Hello,
I've got an issue that's been haunting me for awhile now. I had originally posted about it on another thread earlier in the month. Since it's separate from my original issue I figured I'd start a new discussion.
I've got a router with two public IP addresses configured. One of these is on a sub-interface. I've got a static nat setup for a single local IP that is supposed to route all traffic out over the sub-interface to the internet. As configured, I can only ping the LAN. No outside access for the static-nat host at all. Any pings to the internet hang.
So, at some point, I tried to add a route to the router, going from the host to the sub-interface. If I do this and then ping the local gateway, it hangs...but if I then remove that route I just added, everything works. I can access both the lan and the internet over that sub-interface. This lasts for a few hours. I can even reboot the server and reload the router and it STILL works. But after a few hours it stops working.
The command I issue on the router is: ip route 10.0.0.24 255.255.255.255 GigabitEthernet0/0/0.1
Issue that, ping 10.0.0.1 from the host...watch it hang. Issue no ip route 10.0.0.24 255.255.255.255 GigabitEthernet0/0/0.1 and ping instantly starts responding and the net is reachable.
I'm stumped. I'm going to post my router config below. I'm sure it's something stupid/obvious but I haven't worked on this stuff since 03. It's slowly coming back.
The end result I'm looking for is to have 10.0.0.24's traffic all come and go over sub-interface g0/0/0.1 with a public IP of 216.115.150.34
Config:
Current configuration : 6025 bytes
!
! Last configuration change at 19:09:18 UTC Thu Oct 31 2019
!
version 15.5
service timestamps debug datetime msec
service timestamps log datetime msec
no platform punt-keepalive disable-kernel-core
!
hostname Cerberus
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
enable secret 5 xxxxxxxxxxxxxxxxx
enable password xxxxxxxx
!
no aaa new-model
!
!
!
!
!
!
!
!
!
no ip domain lookup
no ip dhcp conflict logging
ip dhcp excluded-address 10.0.0.1
!
ip dhcp pool LanPool
network 10.0.0.0 255.255.255.0
default-router 10.0.0.1
domain-name Cerberus.Local
dns-server 8.8.8.8 8.8.4.4
!
ip dhcp pool SERVER
host 10.0.0.24 255.255.255.0
hardware-address e03f.49b1.a81e
default-router 10.0.0.1
domain-name Cerberus.Local
dns-server 8.8.8.8 8.8.4.4
!
!
!
ipv6 unicast-routing
ipv6 dhcp pool Proxy1001
dns-server 2001:4860:4860::8888
domain-name cerberus.local
!
ipv6 dhcp pool 32Block
dns-server 2001:4860:4860::8888
domain-name Cerberus
!
!
!
!
!
!
!
!
subscriber templating
multilink bundle-name authenticated
!
!
!
crypto pki trustpoint TP-self-signed-4242028752
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-4242028752
revocation-check none
rsakeypair TP-self-signed-4242028752
!
!
crypto pki certificate chain TP-self-signed-4242028752
certificate self-signed 01
xxxxxxxx
quit
license udi pid ISR4331/K9 sn FDO19321C50
spanning-tree extend system-id
!
!
redundancy
mode none
!
!
vlan internal allocation policy ascending
!
!
!
!
!
!
interface Loopback1
ip address 192.59.31.1 255.255.255.0
!
interface Tunnel0
description Hurricane Electric IPv6 Tunnel Broker
no ip address
ipv6 address 2001:472:1F0C:BF::2/64
ipv6 enable
tunnel source 216.115.150.175
tunnel mode ipv6ip
tunnel destination 209.51.163.34
!
interface GigabitEthernet0/0/0
ip address 216.115.150.175 255.255.255.192
ip nat outside
negotiation auto
ipv6 enable
!
interface GigabitEthernet0/0/0.1
encapsulation dot1Q 2
ip address 216.115.150.34 255.255.255.192
ip nat inside
!
interface GigabitEthernet0/0/1
ip address 10.0.0.1 255.255.255.0
ip nat inside
negotiation auto
ipv6 address 2602:56C0::1/35
ipv6 enable
ipv6 traffic-filter fromswitch in
ipv6 traffic-filter fromswitch out
!
interface GigabitEthernet0/0/1.2
encapsulation dot1Q 2
ipv6 address 2602:56C0:2000::1/35
ipv6 enable
!
interface GigabitEthernet0/0/1.3
encapsulation dot1Q 3
ipv6 address 2602:56C0:4000::1/35
ipv6 enable
!
interface GigabitEthernet0/0/1.4
encapsulation dot1Q 4
ipv6 address 2602:56C0:6000::1/35
ipv6 enable
!
interface GigabitEthernet0/0/1.5
encapsulation dot1Q 5
ipv6 address 2602:56C0:8000::1/35
ipv6 enable
!
interface GigabitEthernet0/0/1.6
encapsulation dot1Q 6
ipv6 address 2602:56C0:A000::1/35
ipv6 enable
!
interface GigabitEthernet0/0/1.7
encapsulation dot1Q 7
ipv6 address 2602:56C0:C000::1/35
ipv6 enable
!
interface GigabitEthernet0/0/1.8
encapsulation dot1Q 8
ipv6 address 2602:56C0:E000::1/35
ipv6 enable
!
interface GigabitEthernet0/0/2
ip address 144.176.124.242 255.255.255.252
negotiation auto
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
no ip address
shutdown
negotiation auto
!
interface Vlan1
no ip address
!
router bgp 397759
bgp log-neighbor-changes
no bgp default ipv4-unicast
neighbor 2001:472:1F0C:BF::1 remote-as 6939
neighbor 2001:472:1F0C:BF::1 update-source Tunnel0
!
address-family ipv4
exit-address-family
!
address-family ipv6
network 2602:56C0::/32
neighbor 2001:472:1F0C:BF::1 activate
exit-address-family
!
ip nat inside source list 1 interface GigabitEthernet0/0/0 overload
ip nat inside source static 10.0.0.24 216.115.150.34 extendable
ip forward-protocol nd
no ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 216.115.150.129
!
!
ip access-list extended BaseACL
permit icmp any any
ip access-list extended Manage-SSH
ip access-list extended NOSPOOF
permit icmp any any
permit ip any any
!
access-list 1 permit 10.0.0.0 0.0.255.255
access-list 101 permit icmp any any
access-list 105 permit ip 0.0.0.24 255.255.255.0 any
access-list 105 permit ip any any
ipv6 route 2602:56C0::/32 Tunnel0
ipv6 route ::/0 Tunnel0
!
snmp-server community public RO
!
!
ipv6 access-list fromswitch
permit ipv6 any any
!
control-plane
!
!
line con 0
stopbits 1
line aux 0
stopbits 1
line vty 0 4
access-class 1 in
password xxxxxxxxxx
login
line vty 5 15
access-class 1 in
login
!
!
end
