Route map and NAT config not working with 2 DSL circuits

[rgaleana06]

I have a 2921 router connected to 2 DSL circuits - DSL1 on gig0/1 and DSL2 on gig0/2.

I am using a route map to force individual hosts to use DSL2 for internet traffic.  I'm using a standard NAT overload statement with ACL to NAT on both DSL interfaces. 

All traffic to DSL1 is working as expected.  I see packets matching route-map DSL and being routed to DSL2, however I'm not seeing NAT translations for DSL2 interface.

Here's the config -

!

interface GigabitEthernet0/0.50

description Server VLAN

encapsulation dot1Q 50

ip address 10.5.0.1 255.255.255.0

no ip redirects

no ip unreachables

no ip proxy-arp

ip nat inside

ip virtual-reassembly in

ip policy route-map DSL

!

!        

interface GigabitEthernet0/1

description DSL1

ip address 71.189.199.201 255.0.0.0

ip nat outside

ip virtual-reassembly in

duplex full

speed auto

!        

interface GigabitEthernet0/2

description DSL2

ip address 173.60.176.18 255.255.255.0

ip nat outside

ip virtual-reassembly in

duplex auto

speed auto

!

ip nat inside source list 100 interface GigabitEthernet0/1 overload

ip nat inside source list 101 interface GigabitEthernet0/2 overload

ip route 0.0.0.0 0.0.0.0 71.189.199.1

!

ip access-list extended Test

deny   ip 10.5.0.0 0.0.255.255 192.168.0.0 0.0.255.255

deny   ip 10.5.0.0 0.0.255.255 10.0.0.0 0.255.255.255

deny   ip 10.5.0.0 0.0.255.255 172.16.0.0 0.15.255.255

permit ip host 10.5.0.11 any

!

access-list 100 deny   ip 192.168.22.0 0.0.0.255 192.168.0.0 0.0.255.255

access-list 100 deny   ip 192.168.22.0 0.0.0.255 10.0.0.0 0.255.255.255

access-list 100 deny   ip 192.168.22.0 0.0.0.255 172.16.0.0 0.15.255.255

access-list 100 permit ip 192.168.22.0 0.0.0.255 any

access-list 100 deny   ip 10.5.0.0 0.0.255.255 192.168.0.0 0.0.255.255

access-list 100 deny   ip 10.5.0.0 0.0.255.255 10.0.0.0 0.255.255.255

access-list 100 deny   ip 10.5.0.0 0.0.255.255 172.16.0.0 0.15.255.255

access-list 100 permit ip 10.5.0.0 0.0.255.255 any

access-list 101 deny   ip 10.5.0.0 0.0.255.255 192.168.0.0 0.0.255.255

access-list 101 deny   ip 10.5.0.0 0.0.255.255 10.0.0.0 0.255.255.255

access-list 101 deny   ip 10.5.0.0 0.0.255.255 172.16.0.0 0.15.255.255

access-list 101 permit ip 10.5.0.0 0.0.255.255 any

!

route-map DSL permit 60

match ip address Test

set ip next-hop 173.60.176.1 (default gateway for DSL2)

Show commands -

HUE-GW-01#show ip access-list

Extended IP access list 100

    10 deny ip 192.168.22.0 0.0.0.255 192.168.0.0 0.0.255.255

    20 deny ip 192.168.22.0 0.0.0.255 10.0.0.0 0.255.255.255

    30 deny ip 192.168.22.0 0.0.0.255 172.16.0.0 0.15.255.255

    40 permit ip 192.168.22.0 0.0.0.255 any

    50 deny ip 10.5.0.0 0.0.255.255 192.168.0.0 0.0.255.255

    60 deny ip 10.5.0.0 0.0.255.255 10.0.0.0 0.255.255.255

    70 deny ip 10.5.0.0 0.0.255.255 172.16.0.0 0.15.255.255

    80 permit ip 10.5.0.0 0.0.255.255 any (505 matches)

Extended IP access list 101

    10 deny ip 10.5.0.0 0.0.255.255 192.168.0.0 0.0.255.255

    20 deny ip 10.5.0.0 0.0.255.255 10.0.0.0 0.255.255.255

    30 deny ip 10.5.0.0 0.0.255.255 172.16.0.0 0.15.255.255

    40 permit ip 10.5.0.0 0.0.255.255 any

Extended IP access list Test

    10 deny ip 10.5.0.0 0.0.255.255 192.168.0.0 0.0.255.255 (2854 matches)

    20 deny ip 10.5.0.0 0.0.255.255 10.0.0.0 0.255.255.255 (4239 matches)

    30 deny ip 10.5.0.0 0.0.255.255 172.16.0.0 0.15.255.255

    40 permit ip host 10.5.0.11 any (201 matches)

HUE-GW-01#show route-map

route-map DSL, permit, sequence 60

  Match clauses:

    ip address (access-lists): Test

  Set clauses:

    ip next-hop 173.60.176.1

  Policy routing matches: 184 packets, 14947 bytes

Any thoughts?  Thanks in advance!

[santosh.g.byahatti]

Your access-list 100 matches the traffic 10.5.x.x which you want to NAT to DSL2, where as access-list 100 is overloaded(pat) to interface DSL1 interface.

Remove those ace's from access-list 100 so that they ll match overload statement for DSL2 interface.


Hope this helps

Sent from Cisco Technical Support iPhone App

[Richard Burts]

The problem with this solution is that it would not allow traffic from 10.5.0.0 to be translated if it is going out Gig 0/1. And most of the traffic from 10.5.0.0 would use Gig 0/1 given the config that was posted.

The better solution is to re-write the logic for address translation. Instead of just using access lists to control the NAT use route maps to control the NAT. In the route map you can have a match statement to match the interface and a second match statement to match the access list. That way access list 100 is used only with Gig 0/1 and access list 101 is used only with Gig 0/2. This should solve your problem.

HTH

Rick

[santosh.g.byahatti]

I would like to add to my previous post as I overlooked the route-map and. Access-list TEST.

There is a route-map matching traffic for a host in access-list TEST to set next hop as dsl2. But that matching is not correct, use the network 10.5.0.0 instead so that it will match the access-list TEST and in turn will nat it towards dsl2.



Sent from Cisco Technical Support iPhone App

[LukaszTJB]

Hello,

Could you post a 'show ip nat stat'. I assume that your nat configuration isn't correct. To use multiple outside nat interfaces you have to use route-maps in the ip nat configuration.

Ip nat inside source route-map interface gig0/2 overload

The route map should look like

Route-map dsl1-wan permit 10
Match interface gig0/2
Match ip address


Sent from Cisco Technical Support Android App