Hello, I seem to be having an issue with Policy Based Routing on a Dialer interface.  I have the following two setups: A.  Cisco router with ADSL WIC - relevant configuration information interface ATM0/0/0   no ip address   no atm ilmi-keepalive   pvc 0/35     pppoe-client dial-pool-number 1 interface FastEthernet0/1   ip address x.x.x.x x.x.x.x   ip nat inside   ip policy route-map dialer1-access interface Dialer1   ip address negotiated   ip nat outside   encapsulation ppp   dialer pool 1 route-map dialer1-access permit 10   match ip address acl_dialer1_permit   set default interface Dialer1 B. Cisco router Ethernet interface connected to DSL modem via switch - relevant configuration information interface GigabitEthernet0/2.220   encapsulation dot1q 220   pppoe enable   pppoe-client dial-pool-number 10 interface GigabitEthernet0/1   ip address x.x.x.x x.x.x.x   ip nat inside   ip policy route-map dialer10-access interface Dialer10   ip address negotiated   ip nat outside   encapsulation ppp   dialer pool 10 route-map dialer10-access permit 10   match ip address acl_dialer10_access   set default interface Dialer10 There is no static default route (ip route 0.0.0.0 0.0.0.0) on either setup.  Setup A works for me successfully.   As configured, setup B does not seem to correctly 'route' the traffic (connection fails)?  If I add the following command to the Dialer interface, ppp ipcp route default then connections succeed but I believe this is because there is now a static default route installed which I don't want. Questions:  1. Is there a way around this?  2. Is this behaviour different when using PPPoE vs ATM? Thanks, Mike ... View more

Hello, I have a router with the following: 1. MPLS network for inter-site communication (all sites use RFC1918 addresses and eigrp for routing) 2. Cable modem internet access 3. DSL internet access 4. IOS version 15.1(4)M I am trying to accomplish the following: 1. Use the two internet connections in a load-balanced / failover setup 2. Only allow certain internal IP addresses access to these internet connections (policy based routing) 3. Do not insert a default route into the routing table I have reviewed the following: 1. IOS NAT Load-Balancing for Two ISP Connections http://www.cisco.com/en/US/tech/tk648/tk361/technologies_configuration_example09186a0080950834.shtml 2. IOS NAT Load-Balancing with Optimized Edge Routing for Two Internet Connections http://www.cisco.com/en/US/tech/tk648/tk361/technologies_configuration_example09186a00808d2b72.shtml Both of the above examples show inserting a default route in the configurations (breaking my rule 3). I have tried the configuration at the bottom, the problem I have run into: As configured below, the device that is allowed internet access will now attemp to use the internet connections for all traffic.  My issue seems to come from the fact that I have used set ip next-hop where instead I would like to use set ip default next-hop . The problem is that command does not have the verify-availability <gateway> <sequence> track <object> option. Idea I have to overcome the issue: In acl_internet_permit, insert a deny statement for RFC1918 address space.  Questions: 1. Is the above 'idea' my only option? 2. Will this actually load-balance between the two lines or just provide failover? Thanks, Mike <start-configuration> version 15.1 ! hostname router ip domain name internet.local ! object-group network og_internet_access host 192.168.65.100 track 220 ip sla 220 reachability ! track 221 ip sla 221 reachability ! interface GigabitEthernet0/0 description MPLS ip address 172.20.0.69 255.255.255.248 ! interface GigabitEthernet0/1 description Inside network ip address 192.168.64.1 255.255.240.0 ip nat inside ip policy route-map Internet-Access ! ! NOTE: the following 'internet' addresses are static and the gateways known (i.e. dhcp always provides ! the same address) ! interface GigabitEthernet0/2.220 description VLAN220 - Internet (Cable Modem) encapsulation dot1Q 220 no