There is best solutions: - If you use AAA based on LDAP, then use: nat-assigned-to-public-ip {interface} - If you use AAA based on RADIUS, then use: NAS-Port-ID (RADIUS attribute 87) NAS-Port-ID = Public IP in AnyConnect VPN. Details: https://netconfigure.net/index.php/ru/forum/12-konfiguratsiya-setevogo-oborudovaniya/199-cisco-anyconnect-source-ip-restrict-ogranichenie-dostupa-po-vneshnemu-ip-klienta ... View more

anybody will help? Physically Tunnel binds to Port-channel (Po1) ASR1006#sh etherchannel summary Flags:  D - down        P/bndl - bundled in port-channel         I - stand-alone s/susp - suspended         H - Hot-standby (LACP only)         R - Layer3      S - Layer2         U - in use      f - failed to allocate aggregator         M - not in use, minimum links not met         u - unsuitable for bundling         w - waiting to be aggregated         d - default port Number of channel-groups in use: 5 Number of aggregators:           5 Group  Port-channel  Protocol    Ports ------+-------------+-----------+----------------------------------------------- 1       Po1(RU)         LACP     Gi0/0/0(bndl) Gi0/0/1(bndl) 2       Po2(RU)         LACP     Gi0/0/2(bndl) Gi0/0/3(bndl) ... View more

Hi,  no, in logs silence ... View more

for completely block torrents see... http://netconfigure.net/index.php/ru/forum/12-konfiguratsiya-setevogo-oborudovaniya/174-cisco-zbf-fpm-vs-mikrotik-firewall-kak-zablokirovat-p2p-torrent-torrents-trekery-dht-pex ... View more

Solution - using ZBF + FPM:   Attempt to block torrents was successful, but not completely: 1 . Downloading of the *.torrent files (content-type: "application/x-bittorrent") - is blocked 2 . The traffic with requests to list SEEDs of a tracker (... info_hash =... ) - is blocked 3 . The DHT traffic - is blocked. PEX (the advanced DHT version)  - doesn't blocked.   Suddenly to whom it is useful, similar to the rules Mikrotik, Cisco ZBF config + FPM:   parameter-map type regex REGEX-TORRENT-ANNOUNCE  pattern .*[Ii][Nn][Ff][Oo]_[Hh][Aa][Ss][Hh]=.* parameter-map type regex REGEX-TORRENT-PROHIBIT-DOWNLOAD  pattern .*application\/x-bittorrent.*|.*\.torrent.* ! class-map type inspect match-all CLASS-INSPECT-HTTP  match protocol http class-map type inspect match-any CLASS-INSPECT  match protocol ftp  match protocol ftps  match protocol tftp  match protocol smtp  match protocol pop3  match protocol dns  match protocol https  match protocol http  match protocol sip  match protocol tcp  match protocol udp  match protocol icmp ! сlass-map type inspect match-any CLASS-INSPECT-ANY-P2P  match protocol gnutella signature  match protocol kazaa2 signature  match protocol fasttrack signature  match protocol bittorrent signature class-map type inspect match-all CLASS-INSPECT-P2P  match class-map CLASS-INSPECT-ANY-P2P ! class-map type inspect http match-all CLASS-HTTP-TORRENT-PROHIBIT-DOWNLOAD  match  response header content-type regex REGEX-TORRENT-PROHIBIT-DOWNLOAD сlass-map type inspect http match-all CLASS-HTTP-TORRENT-ANNOUNCE  match  request method get  match  request arg regex REGEX-TORRENT-ANNOUNCE class-map type inspect http match-any CLASS-HTTP-PORT-MISUSE  match  request port-misuse p2p  match  req-resp protocol-violation ! class-map type access-control match-all CLASS-ACCESS-TORRENT-DHT-OUTGOING  match field UDP length range 95 190  match start UDP payload-start offset 0 size 190 string "d1:ad2:id20:"  match field UDP dest-port range 1025 65535 ! class-map type stack match-all CLASS-STACK-IP-UDP  description *** Stack: [IP [UDP ... ]] ***  match field IP protocol eq 0x11 next UDP ! policy-map type inspect http POLICY-HTTP  class type inspect http CLASS-HTTP-TORRENT-ANNOUNCE   reset   log  class type inspect http CLASS-HTTP-PORT-MISUSE   reset  class type inspect http CLASS-HTTP-TORRENT-PROHIBIT-DOWNLOAD   reset   log policy-map type inspect INSIDE->INTERNET  class type inspect CLASS-INSPECT-P2P   drop  class type inspect CLASS-INSPECT-HTTP   inspect   service-policy http POLICY-HTTP  class type inspect CLASS-INSPECT   inspect  class class-default   drop ! policy-map type access-control POLICY-FILTER  class CLASS-ACCESS-TORRENT-DHT-OUTGOING    log    drop all policy-map type access-control POLICY-STACK  class CLASS-STACK-IP-UDP   service-policy POLICY-FILTER ! interface GigabitEthernet0/0  zone-member security INSIDE interface GigabitEthernet0/1  zone-member security OUTSIDE  service-policy type access-control output POLICY-STACK ! zone-pair security INSIDE->INTERNET source INSIDE destination INTERNET  service-policy type inspect INSIDE->INTERNET ! ... View more

