Hi Richard: After several configurations I got HSRP working with some minor issues. This is the situation: 1) I tried using physical interface name in the NAT statements, but this did not work. Then I tried using the virtual IP address instead, and it works. I'm attaching the configuration. 2) I suppose I expressed myself badly. What I really wanted to ask is what outside interface's IP address (the real one or the virtual one) I must use in the ACLs to deny or permit traffic based on the destination address. I tried with the virtual one, and then again it works. 3) The third question is related to the fact that when you use HSRP there are two IP addresses working in the outside interface (the real and the virtual one). I'm using the virtual one for NAT statements and ACLs, but  I would like to have some specific traffic working only with the real IP address, this is without HSRP. I tried this and it works too, but only when the active router was the one in which I configured the rules for the real IP address. In the configuration I'm attaching the NAT statement and the ACL rule related to this are the ones using the U tcp port. My topology is very simple: - I have two identical routers giving redundant access to Internet to a network using one only Internet access with one public IP address for each router (the real IP addresses). - I expect that when one of the routers goes down the other keeps working with the same public IP address (the virtual one IP address). Is there any simpler way to get this working than HSRP? As I said to you my configuration is now working, but with some minor issues. At this moment the internal network have Internet access, and external users can access to services permited in internal hosts through NAT. The main problem is that DNS traffic is blocked, so internal hosts have Internet access, but they can't surf the web, and I don't know why. ... View more

Hi Amjad: I have two switches (two identical SG-300) and two routers too (two identical 1921) in this desing. It is a litlle complex desing that includes VLANs, HSRP, subinterfaces, router-on-stick... The concrete problem in the trunk port is afecting to switch Sw1 and router Rt1, regardless of if switch Sw2 and router Rt2 are connected or not (Surely I will have the same problem between Sw2 and Rt2, but I have not installed Rt2 yet). That's why I don't talk about second router and switch before, to not make more difficult to find the problem Rt1 physical interface is connected to port 24 of Sw1; port 28 of the two switches is used as uplink port. Here's the oputput of the two switches when both are conected: Sw1#sh vlan Vlan       Name                   Ports                Type     Authorization ---- ----------------- --------------------------- ------------ ------------- 1           1          gi3,gi6-10,gi12-28,Po1-8     Default      Required 10      ?????       gi1-2,gi11,gi24,gi28        static      Required 101      ?????           gi4-5,gi24,gi28          static      Required Sw2#sh vlan Vlan       Name                   Ports                Type     Authorization ---- ----------------- --------------------------- ------------ ------------- 1           1          gi3,gi6-10,gi12-28,Po1-8     Default      Required 10      ?????        gi1-2,gi11,gi24,gi28        static      Required 101      ?????            gi4-5,gi24,gi28          static      Required Thanks. ... View more

Hi Amjad: As I told Alain before I'm not using inter-vlan routing, so I think if the router receives a packet in the VLAN A for the VLAN B it is not going to forward it, regardless of the ACL configurions. It isn't truth? The problem with the trunk is that packets received in the VLAN A of the switch for the VLAN A in the router are not reaching their destiny. I'm attaching the configuration files and the sh vlan output. As I mentioned and not using inter-vlan routing but I agree that this is a poor security desing to isolate the two VLANs so I'm interested in what you're saying about private VLANs. Can this be configured in a SG-300. Thanks. ... View more

I think that I'm not understanding you well. In my design I don't want inter-vlan routing. I want the two VLANs completly isolated between themselves, and this is working well without the need of ACLs, just because there is no inter-vlan routing. The problem is in the trunk port: in theory hosts in each VLAN would be able to access to the router sub-interface defined in its same VLAN without routing, because this sub-interfaces are connected to the trunk port, and trunk port can be accessed by the two VLANs. Routing is done in the router for sharing WAN interface between the two sub-interfaces. In my design there is no layer-3 switch mode or inter-vlan routing needed at all. This is what I need to confirm. ... View more

