Hello everyone, I really need a hint here! I have configured a simple two ISPs load balancing using two default routes and two NAT overload. Load balancing is working fine. (See NAT configuration at bottom). This way, any NAT INSIDE host, is able to reach internet using both ISPs randomly. I need some specific hosts to access internet using a Single specific ISP. Think of it as "load balancing" exceptions, if you will. In other words, I need to disable load balancing and stick with a single ISP for certain hosts within NAT INSIDE that access HTTPS sites. This is because many SSL sites are unusable with load balancing and should be accessed using a single external IP address. I've tried to create roadmaps and also I've tried to modify given roadmaps without success. Please see config below: (part of current running-config.) object-group service PuertosNavegacion description Puerto 80 y 443 tcp source eq www tcp source eq 443 ! interface GigabitEthernet0/0 description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$ ip address xxx.xxx.29.170 255.255.255.248 ip nat outside ip virtual-reassembly in ip policy route-map forceTelmex duplex auto speed auto ! interface GigabitEthernet0/1 ip dhcp client route track 345 ip address dhcp ip nat outside ip virtual-reassembly in ip policy route-map forceTelmex duplex auto speed auto ! interface Vlan3 description puertos LAN ip address 192.168.1.1 255.255.255.0 ip nat inside ip virtual-reassembly in ! ip dns server ip nat inside source route-map fiberNat interface GigabitEthernet0/1 overload ip nat inside source route-map telmexNat interface GigabitEthernet0/0 overload ip route 0.0.0.0 0.0.0.0 xxx.xxx.29.169 ip route 192.168.3.0 255.255.255.0 192.168.1.10 2 ip route 0.0.0.0 0.0.0.0 dhcp ! access-list 110 permit ip 192.168.1.0 0.0.0.255 any access-list 111 remark acepta nat deniega http y https access-list 111 remark CCP_ACL Category=1 access-list 111 permit ip 192.168.1.0 0.0.0.255 any access-list 111 deny   object-group PuertosNavegacion 192.168.1.0 0.0.0.255 any ! route-map fiberNat permit 10 match ip address 111 match interface GigabitEthernet0/1 ! route-map telmexNat permit 10 match ip address 110 match interface GigabitEthernet0/0 ! Thanks in advance, Agustin. ... View more

Hello everyone, There is an RV016 router (SOHO) that will be replaced by a 1941. We have two ISPs with multiple external IP addresses, so I'm able to fetch one unused IP address from each ISP to connect to the 1941 router without affecting the Production Network. The 1941 will be replacing the RV016, so there are plenty of things to be configured: PAT, NAT 1:1, port forwardings, a few VLANs, a few static routes and some simple ACLs. Both routers (1941 and RV016) have the same LAN segment (192.168.1.0 / 24) that means that both LANs cannot be routed. The devices are currently installed in our local datacenter, quite noisy and cold!. > Since both LANs (productive and test) cannot be routed, I was wondering what's the recommended methodology to carry on with the configuration and testing in such way that we're not forced to whistand cold and noise from the datacenter... > In previous SOHO Routers replacements, I configured the test environment with a different LAN ip address, so I was able to directly connect both LANs (Productive and Testing) (disabling the new router's DHCP server, of course) so I could sit comfortably in my office and connect a second NIC from my workstation to the "LAN" with a fixed IP address. When the configuration was over and we were ready to perform a replacement test, we only had to change the "LAN" IP address from the newer router and the configuration would reflect this change. I'm quite newbie with IOS routers! I'm CCNA though it's been a while since I've achieved that. If I got this right, I won't be able to "change" the LAN IP address along with ACLs, NAT, PAT pools, port forwardings and such on a single command. [b]What's your normal approach to this kind of situation? What should I do? [b] Thanks in advance and best regards, Agustin. Buenos Aires, Argentina. ... View more

Hello everyone, I'm having serious issues with this device. We count with two units, one of them is meant to replace an RV016 router in our main building... The problem is: The Internet access (web browsing, ICMP, etc) is intermittent or not working at all when using SA540 devices. - One ISP provides a dynamically assigned IP address, the other one provides quite a few static IP Addresses. - For early minutes after a power cycle, the Internet access seems to work fine. Slow, with hiccups (random packet loss); but it works. - After ~3 minutes, ping start showing timeouts and the web browsing stop working. Once this state was reached, the next tests were performed: - Disconnect one ISP and check behavior. Repeat with the other ISP. - One ISP was connected to an intermediate 10/100/1000 switch before reaching the WAN port (Check this post: https://supportforums.cisco.com/thread/2126259 ) > This was done weeks ago, with default firmware and then the procedure was repeated with upgraded firmware. Same results. > We started testing the second unit, to ensure the previous unit was not malfunctioning or defective. In such "tests", we configured the device in the default 192.168.75.0 /24 segment and we attached the WAN interfaces to our LAN (behind the RV016 LAN). All the computers used for testing behind the SA540 LAN ports, were able to browse internet, download large linux ISO files and start RDP sessions without problems for days. Another important observation was: While connected like this, the SA540 web interface was very fast and lightweighted in comparison with the ISPs directly connected to the WAN and Optional interfaces. Both ISPs provide connectivity using Ethernet. One is a standard CATV+internet ISP, while the other is a more 'enterprise-level' approach with FTTH. We're running in circles! Any help, tips or recommendations will be greatly appreciated! Thanks in advance, Agustin. Buenos Aires, Argentina. ... View more