ip dhcp client request router ip address dhcp ip nat outside ! interface GigabitEthernet0/2.221 description VLAN221 - Internet (DSL) encapsulation dot1Q 221 no ip dhcp client request router ip address dhcp ip nat outside ! router eigrp 150 network 172.20.0.64 0.0.0.7 network 192.168.64.0 0.0.15.255 passive-interface GigabitEthernet0/2.220 passive-interface GigabitEthernet0/2.221 ! ip nat inside source route-map cable-nat interface GigabitEthernet0/2.220 overload ip nat inside source route-map dsl-nat interface GigabitEthernet0/2.221 overload ! ip access-list standard acl_internet_nat permit 192.168.65.100 ! ip access-list extended acl_internet_permit permit ip object-group og_internet_access any ! ip sla 220 icmp-echo <cable-gateway> source-interface GigabitEthernet0/2.220 threshold 2 timeout 3000 frequency 3 ip sla schedule 220 life forever start-time now ip sla 221 icmp-echo <dsl-gateway> source-interface GigabitEthernet0/2.221 threshold 2 timeout 3000 frequency 3 ip sla schedule 221 life forever start-time now ! route-map dsl-nat permit 10 match ip address acl_internet_nat match interface GigabitEthernet0/2.221 ! route-map Internet-Access permit 10 match ip address acl_internet_permit set ip next-hop verify-availability <cable-gateway> 1 track 220 set ip next-hop verify-availability <dsl-gateway> 2 track 221 !         route-map cable-nat permit 10 match ip address acl_internet_nat match interface GigabitEthernet0/2.220 ! ... View more

Hello, I was wondering if it is possible to replicate the following ASA configuration on a Cisco 2851 Router? ASA running 8.2 Router running 15.1 <ASA 5505 config> hostname ASA interface Vlan2   nameif outside   security-level 0 ip address 10.7.5.222 255.255.255.248 ! interface Vlan3   nameif inside   security-level 100 ip address 10.2.6.158 255.255.255.252 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 switchport access vlan 3 ! interface Ethernet0/2 shutdown ! interface Ethernet0/3 shutdown ! interface Ethernet0/4 shutdown ! interface Ethernet0/5 shutdown ! interface Ethernet0/6 shutdown ! interface Ethernet0/7 shutdown ! object-group network HQ network-object 192.168.0.0 255.255.255.0 object-group network HOSTS-AT-HQ network-object host 192.168.0.5 network-object host 192.168.0.6 network-object host 192.168.0.7 object-group network OFFICEA network-object 192.168.1.0 255.255.255.0 object-group network LOCAL-DEVICES network-object host 10.4.9.57 access-list acl_local_to_hq extended permit ip object-group LOCAL-DEVICES object-group HOSTS-AT-HQ access-list acl_local_to_officea extended permit ip object-group LOCAL-DEVICES host 192.168.1.5 access-list acl_nonat_vpn extended permit ip object-group LOCAL-DEVICES object-group HOSTS-AT-HQ access-list acl_nonat_vpn extended permit ip object-group LOCAL-DEVICES host 192.168.1.5 nat-control nat (inside) 0 access-list acl_nonat_vpn static (outside,inside) tcp interface 14809 192.168.1.5 14000 netmask 255.255.255.255 static (outside,inside) tcp interface 14810 192.168.0.5 14000 netmask 255.255.255.255 static (outside,inside) tcp interface 14811 192.168.0.6 14000 netmask 255.255.255.255 route outside 0.0.0.0 0.0.0.0 10.7.5.217 route inside 10.4.9.0 255.255.255.0 10.2.6.157 crypto ipsec transform-set esp-aes-256-sha-hmac esp-aes-256 esp-sha-hmac crypto map local-map 10 match address acl_local_to_hq crypto map local-map 10 set peer w.x.y.z crypto map local-map 10 set transform-set esp-aes-256-sha-hmac crypto map local-map 20 match address acl_local_to_officea crypto map local-map 20 set peer a.b.c.d crypto map local-map 30 set transform-set esp-aes-256-sha-hmac crypto isakmp enable outside crypto isakmp policy 10 ! policy stuff management-access inside tunnel-group w.x.y.z type ipsec-l2l tunnel-group w.x.y.z ipsec-attributes per-shared-key xxxxxxxxxx tunnel-group a.b.c.d type ipsec-l2l tunnel-group a.b.c.d ipsec-attributes per-shared-key xxxxxxxxxx </ASA 5505 config> I am specifically looking for the replication of the 'static' commands. Thanks, Mike ... View more