This is driving me crazy, it's been a solid decade since I administered a Cisco router so perhaps I am doing something really dumb.
The situation is this: I can ping and ssh between the local subnets (wired and wireless). From the router itself, I can ping and lookup hostnames, thus implying TCP and UDP are operational per se.
However, I cannot get any traffic BESIDES ICMP ping to flow from local subnets to the Internet. The NAT translations are there. I can see the packets come back by setting up a packet-trace for ingress on the WAN interface, it says 'punted' which I think on these newer routers just means handing off the CEF? Also, In
sh ip nat stat
I can see thousands of "Out-To-In Drops". I have no idea why they are getting dropped. I thought that without an ACL on the WAN interface, things are permitted by default? What am I missing? Here is my config:
version 16.7
service timestamps debug datetime msec
service timestamps log datetime msec
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname router
!
boot-start-marker
boot-end-marker
!
!
no logging console
enable password password
!
no aaa new-model
!
ip name-server 1.1.1.1 8.8.8.8
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.20.1 192.168.20.49
ip dhcp excluded-address 192.168.30.1 192.168.30.49
!
ip dhcp pool wired
network 192.168.20.0 255.255.255.0
default-router 192.168.20.1
dns-server 1.1.1.1 8.8.8.8
domain-name mydomain.com
!
ip dhcp pool wireless
network 192.168.30.0 255.255.255.0
default-router 192.168.30.1
dns-server 1.1.1.1 8.8.8.8
domain-name mydomain.com
!
!
!
!
!
!
!
!
!
!
subscriber templating
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
license udi pid C1113-8PLTEEAWB sn XXXXXXXXXXX
no license smart enable
!
diagnostic bootup level minimal
!
spanning-tree extend system-id
!
!
!
redundancy
mode none
!
controller Cellular 0/2/0
lte modem link-recovery rssi onset-threshold -110
lte modem link-recovery monitor-timer 20
lte modem link-recovery wait-timer 10
lte modem link-recovery debounce-count 6
!
controller VDSL 0/3/0
!
!
vlan internal allocation policy ascending
!
!
!
!
!
!
interface GigabitEthernet0/0/0
description isp
ip address xx.xx.xx.xx 255.255.255.252
ip nat outside
negotiation auto
!
interface GigabitEthernet0/1/0
switchport access vlan 20
!
interface GigabitEthernet0/1/1
switchport access vlan 20
!
interface GigabitEthernet0/1/2
switchport access vlan 20
!
interface GigabitEthernet0/1/3
switchport access vlan 20
!
interface GigabitEthernet0/1/4
switchport access vlan 20
!
interface GigabitEthernet0/1/5
switchport access vlan 20
!
interface GigabitEthernet0/1/6
switchport access vlan 20
!
interface GigabitEthernet0/1/7
switchport access vlan 20
!
interface Wlan-GigabitEthernet0/1/8
switchport access vlan 30
!
interface Cellular0/2/0
no ip address
!
interface Cellular0/2/1
no ip address
!
interface ATM0/3/0
no ip address
no atm enable-ilmi-trap
!
interface Ethernet0/3/0
no ip address
no negotiation auto
!
interface Vlan1
no ip address
!
interface Vlan20
description wired
ip address 192.168.20.1 255.255.255.0
ip nat inside
!
interface Vlan30
description wireless
ip address 192.168.30.1 255.255.255.0
ip nat inside
!
ip nat pool isp xx.xx.xx.xx xx.xx.xx.xx netmask 255.255.255.252
ip nat inside source list 20 pool isp overload
ip nat inside source list 30 pool isp overload
ip forward-protocol nd
no ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 x.x.x.x
!
!
access-list 20 permit 192.168.20.0 0.0.0.255
access-list 20 remark NAT Allow for Wired
access-list 30 permit 192.168.30.0 0.0.0.255
access-list 30 remark NAT Allow for Wireless
!
!
!
!
control-plane
!
!
line con 0
transport preferred none
transport input none
stopbits 1
line vty 0 4
login
!
wsma agent exec
!
wsma agent config
!
wsma agent filesys
!
wsma agent notify
!
!
end
