Hello,   the 'extendable' keyword is needed when you want to translate a private IP address to more than one public IP address. So in your case, the static entries should look like below:   ip nat inside source static udp 172.31.213.130 2727 <public_primary_ip> 2727  ip nat inside source static udp 172.31.213.130 8181 <public_primary_ip> 8181  ip nat inside source static udp 172.31.213.130 9300 <public_primary_ip> 9300  ip nat inside source static udp 172.31.213.130 15060 <public_primary_ip> 35560  ip nat inside source static tcp 172.31.213.130 15061 <public_primary_ip> 35561  ip nat inside source static 172.31.213.131 <public_secondary_ip> extendable ... View more

Hello,   I guess one way to 'solve' this would be to copy the startup config to a TFTP server, edit the text file and add the remark at the desired position, copy the edited file back to flash, and the issue the command 'copy startup-config running-config'. ... View more

Hello,   depending on which browser you use, try and clear the browsing data. ... View more

Hello,   I might be completely missing the point here, but the only way I have heard of CSR and AWS logging for EFK/Kibana is by using the Cisco Hybrid Solution:   https://blogs.cisco.com/cloud/simplifying-container-orchestration ... View more

Hello,   in that case, leave those lines in there. I just want to see if the problem persists if you take all the extra stuff out... ... View more

Hello,   try and strip the virtual template to the most basic config (changes and additions marked in bold):   aaa group server radius ANAS server name ANAS ! aaa server radius dynamic-author client x.x.x.x server-key 7 121F0C1517190E05242F342D212031015E44 server-key 7 104D8220A0618 auth-type any ignore session-key ignore server-key ! bba-group pppoe PPPOE_OUT virtual-template 3 --> no sessions per-vc limit 64000 --> no sessions per-mac limit 64000 --> no sessions per-vlan limit 64000 inner 64000 ! interface Virtual-Template3 --> no mtu 1460 ip unnumbered Loopback0 no ip redirects ip nat inside --> no ip tcp adjust-mss 1400 --> no ip policy route-map ROUTE-TV no logging event link-status --> no timeout absolute 4320 0 peer default ip address pool interface localpool --> keepalive 30 ppp authentication chap ppp ipcp dns 8.8.8.8 8.8.4.4 --> no ppp timeout retry 80 --> no ppp timeout authentication 60 ip virtual-reassembly interface Port-channel1.905 description PPPOE-QAYRIA encapsulation dot1Q 905 no ip redirects no ip unreachables no ip proxy-arp pppoe enable group PPPOE_OUT ! radius-server attribute 44 include-in-access-req all radius-server attribute 31 mac format one-byte delimiter colon radius-server attribute 31 send nas-port-detail mac-only radius-server attribute nas-port-id include circuit-id radius-server timeout 10 radius-server unique-ident 38 radius-server key 7 1048001B0005100A02003A2E363D20277B41 ! aaa authentication ppp default group radius aaa authorization network default group radius aaa accounting delay-start all aaa accounting nested aaa accounting update periodic 1 aaa accounting network default start-stop group radius aaa accounting system default start-stop group radius ! interface Virtual-Template1 --> no mtu 1460 ip unnumbered Loopback0 no ip redirects ip nat inside --> no ip tcp adjust-mss 1400 --> no ip policy route-map ROUTE-TV no logging event link-status peer default ip address pool interface localpool --> keepalive 30 ppp authentication chap ppp ipcp dns 8.8.8.8 8.8.4.4 ! ... View more

I have a feeling that what Richard points out is the problem indeed. I tested the posted configs in GNS3 and it works fine. Pinging from the router uses the serial interface and WAN IP address as source, so that would not qualify as interesting traffic... ... View more

Hello,   the configs look by the book. Can you post the output of:   debug crypto isakmp debug crypto ipsec   You might want to try and set the pfs group in both crypto maps:   crypto map MAP 1 ipsec-isakmp set peer 20.0.0.2 set transform-set SET --> set pfs group2 match address 101   crypto map MAP 1 ipsec-isakmp set peer 10.0.0.1 set transform-set SET --> set pfs group2 match address 101 ... View more

Hello,   the picture does not show what IP address the server has. Let's say it is 192.168.50.100. If you want network 192.168.30.0/24 to just access this server and nothing else, you need to have a statement that permits access to that server:   access-list 101 permit 192.168.30.0 0.0.0.255 host 192.168.50.100   The implicit 'deny' will allow only access to the server, everything else is denied.   Actually, post the (zipped) .pkt Packet Tracer project file ... View more

Hello,   looks like a physical problem, have you tried to exchange the fiber cable, or switch the transmit and receive ends ? ... View more

Hello,   on a side note, you might want to have a look at the bug below:   https://bst.cloudapps.cisco.com/bugsearch/bug/CSCum44673/?rfs=iqvred ... View more