Hosts asociated to each VLAn can communicate between them, and there is no communication at all between hosts in differents VLANs. This is what I want to happen. The problem is that the trunk port that shloud give access to internet to the two VLANs using two subinterfaces defined on the router (router-on-a-stick) is not working. Host in each VLAN can not communicate withe the router subinterface assignated to its same VLAN. Let's see a sample of the problem: - Host1 (10.10.10.1 / 24) connected directly to port1 in switch1, defined as access port for VLAN 10. - Host1 has the default gateway defined as 10.10.10.254 - Subinterface 0/0.1 defined on the router as encapsulated with dot1q 10 (I suppose this means that it belongs to VLAN 10 too), and with IP address 10.10.10.254 /24. - Interface 0/0 of the router (the physical router interface over which the logical subinterface 0/0.1 has been defined) connected directly to port 24 in the switch, which is defined as a trunk port for several VLANs, including VLAN 10. - There is no communication between Host1 and subinterface 0/0.1 ... View more

Finally I found the problem. It was a mistake in last line of ACL 100. Begginer's mistake. Thanks. ... View more

Hi Alex: The configuration I included in my post I think is according to what you're saying, and of course host in LAN2 are using the correct gateway. I don't have a static route in LAN1 router for reaching LAN2, because I'm using NAT in LAN2 router (overloading), so there is no packets with 10.10.10.0/24 destination addresses in LAN1. If I understand well NAT working with overloading all traffic in LAN1 with destination LAN2 would have 192.168.1.111 as destination address. This is resume of the posted configuration: interface GigabitEthernet0/0 ip address 10.10.10.252 255.255.255.0 ip access-group 103 in ip nat inside ip virtual-reassembly in duplex auto speed auto ! interface GigabitEthernet0/1 ip address 192.168.1.111 255.255.255.0 ip access-group 100 in ip nat outside ip virtual-reassembly in duplex auto speed auto ! ip forward-protocol nd ! ip nat inside source list 1 interface GigabitEthernet0/1 overload ip route 0.0.0.0 0.0.0.0 192.168.1.254 permanent ! access-list 1 permit 10.10.10.0 0.0.0.255 access-list 100 permit icmp any any echo access-list 100 permit icmp any any traceroute access-list 100 permit icmp any any unreachable access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.111 eq telnet access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.111 eq 22 access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.111 eq www access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.111 eq 443 access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.111 eq cmd access-list 100 deny   tcp any host 192.168.1.111 eq telnet access-list 100 deny   tcp any host 192.168.1.111 eq 22 access-list 100 deny   tcp any host 192.168.1.111 eq www access-list 100 deny   tcp any host 192.168.1.111 eq 443 access-list 100 deny   tcp any host 192.168.1.111 eq cmd access-list 100 deny   udp any host 192.168.1.111 eq snmp access-list 100 deny   ip any any access-list 103 permit tcp 10.10.10.0 0.0.0.255 host 10.10.10.252 eq telnet access-list 103 permit tcp 10.10.10.0 0.0.0.255 host 10.10.10.252 eq 22 access-list 103 permit tcp 10.10.10.0 0.0.0.255 host 10.10.10.252 eq www access-list 103 permit tcp 10.10.10.0 0.0.0.255 host 10.10.10.252 eq 443 access-list 103 permit tcp 10.10.10.0 0.0.0.255 host 10.10.10.252 eq cmd access-list 103 deny   tcp any host 10.10.10.252 eq telnet access-list 103 deny   tcp any host 10.10.10.252 eq 22 access-list 103 deny   tcp any host 10.10.10.252 eq www access-list 103 deny   tcp any host 10.10.10.252 eq 443 access-list 103 deny   tcp any host 10.10.10.252 eq cmd access-list 103 deny   udp any host 10.10.10.252 eq snmp access-list 103 permit ip any any ... View more