Help PBR problem with serial

[ekatscisco]

a customer with a netcafe bought a 2801 router with 2 ADSLs and 1 wic-1T. he wanted to pass internet and torrent traffic through ADSLs and games traffic through leased line.

I configured him PBR and works fine with 2 ADSLs but the serial int doesnot work. I am sure that this is a nat problem but i dont know how to fix it (i am not a pro :( ).

please take a look at the config file(the first 2 big ACLs are for ADSLs and i wrote at the bottom permit any to bypass PBR for now until it works with serial int)

[Jon Marshall]

You still haven't modified the 2 nat's for internet and torrent ie. in your config -

ip nat inside source list 2 interface Dialer0 overload

ip nat inside source list 3 interface Dialer1 overload

you need to modify these as per my previous post or else all Nats will be done on list 2 and therefore natted to dialer0.

One other thing. You are natting the games people to 193.92.54.225 -> 193.92.54.254. Are you sure that return traffic for this back to your router will be sent to the serial interface ? If you are not sure better to just nat the games people to the serial interface address in the same way you do with the dialer interfaces.

Jon

[ekatscisco]

ok jon but if i do something like this

ip nat inside source list 101 interface s0/2/0 overload

that doesnt mean that all the hosts will end up with the same static ip like ADSLs?

[Jon Marshall]

Yes they will all end up with the same IP ie. the IP address on the serial interface. If you are sure your NAT pool is routed back to the serial interface you don't have a problem.

Edit - just done a traceroute to 193.92.54.226 and it does end up at your serial interface so you can use that nat pool for games.

Jon

[ekatscisco]

ok i feel a lot of stress leaving my mind right now.

Then looks like the only think yet is to fix my ACLs as you have shown me.

May i ask you a really big favour?

Because i didnt realy understood the solution about the ACLs it would be too much if i was asking you to attach my config with this change because my problem is i cannot do mayour changes with that router now as the netcafe is full with kids and i cannot risk another internet drop.

If i am asking too much its ok, you have already helped much much more than i could imagine and i am gratefull for that.

[Jon Marshall]

There are a couple of issues.

1) You need to remove the old NAT statements to put new ones in. When you remove the old statements it's going to complain so you need a 5 min downtime if that's possible.

2) The games acl has permit ip any any which could create the same problems as before. So i have had to modify the games acl to deny all internet/torrent traffic before permitting any ip.

Give me about 5 minutes and i'll post up the config. The config i post you can cut and paste directly into the router - are you familiar with connecting to router via console cable or telnet ?. Sorry not familiar with SDM.

One other thing. Make sure you can revert back if needed so keep copy of existing config.

Jon

[ekatscisco]

jon you are the best i wish you could imagine how desperate i was before meeting you.

About the telnet, i've configured it in the router and i am working right now through it (by the way the dialer1 doesnt respond to telnet the last days, i guess is ACLs problem) and i know for restoring backup i need a TFTP but i dont know the cli commands and i dont really want to use sdm because the last time i did i spended a lot more time to clear the mess it did so its ok you are not familiar with this.

[Jon Marshall · Accepted solution]

Here are the modifications. Please read through before implementing and there will be an outage so you may have to schedule the change.

If you need to revert then simplest thing is just to change the "ip nat inside..." statements back to how you have it now and at least you will no worse off.

Jon

[ekatscisco]

jon i really dont know what words to use to show you how gratefull i am i hope my client stops yelling now. By the way the command ip virtual reassembly its ok to be at the serial int? or i will have problems?

[Jon Marshall]

"ip virtual reassembly"

fine to leave as is.

Don't thank me just yet as we haven't actually got it working properly at the moment :-)

Jon

[ekatscisco]

jon i am thanking you just for helping because you deserve it and you use your knowledge with patience helping nubies like me. But if bytheway works i invite you for lunch and coffe in greece :)

[Jon Marshall]

No problem, this is what NetPro is for and we have all been in these situations before where someones pressurising you to get it working.

Coffee in Greece - if i remember correctly from last time i was there it's strong stuff !!

[ekatscisco]

we have a perfect sunshine right now so think about it for vacations this summer far away from routers in a white beach with a beer in the hand. Luckily my local supplier became available to help me now before i try your solution which i am sure i will because he cannot find why my configuration dont work :P

[Jon Marshall]

Emmanuel

Many thanks for the ratings.

Would like to hear how you get on.

Jon

[ekatscisco]

please not thanking me the least i could do. About the configuration my local supplier has an appointment and stopped it but in 3-4 hours he will reconnect to check it out. I spoke with my client and he said that it would be disaster if i change something in the rooter right now and i have to wait for early the morning to do our changes, at about 14 hours from now :( . I hope jon to succeed my supplier when he retries today so i dont have this pressure on me until tomorow.