It started working and I can't recall what the culprit was . I'll keep this one in mind for next time. Thanks,   ... View more

Ran into the same issue and added the inside to the statement and it resolved the issue ip nat <inside> source static udp 192.168.1.205 1719 interface GigabitEthernet0/0 1719 ... View more

Hello Vishesh, This is exactly why I have it setup like that , its because it's an 800 series router and I would like to apply Qos in the inbound direction. We know that the WAN interface only supports QoS in the outbound so I found the solution by creating a VRF and called it outside . created a tunnel interface between this VRF and the "global router" so that I can apply the policy on the tunnel interface 0  in the outbound direction , essentially being able to apply QoS in the inbound direction. I didn't mention these details in the initial description of the problem because I didn't want to overcomplicate it and incl. the details that are relevant to my problem. The solution is found on this document on page 47 : stor.balios.net/Live2012/BRKRST-3500.pdf ‎ router#show ip int br | e una Interface                  IP-Address              OK? Method Status                Protocol FastEthernet8              207.45.45.56   YES  DHCP   up                    up Loopback0                  10.1.3.3              YES manual up                    up Loopback1                  10.1.3.4              YES manual up                    up NVI0                       207.45.45.56          YES  unset  up                    up Tunnel0                    10.3.3.3                 YES  manual up                    up Tunnel1                    10.3.3.4                  YES manual up                    up Vlan1                      192.168.110.251   YES  manual up                    up #show ip vrf outside   Name                             Default RD          Interfaces   outside                          1:1                 Tu0                                                        Fa8 Also ping to 4.2.2.2 works as well when sourced from vlan 1 which means the packets are traversing the tunnel between global and outside VRF just fine . #ping 4.2.2.2 source vl 1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 4.2.2.2, timeout is 2 seconds: Packet sent with a source address of 192.168.110.251 !!!!! Success rate is 100 p Hope it makes sense now, Cheers, ... View more

Hi Paul , the tunnel is sourced from a loopback interface on a VRF instance  no aggregation of any sort. interface Tunnel0 bandwidth 5800 ip vrf forwarding outside ip address 10.3.3.3 255.255.255.0 ip nat inside ip inspect INSPECTION in ip virtual-reassembly in tunnel source Loopback0 tunnel destination 10.1.3.4 service-policy output POLICYINPARENT the tunnel endpoints should be able to talk to each other I suppose as I am getting an internet feed though the tunnel . both endpoints are in UP/UP state. Regards, Murad ... View more

Hi vishesh, It's an 891 running C890-UNIVERSALK9-M), Version 15.2(4)M4. #  show ip cef 10.1.3.4 10.1.3.4/32   receive for Loopback1 show run int lo1 Building configuration... Current configuration : 64 bytes ! interface Loopback1 ip address 10.1.3.4 255.255.255.255 end #show int lo1 Loopback1 is up, line protocol is up   Hardware is Loopback   Internet address is 10.1.3.4/32   MTU 1514 bytes, BW 8000000 Kbit/sec, DLY 5000 usec,      reliability 255/255, txload 1/255, rxload 1/255   Encapsulation LOOPBACK, loopback not set   Keepalive set (10 sec)   Last input 00:00:00, output never, output hang never   Last clearing of "show interface" counters never   Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0   Queueing strategy: fifo   Output queue: 0/0 (size/max)   5 minute input rate 0 bits/sec, 0 packets/sec   5 minute output rate 0 bits/sec, 0 packets/sec      0 packets input, 0 bytes, 0 no buffer      Received 0 broadcasts (0 IP multicasts)      0 runts, 0 giants, 0 throttles      0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort      15 packets output, 855 bytes, 0 underruns      0 output errors, 0 collisions, 0 interface resets      0 unknown protocol drops      0 output buffer failures, 0 output buffers swapped out cheers, ... View more

Hi Thiago and Rodrigo, interface Tunnel0 bandwidth 5800 ip vrf forwarding outside ip address 10.3.3.3 255.255.255.0 ip nat inside ip inspect INSPECTION in ip virtual-reassembly in tunnel source Loopback0 tunnel destination 10.1.3.4 service-policy output POLICYINPARENT s207-81-129-56#show policy-map POLICYINPARENT   Policy Map POLICYINPARENT     Class class-default       Average Rate Traffic Shaping       cir 5000000 (bps)       service-policy POLICYIN s207-81-129-56#show policy-map POLICYIN   Policy Map POLICYIN     Class POLICYIN       priority 2000 (kbps)     Class class-default       queue-limit 8 packets        wred, exponential weight 9 ... So basically tried to place a parent policy so I would be able to trigger a congestion state..but that didn't help , it kept telling me the policy is in suspended mode. Thanks you all for your efforts though! Cheers, ... View more

Hi Pdiver, I have tried that (As indicated in the description ) . thanks, ... View more

Hi Mikhailovsky, That's a very good point , the limitation was that in this scenario we won't be able to utilize the integrated VLAN interface ports that are on the router, so we would need another separate physical switch and connect that to port Fa1 . The document where this is referenced is : http://stor.balios.net/Live2012/BRKRST-3500.pdf The document also references another solution where this could potentially work , physical loopback cable between FA1 and the vlan interface of the router , move the config (from the vlan interface to fa1 / ip address , nat inside , inspection, etc) , default the vlan interface , turn it on and give it no IP address , so it acts as a dump flat switch .. this seems more stable than VRF setup. btw : I rebooted the router without changing ANY config , and it seems to be working , with CEF enabled. Go figure! Cheers ... View more

Hi Mikhailovsky , yes it is a bit complex for what we're trying to acheive, it appears that ISR routers have a bit of a limitation despite having more than one layer 3  interface , the VLAN interface does not accept a QoS policy in the outbound direction, thus Cisco suggested creating two VRFs with a tunnel in between and applying the policy on the tunnel , thus acheiving QoS on traffic in the inbound direction for branch offices. I'm thinking of trying it on an 891 instead of an 1811 and with a newer image and see if the issue persists. Cheers, Murad ... View more

Hello MikhailovskyVV, Sorry forgot interface Tunnel0   ip vrf forwarding outside   ip address 10.3.3.3 255.255.255.0   ip inspect INSPECTION in   ip nat inside   ip virtual-reassembly in   tunnel source Loopback0   tunnel destination 10.1.3.4 interface FastEthernet0   ip vrf forwarding outside   ip access-group Outside_IN in   ip address dhcp   ip nat outside   ip virtual-reassembly in   duplex auto   speed auto ! I noticed that if I disable cef things start working again , so could it be a software bug ? Cheers, ... View more

In my case I used a longer key and everything worked after that. This could be your problem as well. ... View more