I have a Cisco ISR 4400 series with a very simple set up. I have an inside LAN interface and a WAN interface. When IP NAT outside is on my WAN facing interface, my LAN can access the internet, however, I can not SSH or Ping the WAN interface from the internet. If I remove IP NAT Outside from my WAN interface, I obviously lose internet connection for my LAN but am able to ping and ssh from the internet into my router.... I am pulling my hair out over this - please help!
Building configuration...
Current configuration : 3780 bytes
!
! Last configuration change at 12:36:19 UTC Fri Apr 27 2018 by xxx
!
version 15.5
service timestamps debug datetime msec
service timestamps log datetime msec
no platform punt-keepalive disable-kernel-core
!
hostname Orange
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
!
no aaa new-model
!
!
!
no ip domain lookup
ip domain name rtr.xx.com
ip dhcp excluded-address 10.0.25.1 10.0.25.49
!
ip dhcp pool internal-lan
import all
network 10.0.25.0 255.255.255.0
default-router 10.0.25.1
dns-server 8.8.8.8
domain-name xx-xx.com
!
!
!!
subscriber templating
!
multilink bundle-name authenticated
!
license udi pid ISR4451-X/K9 sn FOC211587U8
license boot level securityk9
!
spanning-tree extend system-id
!
username xx privilege 15 password 0 xx
!
redundancy
mode none
!
!
vlan internal allocation policy ascending
!
!
class-map type inspect match-any inside-outside-class
match protocol tcp
match protocol udp
match protocol icmp
match protocol dns
match protocol http
match protocol https
class-map type inspect match-any outside-inside-class
match protocol tcp
match protocol udp
match protocol icmp
match protocol http
match protocol https
match protocol dns
class-map type inspect match-any out-self-class
match protocol icmp
match protocol tcp
match protocol udp
match protocol http
match protocol https
class-map type inspect match-any self-out-class
match protocol icmp
match protocol tcp
match protocol udp
match protocol http
match protocol https
!
policy-map type inspect self-out-policy
class type inspect self-out-class
inspect
class class-default
drop log
policy-map type inspect outside-inside-policy
class type inspect outside-inside-class
inspect
class class-default
drop log
policy-map type inspect inside-outside-policy
class type inspect inside-outside-class
inspect
class class-default
drop log
policy-map type inspect out-self-policy
class type inspect out-self-class
inspect
class class-default
drop log
!
zone security outside
zone security inside
zone-pair security inside-outside source inside destination outside
service-policy type inspect inside-outside-policy
zone-pair security out-self source outside destination self
service-policy type inspect out-self-policy
zone-pair security outside-inside source outside destination inside
service-policy type inspect outside-inside-policy
zone-pair security self-out source self destination outside
service-policy type inspect self-out-policy
!
!
!
interface Loopback1
ip address 11.0.1.1 255.255.255.0
!
interface GigabitEthernet0/0/0
ip address 10.0.25.1 255.255.255.0
ip nat inside
zone-member security inside
negotiation auto
!
interface GigabitEthernet0/1/0
ip address 84.x.x.x 255.255.255.252
ip nat outside
zone-member security outside
negotiation auto
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
no ip address
shutdown
negotiation auto
!
interface Vlan1
no ip address
shutdown
!
ip nat inside source list 100 interface GigabitEthernet0/1/0 overload
ip forward-protocol nd
no ip http server
no ip http secure-server
ip tftp source-interface GigabitEthernet0
ip route 0.0.0.0 0.0.0.0 84..x.x.x
!
!
access-list 100 permit ip any any
!
!
!
control-plane
!
!
line con 0
logging synchronous
stopbits 1
line aux 0
stopbits 1
line vty 0 4
login local
transport input ssh
!
!
end
