Yes I read your post and I am looking at my configuration right now.  Looks to be the exact same concept.   The configuration should work I agree, but the NAT is not allowing the traffic back in - in my case.  I included some of the debug ip nat detail above.   Did you also use a route map in your test configuration and I'm assuming the normal GE 0/1 ip nat outside and the ip nat inside for VLAN 1.   Let me change some of the rules and add the any to the access list and see what happens - I will report back in just about 1 hour.  We will get this wrapped up tonight. ... View more

Hi Francesco,   Let us say that we have four servers: 192.168.0.200 - production1.domain.com - Open Port 81 192.168.0.201 - production2.domain.com - Open Port 443 192.168.0.202 - production3.domain.com - Open Port 8040 192.168.0.203 - production4.domain.com - Open Port 8250   In the VLAN of 1022 potential hosts: 192.168.0.1 - 192.168.3.254 - let us say we have a virtual desktop or computer at:   192.168.0.250 - Normal Computer, this computer has the following static IP Address:   192.168.0.250 255.255.255.0 192.168.0.1 DNS 1: 4.2.2.2 - or whatever the ISP has issued DNS 2: 8.8.8.8 - or whatever the ISP has issued   If you open a browser and type in production1.domain.com:81 --> it fails to load from within the VLAN unless the DNS Server is the actual router with the DNS Server enabled and the IP hosts the router can use to resolve it or if the etc host file or domain controller with DNS server roll running is the primary DNS for the workstation.   This is not possible in this application the DNS Servers have to be public ones.   When you try to visit the various hostnames above from teh VLAN it fails, but works fine externally.   If you do an nslookup on the desktop (192.168.0.250) for production1.domain.com it returns the public IP Address of GE8.  It responds to pings, but the router doesn't let it automatically resolve back in with the hostname or even if I type in 96.253.18.130:8040 into the browser.   I know this is a very odd case, but this is the requirements for the site that computers within the subnet with non-private DNS Servers are able to access any server via hostname that maybe hosted from within that VLAN.   At 10:15 EST - I will try various configurations on the router and immediatley post back to this page.   I hope I explained it better.  Please let me know.     ... View more

Hi Peter,   No apologies needed on the delay.  Just early this morning we were working on the TAC SR 683629902 case and the solution provided didn't really address the requirements.  We were able to configure that on our own.   Then I showed them the forum post you provided and they said yes that is one way it could be done.   Literally we programmed it with them, but because it was so late / early in the morning depending on how you look at it, when we tried to test I needed to review the Microsoft Loopback configuration on the Windows Server.   For example I added the loopback interface - configured the public IP address on it and that is where I stopped.  I probably need to start either Internet sharing or bridging the NICs to get that to work so it will work with the router - unless just having the adapter there with the static IP on it is enough.   I advised them I would e-mail them.   I would honestly still be curious to see what the double NAT configuration will look like.  I will have physical access to the site again this is when I will test everything out and see if I can make the site function as needed based on the requirements.   Any additional insight or thoughts you have please share as I will be on site in a couple hours to review this further.  Many thanks. ... View more

Thanks Peter,   I'm trying it right now with the loop back and the PBR Routing.  Could you provide an example of the Double NAT scenario you had referenced earlier - I would like to see what that type of configuration would look like on the system.   Continue to keep me posted and I will provide an update shortly.  Thank you for your support. ... View more

