Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
3253
Views
10
Helpful
19
Replies

Route traffic from an inside interface to access a web-server on another inside interface on a CISCO 2900

Go to solution
kar
Level 1
Level 1

‎02-26-2018 01:12 AM - edited ‎03-08-2019 02:01 PM

Hello eveyone,

 

I am a newb on the networking world. We have a cisco 2900 series router. We have configured three interfaces , two inside and one outside.(not done by me :) ) I have attached the running config file.

 

I am trying to give access to any one on the network 10.10.x.x to access a web-server on 192.168.x.x 

I did try couple of changes on the access list , but didn't work.

 

I am not sure if i am doing the right configuration or where to begin from.

 

let me know if you guys need any more information.

Labels:
Preview file
7 KB
0 Helpful
19 Replies 19

Go to solution
Deepak Kumar
VIP Alumni
VIP Alumni
In response to kar

‎02-27-2018 03:08 AM

Yes, You required.

 

Regards,

Deepak Kumar

Regards,
Deepak Kumar,
Don't forget to vote and accept the solution if this comment will help you!
0 Helpful

Go to solution
kar
Level 1
Level 1
In response to Deepak Kumar

‎02-27-2018 01:01 AM

For 192.168.1.189 which has a domain name record from desktop 10.10.1.181
Router#sho ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
+ - replicated route, % - next hop override

Gateway of last resort is IP1 to network 0.0.0.0

S* 0.0.0.0/0 [1/0] via IP1, GigabitEthernet0/2
10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 10.10.0.0/23 is directly connected, GigabitEthernet0/0
L 10.10.0.1/32 is directly connected, GigabitEthernet0/0
80.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C IP2/29 is directly connected, GigabitEthernet0/2
L PublicIP/32 is directly connected, GigabitEthernet0/2
192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.1.0/24 is directly connected, GigabitEthernet0/1
L 192.168.1.1/32 is directly connected, GigabitEthernet0/1


