1. Allow the two ports explicitly in the inbound ACL applied on the inside interface. This is to see if we see matches, which will prove that the return packets are seen entering the router. --- conf t ip access-list ext 102     1 permit tcp host 192.168.10.1 eq 80 any     2. permit tcp host 192.168.10.1 eq 443 any   exit --- 2. You can also add  another ACL, as below, to see if packets leave the router towards the servers. ---- conf t ip access-list ext vlan1.out    permit tcp any host 192.168.10.1 eq 80    permit tcp any host 192.168.10.1 eq 443    permit ip any any int vlan 1   ip access-group vlan1.out out exit ---- 3. You can use this ACL to see if packets for these translations leave the router towards the internet: --- conf t   ip access-list ext dialer.out     permit tcp any eq 80 any     permit tcp any eq 443 any     permit ip any any int Dialer0    ip access-group dialer.out out exit --- 4. Now try to access the servers from the outside (internet), and send the output as follows: show access-list 101 show access-list vlan1.out show access-list 102 show access-list dialer.out show ip nat trans | i 192.168.10.1|Pro --- Please tell me the public IP of the machine (client) from which you were trying to access these servers, and the public ip assigned to your router's Dialer0. ... View more

1. There is no such solution available in the base image to detect this at Layer - 3 or higher. There could be if you used the PPP protocol for example end to end , but if your isp isn't using that, then it won't work. 2. If we shut down interface 1, then how will we ever know that the ISP Service / connection via interface 1 is working fine at a later point in time, so that we can "no shut" it and bring it back up. What i mean to say is, lets say Fa0/0 is up/up and so is Fa0/1. The internet connection via Fa0/0 goes down. Interface is up/up. Lets say we have a mechanism to detect it. Say, we shut the interface. Now, how will that mechanism tell us if the connection is back up, when the "test packets" that need to go out of interface Fa0/0 can't go out because it's shut. It's going to be in permanent shut mode unless manually no shut. For this we actually remove routes pointing to that interface / or change AD etc, but never "shut" it. ... View more

Lee, To modify ACLs, get a listing of the ACL to check the line numbers. Then go into ACL config mode and make changes. In your case, line 200 is not needed as 210 denies all IP packets anyways (icmp goes over IP). So I removed 200 and 210, then added 210 back as 240, so that it appears after the last permit statement. Then I resequenced this ACL to start numbering the first statement from 10 and increment each sequence number by 10. I'll show how it's done in your case: ----- R1#show ip access-list 101 Extended IP access list 101     10 permit ip 192.168.1.0 0.0.0.255 192.168.10.0 0.0.0.255     20 permit ip 192.168.240.0 0.0.0.255 192.168.10.0 0.0.0.255     30 deny ip 0.0.0.0 0.255.255.255 any     40 deny ip 10.0.0.0 0.255.255.255 any     50 deny ip 127.0.0.0 0.255.255.255 any     60 deny ip 169.254.0.0 0.0.255.255 any     70 deny ip 172.16.0.0 0.15.255.255 any     80 deny ip 192.0.2.0 0.0.0.255 any     90 deny ip 192.168.0.0 0.0.255.255 any     100 deny ip 198.18.0.0 0.1.255.255 any     110 deny ip 224.0.0.0 0.15.255.255 any     120 deny ip any host 255.255.255.255     130 permit udp any any eq non500-isakmp     140 permit udp any any eq isakmp     150 permit esp any any     160 permit tcp any any eq 1723     170 permit gre any any     180 permit tcp any any eq 22     190 permit tcp any any eq telnet     200 deny icmp any any echo     210 deny ip any any log     220 permit tcp any any eq www     230 permit tcp any any eq 443 R1#conf t Enter configuration commands, one per line.  End with CNTL/Z. R1(config)#ip access-list extended 101 R1(config-ext-nacl)#no 200 R1(config-ext-nacl)#no 210 R1(config-ext-nacl)#240 deny ip any any log R1(config-ext-nacl)#exit R1(config)#ip access-list resequence 101 10 10 R1(config)#end R1#show access-list 101 Extended IP access list 101     10 permit ip 192.168.1.0 0.0.0.255 192.168.10.0 0.0.0.255     20 permit ip 192.168.240.0 0.0.0.255 192.168.10.0 0.0.0.255     30 deny ip 0.0.0.0 0.255.255.255 any     40 deny ip 10.0.0.0 0.255.255.255 any     50 deny ip 127.0.0.0 0.255.255.255 any     60 deny ip 169.254.0.0 0.0.255.255 any     70 deny ip 172.16.0.0 0.15.255.255 any     80 deny ip 192.0.2.0 0.0.0.255 any     90 deny ip 192.168.0.0 0.0.255.255 any     100 deny ip 198.18.0.0 0.1.255.255 any     110 deny ip 224.0.0.0 0.15.255.255 any     120 deny ip any host 255.255.255.255     130 permit udp any any eq non500-isakmp     140 permit udp any any eq isakmp     150 permit esp any any     160 permit tcp any any eq 1723     170 permit gre any any     180 permit tcp any any eq 22     190 permit tcp any any eq telnet     200 permit tcp any any eq www     210 permit tcp any any eq 443     220 deny ip any any log R1# --------- ... View more

