John Blakley · ‎03-12-2012

Can you post your 102 acl? I have a feeling that you could be blocking dns traffic....

HTH, John *** Please rate all useful posts ***

Kimberly Adams · ‎03-12-2012

I see you have access-groups applied to both interfaces, but do not see the matching access-lists? Do they exist and if they do, then can you please post them? If not, then that would be a good first starting place to look.

Thanks,

Kimberly

Thanks and Cheers! Kimberly Please remember to rate helpful posts.

GW M · ‎03-12-2012

Here is the 102 ACL

access-list 102 deny ip host 255.255.255.255 any

access-list 102 deny ip 127.0.0.0 0.255.255.255 any

access-list 102 permit ip any any

John Blakley · ‎03-12-2012

Are you statically assigning dns? Your dhcp pool doesn't have anything listed for it. If you're needing to get it from dhcp, you can add the following:

ip dhcp

dns-server

HTH, John *** Please rate all useful posts ***

GW M · ‎03-12-2012

I can resolve DNS names from the clients.

I also have DNS servers defined in config

ip name-server 24.92.226.11

ip name-server 24.92.226.12

GW M · ‎03-12-2012

When I run "debug ip nat detailed", I see the following. The client is 192.168.2.151. It is using a static IP and static default gateway (which is the Cisco 2901 router) and static DNS (which is the Cisco 2901 router). The router is acting as the DNS server for the clients.

001080: Mar 12 21:34:36.089 EDT: NAT: map match SDM_RMAP_1

001081: Mar 12 21:34:36.089 EDT: mapping pointer available mapping:0

001082: Mar 12 21:34:36.089 EDT: NAT: [0] Allocated Port for 192.168.2.151 -> 208.105.101.191: wanted 51603 got 51603

001083: Mar 12 21:34:36.089 EDT: NAT*: i: tcp (192.168.2.151, 51603) -> (204.160.125.126, 80) [20305]

001084: Mar 12 21:34:36.089 EDT: NAT*: i: tcp (192.168.2.151, 51603) -> (204.160.125.126, 80) [20305]

001085: Mar 12 21:34:36.089 EDT: NAT*: s=192.168.2.151->208.105.101.191, d=204.160.125.126 [20305]

001086: Mar 12 21:34:36.117 EDT: %SEC-6-IPACCESSLOGP: list 103 denied tcp 204.160.125.126(80) -> 208.105.101.191(51603), 1 packet

001087: Mar 12 21:34:36.341 EDT: NAT: map match SDM_RMAP_1

001088: Mar 12 21:34:36.341 EDT: mapping pointer available mapping:0

001089: Mar 12 21:34:36.341 EDT: NAT: [0] Allocated Port for 192.168.2.151 -> 208.105.101.191: wanted 51604 got 51604

001090: Mar 12 21:34:36.341 EDT: NAT*: i: tcp (192.168.2.151, 51604) -> (98.139.127.62, 80) [20308]

001091: Mar 12 21:34:36.341 EDT: NAT*: i: tcp (192.168.2.151, 51604) -> (98.139.127.62, 80) [20308]

001092: Mar 12 21:34:36.341 EDT: NAT*: s=192.168.2.151->208.105.101.191, d=98.139.127.62 [20308]

001093: Mar 12 21:34:37.333 EDT: NAT: expiring 208.105.101.191 (192.168.2.151) tcp 51585 (51585)

001094: Mar 12 21:34:37.333 EDT: NAT-SymDB: DB is either not enabled or not initiated.

001095: Mar 12 21:34:37.453 EDT: %SEC-6-IPACCESSLOGP: list 103 denied tcp 199.7.50.72(80) -> 208.105.101.191(51571), 1 packet

001096: Mar 12 21:34:38.357 EDT: NAT: expiring 208.105.101.191 (192.168.2.151) tcp 51586 (51586)

001097: Mar 12 21:34:38.357 EDT: NAT-SymDB: DB is either not enabled or not initiated.

001098: Mar 12 21:34:38.869 EDT: NAT: expiring 208.105.101.191 (192.168.2.191) tcp 743 (743)

001099: Mar 12 21:34:38.869 EDT: NAT-SymDB: DB is either not enabled or not initiated.

001100: Mar 12 21:34:38.869 EDT: %SEC-6-IPACCESSLOGP: list 103 denied tcp 217.156.169.160(80) -> 208.105.101.191(51578), 1 packet

What is "NAT-SymDB: DB is either not enabled or not initiated." and why is NAT: expiring?

kingkarlos85 · ‎05-02-2012

Hi mate, bit late to the discussion but thought I'd chime in for anyone else with a similar problem!

I don't think the problem is with NAT-SymDB, your NAT is working and the translations are happening and traffic is being fired off, but more with ACL 103 which is applied to your outside internet port (G0/0) and appears to be blocking all your return traffic.

Your own debug log points to that:

%SEC-6-IPACCESSLOGP: list 103 denied tcp 204.160.125.126(80) -> 208.105.101.191(51603), 1 packet

%SEC-6-IPACCESSLOGP: list 103 denied tcp 199.7.50.72(80) -> 208.105.101.191(51571), 1 packet

%SEC-6-IPACCESSLOGP: list 103 denied tcp 217.156.169.160(80) -> 208.105.101.191(51578), 1 packet

If you look, these are all coming from SOURCE port 80, so are probably the SYN, ACK responses from your initial packets getting slammed face first into ACL 103.

The Sym-DB errors and the Expiry are probably due to this - because there is no SYN, ACK response within a specific time period the router is removing the translation as it never established a session.

Hope this helps if you are still stuck with this mate, but fingers crossed you cracked it first!

Cheers, Karlos.

rizwanr74 · ‎05-02-2012

Hi there,

Please try this out.

ip inspect name FW tcp
ip inspect name FW udp

interface GigabitEthernet0/0
ip inspect FW in
ip inspect FW out

Please let me know, if that helps.

thanks