Hello Peter @Peter Paluch,   Thank you for the response.  There is still an open service request number on this: SR683629902 - I'm awaiting to here from the Cisco team on it - we worked on it and they had to take the case to the lab and I have not heard anything back yet.   You are correct I would like a server such as 192.168.0.200 with public DNS Server when they are looking to reach the hostname assigned to server 192.168.0.201 to load from within the VLAN.  It only works externally.  The only IP Address assigned to the server currently is just the private IP.  So when you state that one of the following alternatives would need to be true the one that is true is this:   "The servers are configured only with their private IP addresses. (Yes) For packets from inside hosts targeted to the public server IP addresses, the router would translate the destination IP address from the public IP address to the private IP address. However, the router would also need to translate the source IP address of these packets to a fictious IP range to cause the servers to respond to clients through the router and not directly; if the source IP addresses were not changed, the communication would fail because the clients would attempt to talk to the servers using their public IPs but would be receiving responses from their private IPs, and would drop them as unexpected. Essentially, this would require a double NAT. Based on the nature of NAT on Cisco IOS-based devices, this alternative would be cumbersome and unintuitive to configure, and I would personally recommend avoiding it at all if possible."   Now since the configuration for that is not simple - I have no problem going with the first option.  The only thing here is that the: you state the servers would need to be configured with their appropriate public IP addresses as additional IP addresses they have, on top of their existing private IP addresses.   In the scenario here the servers all have the SAME public IP Address - hence why they all use different ports.  I'm not sure how I could add the public IP address to the servers as secondary without more managed switching devices, etc.  Maybe the double NAT is the solution.  If I had more IPs I would just use the 1:1 NAT option and it would work, but for this case that is not an option.   Yesterday before your recommendation came in I tried to reconfigure the NAT with just IP NAT enable commands.  Looking at the form at this link I thought this could be the issue based on the debug ip nat commands that were received:   https://supportforums.cisco.com/t5/lan-switching-and-routing/port-forwarding-issue/td-p/1446759   Regardless it did not work, but I want you to see the configuration that was applied:   I updated the configuration to the following:   ! Last configuration change at 14:33:45 EST Mon Dec 18 2017 version 15.3 service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! hostname Router ! boot-start-marker boot-end-marker ! aqm-register-fnf ! logging buffered 51200 warnings ! no aaa new-model clock timezone EST -5 0 ! ! ! ! ! ! ! ip dhcp excluded-address 192.168.0.1 192.168.0.99 ip dhcp excluded-address 192.168.0.200 192.168.0.254 ! ip dhcp pool internal  network 192.168.0.0 255.255.255.0  dns-server 192.168.0.213 4.2.2.2 71.243.0.12 68.237.161.12  domain-name epcomworld.local  default-router 192.168.0.1  lease 14 ! ! ! ip domain name router.testrouter.local ip name-server 4.2.2.2 ip cef no ipv6 cef ! ! ! ! ! multilink bundle-name authenticated ! ! ! ! ! ! ! license udi pid C891F-K9 ! ! ! ! ! ! ! ip ssh version 2 ! class-map match-all Voice  match ip dscp ef ! policy-map EGNVoice  class Voice   priority 25000 ! ! ! ! ! ! ! ! ! ! ! interface BRI0  no ip address  encapsulation hdlc  shutdown  isdn termination multidrop ! interface FastEthernet0  no ip address  duplex auto  speed auto ! interface GigabitEthernet0  no ip address ! interface GigabitEthernet1  no ip address ! interface GigabitEthernet2  no ip address ! interface GigabitEthernet3  no ip address ! interface GigabitEthernet4  no ip address ! interface GigabitEthernet5  no ip address ! interface GigabitEthernet6  no ip address ! interface GigabitEthernet7  no ip address ! interface GigabitEthernet8  ip address 96.253.18.131 255.255.255.0 secondary  ip address 96.253.18.130 255.255.255.0  ip nat enable  ip virtual-reassembly in  duplex auto  speed auto  service-policy output EGNVoice ! interface Vlan1  ip address 192.168.0.1 255.255.252.0  ip nat enable  ip virtual-reassembly in ! interface Async3  no ip address  encapsulation slip ! ip default-gateway 96.253.18.1 ip forward-protocol nd no ip http server no ip http secure-server ! ! ip nat source static tcp 192.168.0.202 8040 interface GigabitEthernet8 8040 ip nat source static tcp 192.168.0.202 8041 interface GigabitEthernet8 8041 ip nat source