The only way to know if a connection more than 1 hop away it down, or something at Layer 3 is down, while Layer 2 is still up, it to use SLA / EEM, which isn't supported in ipbase image. If this customer has multiple routers, then you might want to use another router that has a higher feature set in this location , and swap the devices. Other than that, i highly doubt if someone will come up with a solution that would be manageable and supportable. ... View more

The ACL applied inbound on the Dialer interface to permit those two ports, is placed after deny ip any any. ---- access-list 101 deny   ip any any log access-list 101 permit tcp any any eq www access-list 101 permit tcp any any eq 443 --- Please shift deny ip any any to the end. Also, if you want access to these servers over NAT, and even regular end users in your lan to be able to access resources over the vpn hosted on remote sites, you need to call a route-map in your nat statements, which calls an ACL, which denies local - remote traffic so it doesn't get natted, and you permit the rest (remember to not use permit ip any any in nat acl). For example: ip access-list extended NATACL   deny ip 192.168.0.0 0.0.255.255 10.0.0.0 0.255.255.255   deny ip 192.168.0.0 0.0.255.255 172.16.0.0 0.31.255.255   deny ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255   permit ip 192.168.10.0 0.0.255.255 any route-map NATMAP match ip address NATACL Remove these first: --- ip nat inside source list 105 interface Dialer0 overload ip nat inside source static tcp 192.168.10.1 80 interface Dialer0 80 ip nat inside source static tcp 192.168.10.1 443 interface Dialer0 443 --- Then: ---- ip nat inside source route-map NATMAP interface Dialer0 overload ip nat inside source static tcp 192.168.10.1 80 interface Dialer0 80 route-map NATMAP ip nat inside source static tcp 192.168.10.1 443 interface Dialer0 443 route-map NATMAP ------ If the static NAT statements don't allow you to use route-map after dialer 0 80/443, then you can change that to the public ip you have , which should be static and known to you. I see you have ppp autoneg, and hope that you it gives you the same IP everytime. ... View more

Paste output of: 1. "show version" 2. conf t     ip sla ? 3.  conf t       rtr ? ... View more

If you're accessing an application over WAN, the session is created between the End-Users and the server hosting the application. Unless you've configured a stateful feature on the router (firewall / nat) etc, and the session expiry timer of that stateful feature is less than the time the users are idle, the router won't come into the picture. 1. Please let us know if you have any stateful features configued 2. Their config 3. In how much time does the connection reset? For example if i don't use the app for 3 hours or leave it open for 5 minutes, does the session timeout? If you don't have any stateful feature configured, this could be something else altogether. ... View more

Hey Adam, I thought some more on this, and realized that even if we configured NAT on the routers, the ASA would stilll have no way to know what the incoming path of the traffic was, to be able to forward the outbound traffic to the correct router. So, here are a few suggestions regarding this: 1. As we have to do "source based routing", for this to work, let ASA send the packets to either router (by hsrp virtual ip as the next hop, or if you run a routing protocol between the asa and routers, then dynamic route). 2. The routers will have a PBR configured and applied to the inside interface to send all traffic with a source IP not supported by it's ISP, to the other router's inside interface IP. So a packet that comes from the ASA to lets say Router1, but actually has a NAT IP of the ISP2's pool, will hit pbr, and take a U-turn, and be sent to Router2. Here it won't match it's pbr as it is meant to be forwarded out Router2, and will be sent out. ... View more