Router#sho ip access-lists
Standard IP access list 1
10 permit 10.10.0.0, wildcard bits 0.0.1.255 (278811 matches)
20 permit 192.168.1.0, wildcard bits 0.0.0.255 (214588 matches)
Standard IP access list 10
10 deny 10.10.0.0, wildcard bits 0.0.1.255
20 permit any
Standard IP access list 12
10 deny 192.168.1.0, wildcard bits 0.0.0.255
20 permit any
Standard IP access list 23
10 permit 10.10.0.0, wildcard bits 0.0.1.255 (139 matches)
Extended IP access list 100
10 permit tcp host 192.168.1.220 host PublicIP established log
Extended IP access list 101
10 permit ip any any (15519 matches)
Extended IP access list 111
10 permit ip 10.10.0.0 0.0.1.255 host 192.168.1.189 (56 matches)
20 deny ip 10.10.0.0 0.0.1.255 any (10837 matches)
30 permit ip any any (5771984 matches)
Extended IP access list 112
10 permit ip host 192.168.1.189 10.10.0.0 0.0.1.255 (48 matches)
20 deny ip 192.168.1.0 0.0.0.255 any (34 matches)
30 permit ip any any (7225704 matches)
Extended IP access list 199
10 permit ip any any
Router#sho ip nat translations | include 10.10.1.181
tcp PublicIP:49114 10.10.1.181:49114 52.230.7.59:443 52.230.7.59:443
tcp PublicIP:2185 10.10.1.181:49118 52.230.7.59:443 52.230.7.59:443
tcp PublicIP:49136 10.10.1.181:49136 108.177.119.188:443 108.177.119.188:44 3
tcp PublicIP:49138 10.10.1.181:49138 146.148.4.23:443 146.148.4.23:443
tcp PublicIP:49532 10.10.1.181:49532 108.177.126.188:5228 108.177.126.188:5 228
tcp PublicIP:49561 10.10.1.181:49561 52.230.84.217:443 52.230.84.217:443
tcp PublicIP:2565 10.10.1.181:49776 23.8.103.64:443 23.8.103.64:443
tcp PublicIP:49777 10.10.1.181:49777 52.22.85.101:443 52.22.85.101:443
tcp PublicIP:49778 10.10.1.181:49778 23.212.6.114:443 23.212.6.114:443
tcp PublicIP:49784 10.10.1.181:49784 93.184.221.200:443 93.184.221.200:443
tcp PublicIP:2749 10.10.1.181:49796 138.91.254.234:443 138.91.254.234:443
tcp PublicIP:2750 10.10.1.181:49797 138.91.254.234:443 138.91.254.234:443
tcp PublicIP:49805 10.10.1.181:49805 172.217.17.74:80 172.217.17.74:80
tcp PublicIP:2262 10.10.1.181:49806 172.217.17.74:80 172.217.17.74:80
tcp PublicIP:2317 10.10.1.181:49807 157.240.13.35:443 157.240.13.35:443
tcp PublicIP:49808 10.10.1.181:49808 157.240.13.19:443 157.240.13.19:443
tcp PublicIP:2431 10.10.1.181:49809 54.231.81.16:443 54.231.81.16:443
tcp PublicIP:2480 10.10.1.181:49810 54.231.81.16:443 54.231.81.16:443
tcp PublicIP:49811 10.10.1.181:49811 144.2.193.69:443 144.2.193.69:443
tcp PublicIP:49812 10.10.1.181:49812 52.84.225.116:80 52.84.225.116:80
tcp PublicIP:49813 10.10.1.181:49813 52.84.225.116:80 52.84.225.116:80
tcp PublicIP:49815 10.10.1.181:49815 40.68.222.212:443 40.68.222.212:443
tcp PublicIP:49816 10.10.1.181:49816 40.68.222.212:443 40.68.222.212:443
udp PublicIP:50395 10.10.1.181:50395 172.217.17.78:443 172.217.17.78:443
udp PublicIP:51308 10.10.1.181:51308 94.200.200.200:53 94.200.200.200:53
udp PublicIP:53124 10.10.1.181:53124 108.177.127.147:443 108.177.127.147:44 3
udp PublicIP:1049 10.10.1.181:53125 172.217.17.72:443 172.217.17.72:443
udp PublicIP:54047 10.10.1.181:54047 108.177.127.189:443 108.177.127.189:44 3
udp PublicIP:54362 10.10.1.181:54362 94.200.200.200:53 94.200.200.200:53
udp PublicIP:54422 10.10.1.181:54422 172.217.17.78:443 172.217.17.78:443
udp PublicIP:54424 10.10.1.181:54424 172.217.17.78:443 172.217.17.78:443
udp PublicIP:54689 10.10.1.181:54689 94.200.200.200:53 94.200.200.200:53
udp PublicIP:54690 10.10.1.181:54690 172.217.17.78:443 172.217.17.78:443
udp PublicIP:54691 10.10.1.181:54691 172.217.17.78:443 172.217.17.78:443
udp PublicIP:54756 10.10.1.181:54756 108.177.127.189:443 108.177.127.189:44 3
udp PublicIP:54758 10.10.1.181:54758 108.177.126.94:443 108.177.126.94:443
udp PublicIP:54868 10.10.1.181:54868 172.217.17.78:443 172.217.17.78:443
udp PublicIP:55687 10.10.1.181:55687 108.177.127.189:443 108.177.127.189:44 3
udp PublicIP:56064 10.10.1.181:56064 94.200.200.200:53 94.200.200.200:53
udp PublicIP:56217 10.10.1.181:56217 94.200.200.200:53 94.200.200.200:53
udp PublicIP:56218 10.10.1.181:56218 216.58.211.106:443 216.58.211.106:443
udp PublicIP:57262 10.10.1.181:57262 172.217.17.78:443 172.217.17.78:443
udp PublicIP:58151 10.10.1.181:58151 94.200.200.200:53 94.200.200.200:53
udp PublicIP:58301 10.10.1.181:58301 216.58.211.106:443 216.58.211.106:443
udp PublicIP:58991 10.10.1.181:58991 172.217.17.78:443 172.217.17.78:443
udp PublicIP:59013 10.10.1.181:59013 172.217.17.74:443 172.217.17.74:443
udp PublicIP:59278 10.10.1.181:59278 94.200.200.200:53 94.200.200.200:53
udp PublicIP:60076 10.10.1.181:60076 94.200.200.200:53 94.200.200.200:53
udp PublicIP:60132 10.10.1.181:60132 108.177.127.189:443 108.177.127.189:44 3
udp PublicIP:60207 10.10.1.181:60207 94.200.200.200:53 94.200.200.200:53
udp PublicIP:1090 10.10.1.181:61111 108.177.127.189:443 108.177.127.189:44 3
udp PublicIP:62920 10.10.1.181:62920 94.200.200.200:53 94.200.200.200:53
udp PublicIP:63119 10.10.1.181:63119 94.200.200.200:53 94.200.200.200:53
udp PublicIP:63120 10.10.1.181:63120 108.177.127.189:443 108.177.127.189:44 3
udp PublicIP:63847 10.10.1.181:63847 94.200.200.200:53 94.200.200.200:53
udp PublicIP:63918 10.10.1.181:63918 94.200.200.200:53 94.200.200.200:53
udp PublicIP:64842 10.10.1.181:64842 108.177.126.94:443 108.177.126.94:443
udp PublicIP:64905 10.10.1.181:64905 94.200.200.200:53 94.200.200.200:53

0 Helpful

Go to solution
Seb Rupik
VIP Alumni
VIP Alumni

‎02-26-2018 01:42 AM - edited ‎02-26-2018 01:46 AM

Hi there,

Gi0/0 has an ACL configured for outgoing packets which will drop all traffic from 10.10.0.0 /23.

 

If you want the traffic to be permitted, try the following:

!
access-list 101 permit ip 10.10.0.0 0.0.1.255 host <IP-of-webserver>
access-list 101 deny ip 10.10.0.0 0.0.1.255 any
access-list 101 permit ip any any
!
int gi0/1
  no ip access-group 101 out
!

 

cheers,

Seb.

0 Helpful

Go to solution
kar
Level 1
Level 1
In response to Seb Rupik

‎02-26-2018 02:24 AM

Hello Seb,

I will try and let you know.
0 Helpful

Go to solution
Seb Rupik
VIP Alumni
VIP Alumni
In response to kar

‎02-26-2018 03:10 AM

You will also need to adjust the other ACL on Gi0/0 to permit the return traffic:

 

!
int gi0/0
  ip access-group 102 out
!
access-list 102 permit ip host <IP-of-webserver> 10.10.0.0 0.0.1.255 
access-list 102 deny ip 192.168.1.0 0.0.0.255 any
access-list 102 permit ip any any
!
0 Helpful
Customers Also Viewed These Support Documents
Review Cisco Networking for a $25 gift card