static tcp 192.168.0.251 3389 interface GigabitEthernet8 48526 ip nat source static tcp 192.168.0.200 81 interface GigabitEthernet8 81 ip nat source static tcp 192.168.0.201 443 interface GigabitEthernet8 443 ip nat source static tcp 192.168.0.203 8250 interface GigabitEthernet8 8250 ip nat source static tcp 192.168.0.216 48520 interface GigabitEthernet8 48520 ip nat source static tcp 192.168.0.217 48521 interface GigabitEthernet8 48521 ip nat source static tcp 192.168.0.218 48522 interface GigabitEthernet8 48522 ip nat source list 100 interface GigabitEthernet8 overload (I tried with access list 1 too and that did not work either) --> Nat Traffic did work, but the internal servers resolving to hostname via public DNS would not load sites. ip nat source static tcp 192.168.0.250 3389 interface GigabitEthernet8 48525 ip nat source static tcp 192.168.0.251 80 interface GigabitEthernet8 80 ip nat inside source static tcp 192.168.0.202 8040 interface GigabitEthernet8 8040 ip nat inside source static tcp 192.168.0.202 8041 interface GigabitEthernet8 8041 ip nat inside source static tcp 192.168.0.251 3389 interface GigabitEthernet8 48526 ip nat inside source static tcp 192.168.0.200 81 interface GigabitEthernet8 81 ip nat inside source static tcp 192.168.0.201 443 interface GigabitEthernet8 443 ip nat inside source static tcp 192.168.0.203 8250 interface GigabitEthernet8 8250 ip nat inside source static tcp 192.168.0.216 48520 interface GigabitEthernet8 48520 ip nat inside source static tcp 192.168.0.217 48521 interface GigabitEthernet8 48521 ip nat inside source static tcp 192.168.0.218 48522 interface GigabitEthernet8 48522 ip nat inside source static tcp 192.168.0.250 3389 interface GigabitEthernet8 48525 ip nat inside source static tcp 192.168.0.251 80 interface GigabitEthernet8 80 ip nat inside source route-map FE0_General_Failover interface FastEthernet0 overload ip nat inside source route-map GE8_General_Failover interface GigabitEthernet8 overload ip nat inside source static tcp 192.168.0.250 3389 96.253.18.130 48525 extendable ip nat inside source static tcp 192.168.0.251 3389 96.253.18.130 48526 extendable ip route 0.0.0.0 0.0.0.0 96.253.18.1 ! ! route-map GE8_General_Failover permit 1  match ip address 100  match interface GigabitEthernet8 ! route-map FE0_General_Failover permit 1  match ip address 100  match interface FastEthernet0 ! access-list 1 permit 192.168.0.0 0.0.3.255 access-list 100 deny   ip 192.168.0.0 0.0.3.255 host 96.253.18.130 access-list 100 deny   ip 192.168.0.0 0.0.3.255 host 96.253.18.131 access-list 100 permit ip 192.168.0.0 0.0.3.255 any ! control-plane ! ! ! mgcp behavior rsip-range tgcp-only mgcp behavior comedia-role none mgcp behavior comedia-check-media-src disable mgcp behavior comedia-sdp-force disable ! mgcp profile default ! ! ! ! banner login ^CAuthorized Personnel Only!  Please enter username and password.  All attempts on this device will be logged and recorded.  Contact Epcom Global Networks for support and service! ^C ! line con 0  logging synchronous  login  no modem enable  transport preferred none line aux 0  login  transport preferred none line 3  modem InOut  speed 115200  flowcontrol hardware line vty 0 4  privilege level 15  login local  transport preferred none  transport input ssh ! scheduler allocate 20000 1000 !   I will now re-code the router with the configuration you have suggested.  It is so interesting to me that the D-Link Router does this fine as this was the environment these devices / servers were used in and within that VLAN with the open ports to the various servers you could use hostname resolution and it did work.  I never realized / knew this would be so complex to enable on the Cisco ISR platform.   Please let me know your continued thoughts - many thanks.     ... View more

