Internet for VLAN

[frederick.mercado]

We are running a 9300 switch that is doing L3 inter vlan/ip routing. I have tried multiple configurations but cannot seem to get clients to get out to the internet. We would like to get our internet only VLAN xxx to allow users in VLAN xxx to go out.

Essentially NATing (masquerading?) their internal IPs of 10.74.xxx.x (Gw .250 and .0 sub) to a single external IP (207.xx.xx.x /.248 sub) to get out to the internet. I connected a cable from our ISP switch to our L3 switch and need a good example port configuration. Clients are connecting via MOBILE SSID and getting DHCP and RADIUS successfully internally, but we want their internet traffic to use the ISP. 

[balaji.bandi]

here is example : (never tried on cat 9300)

https://www.cisco.com/c/en/us/support/docs/switches/catalyst-9300-series-switches/217419-configure-and-verify-nat-on-catalyst-900.html

[frederick.mercado]

I saw this, but nothing on how to apply to VLANs. 

[Jon Marshall]

It would basically be the same ie. an SVI is just a L3 interface so in the document they are using physical interfaces but you should be able to apply the NAT commands to the SVIs eg. 

int vlan <vlan ID>
ip address x.x.x.x y.y.y.y
ip nat inside

etc.

Jon

[frederick.mercado]

seems I applied as such to my config below. What would be incorrect?

[balaji.bandi]

If you like to apply NAT config basic rule is  for that  VLAN  should belong to Physical port first , then you can add SVI Interace, if the Physical port in Layer3 interface, SVI VLAN not going to work

Also are you looking inside and outside  both VLAN SVI ?

can you post show run complete, so we can suggest better.

[Flavio Miranda]

Check you licensing:

"With Cisco IOS® XE 16.12.1 NAT is now available on the Network Advantage license. On all earlier releases, it is available on the DNA Advantage license."

[frederick.mercado]

I have 16.12.4 ios

[frederick.mercado]

I believe the issue is I may need a good example configuration of how to setup both VLANs (public and private) and NAT settings.

[frederick.mercado]

I have cable from ISP switch a cable going from WLC on L2/L3 interface.

[balaji.bandi]

Do you have HSRP, how is your network diagram look like ?

for setup to work, start with basic ACL and start building once working basic setup.

post show run (fuill config)

[frederick.mercado]

Yes we do HSRP. VLAN xxx is not configured a such for ISP.

VLAN xxx is.

[frederick.mercado]

Removed

[Jon Marshall]

You have applied the same acl to multiple interfaces in both directions which really doesn't make sense as well as the last two lines being redundant as "permit ip any any" covers those. 

For the NAT you need to define the traffic and configure a NAT statement so in the document look at the dynamic NAT overload (PAT) section ie. create an acl for the traffic you want to NAT and then a NAT statement as in the document. 

Jon

[frederick.mercado]

We do not want ISP traffic to reach other VLANs, any good recommendations?