For internet peering, if you can run routing like i said earlier, you should go for it. I don't see how provider address space or provider independent address space should make a differce. If your concern of /27 and you loosing addressing blocks is the concern, then there are other ways to work that out. Also tell me if your interent facing links are configured with private IPs or public? If public, then is it part of the same /27 subnetted or full /27 mask. If not part of /27,then what is it ? /30? Anyways, if you can't run a protocol with your providers, then you can run ip sla with tracking to flap your default route when connectivity is lost with the isp. You can either choose to track upto gateway or even beyond to some known server. Redistribute this default route into eigrp which you run between routers and ASA, and ASA will know if your uplink is up or down. ip route 0.0.0.0 0.0.0.0 64.1.1.1 track 1 track 1 rtr 1 ip sla 1 icmp-echo 64.1.1.1 source-interface FastEthernet0/0 frequency 10 router eigrp 1 no auto-summary network 10.0.0.0 redistribute static --- Load balancing in current scenario may not work because of different ip pools from providers, Now i see why you were saying dual natting, cause you want to nat the internet traffic inbound going to ASA so that the ASA cna identify which router to send back the traffic to, else the providers would drop it if they got each others addresses in the source IP on the way out. However, there are a few issues here: 1. Routers don't support doing a reverse nat outside --> for this scenario. It just isn't supported, even though an outside to inside nat is configurable, what matters is which part of the IP is getting changed, and how routing will affect this as well, as there are different rules for natting in routers when it comes to nat order of operation. 2. Internet IP table is huge. Even if you don't get huge amounts of traffic, expect some 10s of thousands of NAT entries just for internet traffic which can cause resource utilization to go high and overload . 3. ASAs have a trick with which you can do reverse nat, but trust me, you won't get support from TAC on this. I think they'll deny that it can even be done, even though i know it can and has been done before in only exception cases. Even if you find someone who can do it for you, anytime that there is an issue and you need to go to TAC or a consultant for support, you'll be refused as it's agaist all design guides and best practices. There would be unpredictable behavior. You'll be left hanging in the middle in such a scenario. 4. Because of this, you'll have to re-think your design, maybe when it comes to ASAs. In this case, NATTING will  have to be done on the routers. ASA can be free of any NAT config in your case. You might be thinking that you can NAT everything on the ASA and then just NAT the ASA IP on the router. It doesn't make much difference unless you have a specific purpose to nat on the asa. It's more or less the same thing. Other than that, NATTING everyting on the routers also gives you one advantage. You can configure netflow on the routers and get a good insight into the traffic flows, specially during malicious activities or if there is a DOS attack, or if a user is hogging a lot of your bandwidth, intentionally (torrents) or unintentionally. You can also fine tune QoS based on inside IP address groups on the router for internet bandwidth, which would be tougher if you just had one ASA NAT IP arriving on the router (deep packet inspection = more cpu). ... View more

Hi Blanch, 1. I need a lot more information to tell you whats going on: -- Complete configs of all 3 routers would be good (here even the inteface configs aren't there) -- "show ip route" and "show ip cef "for the prefixes which you're pinging -- traceroute to the prefixes as well 2. You say that when you're pinging 192.168.200.1 from Router 1 , that the IP resides on Router 2 in  a vrf. Fair enough. However, when you do a reverse ping, I don't see "ping vrf [vrfname] 192.168.200.5" Also, if that interface is in a vrf on Router 2, and eigrp 200 is running over it, then we should have the configs under the address-family for that vrf in eigrp, which i don't see here. 3. Also send outputs of show ip eigrp neigh ... View more

Hi Strangeroad, 1. GLBP for load-balancing is not going to work in your scenario if my understand of the topology is as below:            |---------3945 AVF----Gig0/0---------| Inside---|                                             |--------Paetec             |--------3945 AVG---Gig0/0---------| If this is so, GLBP mac will be learnt during ARP and cached for a few hours, and all traffic will hit one router and not the other. 2. As bind is only for inteface and providing an ip is not an option, you might look into using loopback intefaces to terminate the SIP sessions and bind to that interface. 3. To keep that virtual IP, you can configure ip nat inside on the loopback and ip nat outside on the gig, and nat that particular IP flow by using a nat acl . My 2 cents as a non VoIP engineer, and I could be totally off here, so please confirm with someone else or TAC. ... View more

Tahequivoice, If VPN is for failover, then run EIGRP / OSPF over VPN and have dynamic failover, which i think is better than ip sla. You'll also not need statics any more. BGP with MPLS providers usually is EBGP and so it'll have AD 20. OSPF / EIGRP will have AD higher than that 110 / 90, and so they won't be preferred , unless eBGP goes down. ... View more