Hi Francesco,   That statement should have said - when trying to access the hostname within the LAN the page does not load, though the DNS resolves it to the PUBLIC IP address of GE8.   The DNS Server is: 4.2.2.2 and even with 8.8.8.8 same thing.  The nslookup is as follows:   Server:  b.resolvers.Level3.net Address:  4.2.2.2 Non-authoritative answer: Name:    test.domain.com Address:  96.253.18.130   When doing a debug ip nat detail I get this statement and I do not know why the router has 0.0.0.0 (local address) in it:   *Dec 18 16:42:31.872: NAT*: TCP s=3389->47525, d=64289 *Dec 18 16:42:31.872: NAT*: s=192.168.0.200->96.253.18.130, d=73.142.85.98 [15194] *Dec 18 16:42:31.872: NAT*: i: tcp (192.168.0.200, 3389) -> (73.142.85.98, 64289) [15195] *Dec 18 16:42:31.872: NAT*: TCP s=3389->47525, d=64289 *Dec 18 16:42:31.872: NAT*: s=192.168.0.200->96.253.18.130, d=73.142.85.98 [15195] *Dec 18 16:42:31.908: NAT*: o: tcp (73.142.85.98, 50281) -> (96.253.18.130, 443) [12832] *Dec 18 16:42:31.908: NAT*: s=73.142.85.98, d=96.253.18.130->192.168.0.201 [12832] *Dec 18 16:42:31.912: NAT*: o: tcp (73.142.85.98, 64289) -> (96.253.18.130, 47525) [12833] *Dec 18 16:42:31.912: NAT*: TCP s=64289, d=47525->3389 *Dec 18 16:42:31.912: NAT*: s=73.142.85.98, d=96.253.18.130->192.168.0.200 [12833] *Dec 18 16:42:31.916: NAT: API parameters passed: src_addr:192.168.0.200, src_port:0 dest_addr:96.253.18.130, dest_port:0, proto:6 if_input:Vlan1 pak:E85C1C0 get_translated:1 *Dec 18 16:42:31.916: NAT - SYSTEM PORT for 96.253.18.130: allocated port 0, refcount 37098, localport 4294967295, localaddr 0.0.0.0, flags 1, syscount 37098, proto 6 *Dec 18 16:42:31.916: NAT: API parameters passed: src_addr:192.168.0.200, src_port:0 dest_addr:96.253.18.130, dest_port:0, proto:6 if_input:Vlan1 pak:E85C1C0 get_translated:1 *Dec 18 16:42:31.916: NAT - SYSTEM PORT for 96.253.18.130: allocated port 0, refcount 37099, localport 4294967295, localaddr 0.0.0.0, flags 1, syscount 37099, proto 6 *Dec 18 16:42:31.924: NAT*: i: tcp (192.168.0.201, 443) -> (73.142.85.98, 50281) [3326] *Dec 18 16:42:31.924: NAT*: s=192.168.0.201->96.253.18.130, d=73.142.85.98 [3326] *Dec 18 16:42:31.932: NAT*: i: tcp (192.168.0.200, 3389) -> (73.142.85.98, 64289) [15196] *Dec 18 16:42:31.932: NAT*: TCP s=3389->47525, d=64289 *Dec 18 16:42:31.932: NAT*: s=192.168.0.200->96.253.18.130, d=73.142.85.98 [15196] *Dec 18 16:42:31.932: NAT*: i: tcp (192.168.0.200, 3389) -> (73.142.85.98, 64289) [15197] *Dec 18 16:42:31.932: NAT*: TCP s=3389->47525, d=64289 *Dec 18 16:42:31.932: NAT*: s=192.168.0.200->96.253.18.130, d=73.142.85.98 [15197] *Dec 18 16:42:31.932: NAT*: i: tcp (192.168.0.200, 3389) -> (73.142.85.98, 64289) [15198]   In the above debug server 192.168.0.200 was using Firefox to access the server via hostname running on 192.168.0.202.  Publically this works, but within the VLAN you cannot get the browser to open the page with the hostname.  You would either have to use the public IP address or a DNS Server that has the rule in it with the internal VLAN IP to make it work.  I have edited the Windows Host File and it works fine, but that is not a solution for a network with 0.0.3.255 devices.   Continue to keep me posted on your thoughts.  Thanks. ... View more

Hello All,   I have configured the ip name-server 4.2.2.2 option and the ip domain lookup is back in the config.   I have updated the access-list 100 to have the two deny options on top and the permit option 3rd on the list.   However, when trying to resolve the hostname within the VLAN still does not work.   The route-map is for another ISP that has not yet been installed, but will be soon.   Any other suggestions are welcome. ... View more

Hello Again,   Yes I did do that and the system is definitely messed up.  I did open a case with TAC on this matter last week and they promised to test it in the lab and get back to me tomorrow (Monday) - I hope they do because I think it is crazy that a high end router has issues doing this, but a D-Link router does it fine.  There must be some with to make it work - it just doesn't seem plausible.   The configuration in the latest state is as follows:   Current configuration : 4379 bytes ! ! Last configuration change at 21:34:26 EST Sun Dec 17 2017 by version 15.3 service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! hostname Test-Router ! boot-start-marker boot-end-marker ! aqm-register-fnf ! logging buffered 51200 warnings enable secret 5 enable password 7 ! no aaa new-model clock timezone EST -5 0 ! ! ! ! ! ! ! ip dhcp excluded-address 192.168.0.1 192.168.0.99 ip dhcp excluded-address 192.168.0.200 192.168.0.254 ! ip dhcp pool internal  network 192.168.0.0 255.255.255.0  dns-server 192.168.0.213 4.2.2.2 71.243.0.12 68.237.161.12  domain-name testrouter.local  default-router 192.168.0.1  lease 14 ! ! ! no ip domain lookup ip domain name router.testrouter.local ip cef no ipv6 cef ! ! ! ! ! multilink bundle-name authenticated ! ! ! ! ! ! ! license udi pid C891F-K9 ! ! ! ! ! ! ! ip ssh version 2 ! class-map match-all Voice  match ip dscp ef ! policy-map EGNVoice  class Voice   priority 