Hello,
our problem is quite similar to this one. What we want to achieve is to redirect the http traffic to one IP address. Here is our configuration (omited):
interface FastEthernet0/0
ip address 192.168.253.3 255.255.255.240 secondary
ip address 10.10.10.124 255.255.255.128
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
no cdp enable
!
interface Ethernet1/0
ip address 10.17.1.1 255.255.240.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip policy route-map dnat
duplex full
no cdp enable
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.10.10.2
no ip http server
no ip http secure-server
!
ip nat pool slb-srv 192.168.253.1 192.168.253.1 prefix-length 28 type rotary
ip nat inside source list internet-clients interface FastEthernet0/0 overload
ip nat inside destination list web pool slb-srv
!
ip access-list extended internet-clients
deny tcp any any eq www
permit ip 10.17.0.0 0.0.15.255 any
ip access-list extended web
permit tcp any any eq www
no cdp run
!
end
As you can see, we want all the traffic from the ACL internet-clients to be SNAT-ed to interface FE 0/0 and all the http traffic to be DNAT-ed to ip address 192.168.253.1.
As you can imagine this didn't work for us. What we see is that it simply doesn't NAT the http packets at all. ICMP and other traffic is OK (we can ping any site), but not http, we are not able to open any site.
Would greatly appreciate any help,
Dardan