The all problems is solved after update IOS from bugged  c2800nm-adventerprisek9-mz.151-4.M.bin to lastest  c2800nm-adventerprisek9-mz.151-4.M10.bin  !   Сolleagues, thanks for the help! ... View more

Hello Lukasz   ACL-NAT1 and ACL-NAT2 are completely identical. And any of route-map's in general doesn't work (even if interface ip statement in ip nat configured, instead of pools):   " 1. I configured identical ACL-NAT's and reconfigured Route-Map's: ip route 0.0.0.0 0.0.0.0 1.1.1.1 ip route 0.0.0.0 0.0.0.0 2.2.2.1 ! ip nat inside source route-map RMAP-NAT-ISP1 pool POOL-ISP1 overload ip nat inside source route-map RMAP-NAT-ISP2 pool POOL-ISP2 overload ! route-map RMAP-NAT-ISP1 permit 10  match ip address ACL-NAT1  match interface FastEthernet0/1/0.1101 oute-map RMAP-NAT-ISP2 permit 10  match ip address ACL-NAT2  match interface FastEthernet0/1/0.1103 ! The same problem - no Internet access, even if " no ip route 0.0.0.0 0.0.0.0 2.2.2.1 " ! " Actually I found out the following... balancing of default routes incorrectly works. All traffic goes through ISP1, even if two default gateways configured! My tests: I run 'traceroute' with source ip 1.1.1.2 (interface from ISP1 subnet) to 8.8.8.8 - OK! I run 'traceroute' with source ip 2.2.2.2 (interface from ISP2 subnet) to 8.8.8.8 - receive A! A! A! from 1.1.1.1.  (PBR & ZBF doesn't configured)   ... View more

Router for translation of addresses only the first record "ip nat inside source list ..." is selected, even if there is the second record is configured. In ios configuration they are sorted in alphabetical order, and always only the first record is used for NAT. ... View more

1. I configured identical ACL-NAT's and reconfigured Route-Map's: ip route 0.0.0.0 0.0.0.0 1.1.1.1 ip route 0.0.0.0 0.0.0.0 2.2.2.1 ! ip nat inside source route-map RMAP-NAT-ISP1 pool POOL-ISP1 overload ip nat inside source route-map RMAP-NAT-ISP2 pool POOL-ISP2 overload ! route-map RMAP-NAT-ISP1 permit 10  match ip address ACL-NAT1  match interface FastEthernet0/1/0.1101 oute-map RMAP-NAT-ISP2 permit 10  match ip address ACL-NAT2  match interface FastEthernet0/1/0.1103 ! The same problem - no Internet access, even if " no ip route 0.0.0.0 0.0.0.0 2.2.2.1 " ! 2. I configured identical ACL-NAT's and reconfigured ip nat translations: ip route 0.0.0.0 0.0.0.0 1.1.1.1 ip route 0.0.0.0 0.0.0.0 2.2.2.1 ! ip nat inside source list ACL-NAT1 pool POOL-ISP1 overload ip nat inside source list ACL-NAT2 pool POOL-ISP2 overload ! The same problem - no Internet access, but if  " no ip route 0.0.0.0 0.0.0.0 2.2.2.1 " that everything works (but only through one provider)   ... View more

Thanks for comments I see, that router use ip CEF, but nevertheless it doesn't solve a problem.  This is bug? There is no solutions?   ... View more