Router can ping by IP/domain, LAN (NAT) Client Can only ping by IP

[T_K]

I am having difficulty determining where my, apparent, DNS issue is occurring.  The 4331 is able to ping 8.8.8.8, and is able to ping www.google.com, but my LAN Client can only ping 8.8.8.8, LAN Client attempts to ping www.google.com indicate that the host cannot be found (Windows 10 Client with static DNS server 8.8.8.8 assigned, connected directly to 4331's GE 0/0/1 interface, Client performs as expected when connected directly to ISP GW and assigned the 4331's static IP address).  The 4331's configuration is, with some differences due to interface numbering and OS versions, the same as the 2851's that I am replacing (ACLs, IP Address, SM, GW of last resort, etc.)  My hope is that someone here will notice something that I have missed/am missing, or have some guidance on how to investigate this more efficiently than I have been able (over the past few days).  I have attached a sanitized copy of the 4331's configuration to this post.  Thank you for any assistance that you are able provide.

[T_K]

When I move it into production, I do not want my router to act as a dns server.  I am totally willing to have it do so to help isolate what is preventing my LAN clients from utilizing a public dns server though.  After adding "ip dns server" to the configuration the client is able to ping www.google.com.  

[balaji.bandi]

Since we are not sure about your setup here - what testing?

I am thinking now :

ISP----your old Router---New 4431 --your test client

When you replace the old router with this, you need to make your DHCP pool and DNS Server, Looks like you have your own DNS server in the network that will resolve the DNS.

Hopefully, you understand your setup better than us, so make some visual drawings so you are clear - on how your setup functions.

[T_K]

Crudely drawn layout of what I am trying to get working

[balaji.bandi]

test - if you have sill issue  post show run, show IP route, show IP interface brief

do nslookup google.com (see that resolved DNS)

ipconfig /all (post the output )

[T_K]

@balaji.bandi Thank you for your reply.  Client PC can ping 8.8.8.8.  All nslookups result in DNS request timeout, from initial command execution to specifying the server.  Please find the ip route and ip interface brief outputs attached.

[balaji.bandi]

if you able to ping and not able to nslookup 

2 reasons, May be provide blocking DNS resolution

providers only allow their DNS for security reason.

Can you try the below as suggested and post the output to understand the better issue ?

type in the command line nslookup

>server  151.164.1.8

>google.com  

[T_K]

Provider not blocking DNS on any of the other IP addresses belonging to this block and he router can ping by name.  Please find the nslookup information below

[balaji.bandi]

check ip routing - enabled

ip dhcp pool <Removed>
network 10.245.161.0 255.255.255.0
default-router 10.245.161.254
domain-name <RemovedA>.com
option 150 ip 10.245.161.6
dns-server 8.8.8.8  <- change, this to google DNS

check if this resolves the issue before you proceed further. (make sure the PC get the DHCP IP address)

do nslookup google.com (see that resolved DNS)

If still having issue ?

Do you have Pool of IP address from ISP ?

ip nat pool branch <RemovedJ> <RemovedJ> netmask 255.255.255.240
ip nat inside source list 120 pool branch overload

if not try below :

no ip nat pool branch <RemovedJ> <RemovedJ> netmask 255.255.255.240
no ip nat inside source list 120 pool branch overload

!

ip nat inside source list 120  interface GigabitEthernet0/0/0 overload

test - if you have sill issue  post show run, show IP route, show IP interface brief

[Baratheon]

Sorry to use your post to ask a question, I'm very sorry. Hi, friends, I would like to ask about the ACL settings. In the picture, I want both R1 and R2 to be able to ping the IT Router, and The IT Router cannot ping R1. I would like to ask you the specific ACL configuration method? No more trouble to guide, thank you.

[balaji.bandi]

@Baratheon   you are cross-posting not related to the issue, an open a new thread would be nice.

[MHM Cisco World]

ip dns server <<- add this and check result, if you want router to be your DNS server for all your client 
all above three point must config with this command

[T_K]

When I move this router into production, I will not want it to act as a DNS server; for testing purposes, adding ip dns server to the configuration does allow the client to ping by name.  Unfortunately, I havent been able to determine what is preventing the client from utilizing 8.8.8.8, directly, for dns resolution.

[balaji.bandi]

On your original config of DHCP Pool show you have DNS Server different IP - is that working?  if that is working for clients, then it should work on the new router too. but you do not make any clarity that you have DNS Server ? if you don't have use 8.8.8.8 google DNS and Test it.

ip dhcp pool <Removed>
network 10.245.161.0 255.255.255.0
default-router 10.245.161.254
domain-name <RemovedA>.com
option 150 ip 10.245.161.6
dns-server 10.245.161.15 10.245.165.5

[T_K]

That is correct, on the configuration that I posted, it lists the DNS servers that will be utilized by the client machines in the production network; I tried to leave the posted configuration as complete as possible and figured listing them would not have any  impact as I had statically set the DNS server to be 8.8.8.8 on the Client machine, moving the client machine to the production network allows it to utilize 8.8.8.8 without issue.  For testing, I am using google's DNS server 8.8.8.8 as there is no access to the production DNS servers.

[balaji.bandi]

That is correct, on the configuration that I posted, it lists the DNS servers that will be utilized by the client machines in the production network

if this works in an exciting environment, when you do cut over that should work as expected.  

OP -  2851's that I am replacing (ACLs, IP Address, SM, GW of last resort, etc.)   - So that is the conclusion.

On your picture for now instead of 4431 you have 2851 (if the client using same DNS working, when you replace that should work).