help debugging a simple nat setup

[benlemasurier]

I'm having touble setting up NAT translations in what appears to be a simple senario. From the router I'm able to ping to the outside world, though clients behind ge0/1 are not.

[Internal LAN 10.10.10.0/26] -> [ ge 0/1 10.10.10.1] ( cisco 2911) -> [ ge 0/0 external.ip.address] -> [internet]

Attached is the router config, any thoughts?

[Yudong Wu]

I don't see any thing wrong in your configuration.

Can you try to move "ip nat inside" command and then apply it back to see if it can fix it?

If not, maybe run some debug like "debug ip nat" and "debug ip packet" .

[benlemasurier]

Thanks Yudong,

Still no luck, here's the 'debug ip packet' output from a host pinging to the outside world:

Feb 21 23:15:40.903: IP: s=10.10.10.60 (GigabitEthernet0/1), d=8.8.8.8, len 84, input feature, Virtual Fragment Reassembly After IPSec Decryption(34), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Feb 21 23:15:40.903: IP: s=10.10.10.60 (GigabitEthernet0/1), d=8.8.8.8, len 84, input feature, MCI Check(66), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Feb 21 23:15:40.919: IP: s=10.10.10.60 (GigabitEthernet0/1), d=8.8.8.8, len 84, input feature, Stateful Inspection(4), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Feb 21 23:15:40.919: IP: s=10.10.10.60 (GigabitEthernet0/1), d=8.8.8.8, len 84, input feature, Virtual Fragment Reassembly(22), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Feb 21 23:15:40.919: IP: s=10.10.10.60 (GigabitEthernet0/1), d=8.8.8.8, len 84, input feature, Virtual Fragment Reassembly After IPSec Decryption(34), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Feb 21 23:15:40.919: IP: s=10.10.10.60 (GigabitEthernet0/1), d=8.8.8.8, len 84, input feature, MCI Check(66), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Feb 21 23:15:40.931: IP: s=10.10.10.60 (GigabitEthernet0/1), d=8.8.8.8, len 84, input feature, Stateful Inspection(4), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Feb 21 23:15:40.931: IP: s=10.10.10.60 (GigabitEthernet0/1), d=8.8.8.8, len 84, input feature, Virtual Fragment Reassembly(22), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

'debug ip nat' has no output

[Yudong Wu]

If removing/reapplying "ip nat" command could not fix the issue and there is no "debug ip nat" output, it is most likely a bug. I would suggest you to try a latest code.