Hi Cadet Alain,
here is a cut down version of the config.
As I am using CPP most of the stuff is pretty much bulk standard.
As per prior comments I have put both of the 192.168.x.0/255 address spaces into the PRIVATE-ZONE
As both the GigabitEthernet and FastEthernet interfaces are "inside" NAT and also in the same zone. I would expect all to be ok..
I have also looked the arp entries following doing PINGS and it shows entries for both IP addresses on the 192.168.1.0/24 network and the 192.168.223.0/24 network.
Could it be that the router is not routing the 192.168 address spaces as these are "non-routable" addresses?
Also I an ping 192.168.1.1 device but not the 192.168.1.136 device.
I can also do a "dig @192.168.1.1 www.google.com" and get an anwser, but I cannot do http to 192.168.1.1... so this is really puzzling. The 192.168.1.1 device is a Netgear VPN box, in which I have put static routes for 192.168.223.0/24 network.
!
! Last configuration change at 09:54:58 UTC Mon Jan 16 2012 by admin
!
version 15.1
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname big
!
boot-start-marker
boot-end-marker
!
!
…
…
!
!
!
ip dhcp excluded-address XX.XX.XX.1 XX.XX.XX.49
ip dhcp excluded-address XX.XX.XX.71 XX.XX.XX.254
ip dhcp excluded-address XX.XX.XX.71 XX.XX.XX.126
ip dhcp excluded-address 192.168.223.1 192.168.223.99
ip dhcp excluded-address 192.168.223.126 192.168.223.254
!
!
!
no ip bootp server
ip domain name DOG.com
ip name-server 139.XX.XX.XX
ip name-server 203.XX.XX.XX
ip inspect log drop-pkt
ip inspect audit-trail
ip inspect name CCP_MEDIUM appfw CCP_MEDIUM
...
!
multilink bundle-name authenticated
!
…
…
!
redundancy
!
!
!
!
ip tcp synwait-time 10
no ip ftp passive
!
…
...
!
zone security dmz-zone
zone security in-zone
zone security out-zone
zone security PRIVATE-ZONE
…
…
interface Null0
no ip unreachables
!
interface GigabitEthernet0/0
description $ETH-LAN$
ip address 203.XX.XX.130 255.255.255.224
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip flow ingress
ip nat outside
ip virtual-reassembly in
zone-member security in-zone
duplex auto
speed auto
no mop enabled
!
interface GigabitEthernet0/1
description $ETH-LAN$
ip address 192.168.223.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat inside
ip virtual-reassembly in
zone-member security PRIVATE-ZONE
duplex auto
speed auto
no mop enabled
!
interface FastEthernet0/2/0
description $ETH-LAN$
ip address 192.168.1.160 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat inside
ip virtual-reassembly in
zone-member security PRIVATE-ZONE
duplex auto
speed auto
no mop enabled
!
interface FastEthernet0/2/1
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
shutdown
duplex auto
speed auto
no mop enabled
!
interface ATM0/3/0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
no atm ilmi-keepalive
!
interface ATM0/3/0.1 point-to-point
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface GigabitEthernet0/0/0
!
interface GigabitEthernet0/0/1
!
interface GigabitEthernet0/0/2
!
interface GigabitEthernet0/0/3
!
interface Vlan1
description $ETH-4ESG$$INTF-INFO-10/100/1000 Ethernet$$ETH-LAN$FW-DMZ$
ip address 203.XX.XX.1 255.255.255.128
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip flow ingress
ip flow egress
ip nat outside
ip virtual-reassembly in
zone-member security dmz-zone
!
interface Dialer0
description $FW_OUTSIDE$
ip address XX.XX.XX.XX 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip flow egress
ip nat outside
ip virtual-reassembly in
zone-member security out-zone
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname XXXXXX
ppp chap password 7 XXXXX
ppp pap sent-username XXXXXX password 7 XXXXXX
service-policy input sdmappfwp2p_CCP_MEDIUM
service-policy output sdmappfwp2p_CCP_MEDIUM
!
ip forward-protocol nd
!
ip http server
ip http authentication local
ip http secure-server
ip flow-top-talkers
top 200
sort-by bytes
cache-timeout 500
!
ip dns server
ip nat pool NAT-POOL1 203.XX.XX.161 203.XX.XX.189 netmask 255.255.255.224
ip nat inside source route-map SDM_RMAP_1 pool NAT-POOL1
ip route 0.0.0.0 0.0.0.0 165.XXX.XX.1
ip route 192.168.1.0 255.255.255.0 FastEthernet0/2/0 permanent
ip route 192.168.223.0 255.255.255.0 GigabitEthernet0/1 permanent
ip route 203.XX.XX.0 255.255.255.128 Vlan1 permanent
ip route 203.XX.XX.128 255.255.255.224 GigabitEthernet0/0 permanent
ip route 203.XX.XX.160 255.255.255.224 Loopback0 permanent
!
!
logging 203.XX.XX.XX
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 192.168.223.0 0.0.0.255
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 100 remark CCP_ACL Category=128
access-list 100 permit ip host 255.255.255.255 any
access-list 100 permit ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip XXX.XXX.XXX.0 0.0.0.255 any
access-list 100 permit ip XX.XX.XX.0 0.0.0.255 any
access-list 102 remark CCP_ACL Category=2
access-list 102 permit ip 192.168.223.0 0.0.0.255 any
access-list 102 permit ip 192.168.1.0 0.0.0.255 any
dialer-list 1 protocol ip permit
!
no cdp run
...
!
!
!
route-map SDM_RMAP_1 permit 1
match ip address 102
!
!
!
control-plane
!
...
ntp update-calendar
ntp server 192.189.54.17
ntp server 192.189.54.33
ntp server 203.161.12.165
ntp server 130.102.2.123
end
