I have a Cisco 2911 ISR that has two separate WAN ports each used by a different VLAN behind the router.
Gi0/1 is statically connected to the first ISP via Dialer1. This network host all of our business IP traffic, including access to the Internet, Very shortly it will be used for Static-Dynamic IPSEC VPN ( This has not been configured yet)
Gi0/2 is a dynamically provided ISP connection that is meant for users on VLAN2 for personnel not business related network/internet access. FE0/0/0-8 are used to connect to the Cisco 3560 switch and to all the POE AP's we have on our facility. the AP's all have two SSID's assigned one SSID is for VLAN1 and one for VLAN2.
I currently have Internet connectivity thru VLAN1, I do not have internet connectivity thru VLAN2, I am able to ping the router that Gi0/2 in connected to using ping 192.168.1.1 (router address for network that Gi0/2 is connected) source VLAN2
I think I have an issue with my NAT policy? However I am not experienced enough to find it or make the right changes.
Running Config.
Current configuration : 4594 bytes
!
! No configuration change since last restart
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
enable secret 4 XXXXX
!
no aaa new-model
clock timezone PST -8 0
clock summer-time PST date Mar 10 2019 0:00 Nov 3 2019 0:00
clock calendar-valid
!
ip cef
!
!
!
ip dhcp excluded-address 192.168.10.1 192.168.10.60
ip dhcp excluded-address 192.168.20.1 192.168.20.60
!
ip dhcp pool VLAN2
network 192.168.20.0 255.255.255.0
default-router 192.168.20.1
dns-server 208.67.220.220 208.67.222.222
!
ip dhcp pool VLAN1
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 208.67.220.220 208.67.222.222
!
!
!
no ip domain lookup
ip multicast-routing
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
license udi pid CISCO2911/K9 sn FTX1620AH5A
license boot module c2900 technology-package securityk9
hw-module sm 1
!
!
!
vtp domain XXXXXX
vtp mode transparent
!
redundancy
!
!
!
!
!
vlan 2
!
!
!
!
!
!
!
!
!
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0/1
description BusinessUse
no ip address
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 10
!
interface GigabitEthernet0/2
description PersonnelUse
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
no routing dynamic
!
interface FastEthernet0/1/0
switchport trunk allowed vlan 1-3,1002-1005
switchport mode trunk
no ip address
!
interface FastEthernet0/1/1
switchport trunk allowed vlan 1-3,1002-1005
switchport mode trunk
no ip address
!
interface FastEthernet0/1/2
description Netgear AP Kitchen
switchport trunk allowed vlan 1,3,1002-1005
switchport mode trunk
no ip address
!
interface FastEthernet0/1/3
description Cisco AP Service Bay
switchport mode trunk
no ip address
!
interface FastEthernet0/1/4
description Cisco AP Data Room
switchport mode trunk
no ip address
!
interface FastEthernet0/1/5
description Cisco AP FCR
switchport mode trunk
no ip address
!
interface FastEthernet0/1/6
description Cisco AP Dayroom
switchport mode trunk
no ip address
!
interface FastEthernet0/1/7
description Cisco AP Gym
switchport mode trunk
no ip address
!
interface FastEthernet0/1/8
description Access VLAN2 only!!
switchport access vlan 2
no ip address
!
interface FastEthernet0/2/0
no ip address
!
interface FastEthernet0/2/1
no ip address
!
interface FastEthernet0/2/2
no ip address
!
interface FastEthernet0/2/3
no ip address
!
interface GigabitEthernet1/0
no ip address
shutdown
!
interface Vlan1
ip address 192.168.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip policy route-map PBR
!
interface Vlan2
ip address 192.168.20.1 255.255.255.0
ip helper-address 192.168.1.1
ip nat inside
ip virtual-reassembly in
ip policy route-map PBR
!
interface Dialer1
ip address negotiated
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 10
ppp authentication chap callin
ppp chap hostname XXXXXXXXX
ppp chap password 0 XXXXXXXX
ppp ipcp route default
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip nat inside source list 10 interface Dialer1 overload
ip nat inside source list 20 interface GigabitEthernet0/2 overload
!
ip access-list extended VLAN1
permit ip 192.168.10.0 0.0.0.255 any
ip access-list extended VLAN2
permit ip 192.168.20.0 0.0.0.255 any
!
kron occurrence reload-daily at 2:00 recurring
policy-list reload-daily
!
kron policy-list reload-daily
cli reload
!
access-list 10 permit 192.168.10.0 0.0.0.255
access-list 20 permit 192.168.20.0 0.0.0.255
!
route-map PBR permit 10
match ip address VLAN1
set ip next-hop verify-availability
!
route-map PBR permit 20
match ip address VLAN2
set ip next-hop 192.168.1.1
!
!
!
control-plane
!
!
!
line con 0
exec-timeout 30 0
password XXXXXXX
login
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line 67
no activation-character
no exec
transport preferred none
transport input all
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
flowcontrol software
line vty 0 4
privilege level 15
password XXXXX
login
transport input telnet ssh
transport output telnet ssh
!
scheduler allocate 20000 1000
!
end