25000 ! ! ! ! ! ! ! ! ! ! ! interface BRI0  no ip address  encapsulation hdlc  shutdown  isdn termination multidrop ! interface FastEthernet0  no ip address  duplex auto  speed auto ! interface GigabitEthernet0  no ip address ! interface GigabitEthernet1  no ip address ! interface GigabitEthernet2  no ip address ! interface GigabitEthernet3  no ip address ! interface GigabitEthernet4  no ip address ! interface GigabitEthernet5  no ip address ! interface GigabitEthernet6  no ip address ! interface GigabitEthernet7  no ip address ! interface GigabitEthernet8  ip address 96.253.18.131 255.255.255.0 secondary  ip address 96.253.18.130 255.255.255.0  ip nat outside  ip virtual-reassembly in  duplex auto  speed auto  service-policy output EGNVoice ! interface Vlan1  ip address 192.168.0.1 255.255.252.0  ip nat inside  ip virtual-reassembly in ! interface Async3  no ip address  encapsulation slip ! ip default-gateway 96.253.18.1 ip forward-protocol nd no ip http server no ip http secure-server ! ! ip nat inside source route-map FE0_General_Failover interface FastEthernet0 overload ip nat inside source route-map GE8_General_Failover interface GigabitEthernet8 overload ip nat inside source static tcp 192.168.0.200 81 96.253.18.130 81 extendable ip nat inside source static tcp 192.168.0.201 443 96.253.18.130 443 extendable ip nat inside source static tcp 192.168.0.202 8040 96.253.18.130 8040 extendable ip nat inside source static tcp 192.168.0.202 8041 96.253.18.130 8041 extendable ip nat inside source static tcp 192.168.0.203 8250 96.253.18.130 8250 extendable ip nat inside source static tcp 192.168.0.216 48520 96.253.18.130 48520 extendable ip nat inside source static tcp 192.168.0.217 48521 96.253.18.130 48521 extendable ip nat inside source static tcp 192.168.0.218 48522 96.253.18.130 48522 extendable ip route 0.0.0.0 0.0.0.0 96.253.18.1 ! ! route-map GE8_General_Failover permit 1  match ip address 100  match interface GigabitEthernet8 ! route-map FE0_General_Failover permit 1  match ip address 100  match interface FastEthernet0 ! snmp-server location Epcom RI, USA snmp-server contact Epcom World Industries, Inc. access-list 100 permit ip 192.168.0.0 0.0.3.255 any access-list 100 deny   ip 192.168.0.0 0.0.3.255 host 96.253.18.130 access-list 100 deny   ip 192.168.0.0 0.0.3.255 host 96.253.18.131 ! control-plane ! ! ! mgcp behavior rsip-range tgcp-only mgcp behavior comedia-role none mgcp behavior comedia-check-media-src disable mgcp behavior comedia-sdp-force disable ! mgcp profile default ! ! ! ! ! line con 0  password 7  logging synchronous  login  no modem enable line aux 0  password 7  login line 3  modem InOut  speed 115200  flowcontrol hardware line vty 0 4  privilege level 15  password 7  login local  transport input ssh ! scheduler allocate 20000 1000 ! end ... View more

Hi Francesco,   I agree I went to the main page and the last post is not posting you are correct - I do not know why this is the case!  Very strange.   Yes nslookup provides the public ip the 55.55.55.55.   Yes the goal is to simply type in the hostname which resolves the public ip when using the public DNS Servers or really any DNS Servers (other then internal, which could obviously provide the public automatically).  If you try to access router.testrouter.com from outside the network it works fine with the static NAT rules.  I want a LAN users to type in router.testrouter.com and it works fine too from the VLAN.   I do not understand why a cheap consumer router will do it and this Cisco Router will not.  The Cisco Router knows that it is trying to get the public IP address: 55.55.55.55, but why doesn't it router it back in?  Or how do I tell the router that with Internal traffic allow it to come back in - now I'm rambling, but you get my point.  And using a provided DNS Server is not an option - its needs to be able to work independently.   Here are the IP NAT Translations: do sh ip nat translations Pro Inside global         Inside local          Outside local         Outside global udp 96.253.18.130:49265   192.168.0.102:49265   4.2.2.2:53            4.2.2.2:53 tcp 96.253.18.130:49708   192.168.0.102:49708   65.52.108.207:443     65.52.108.207:443 tcp 96.253.18.130:49719   192.168.0.102:49719   17.248.135.242:443    17.248.135.242:443 tcp 96.253.18.130:49726   192.168.0.102:49726   17.249.108.26:5223    17.249.108.26:5223 tcp 96.253.18.130:49735   192.168.0.102:49735   77.234.44.25:80       77.234.44.25:80 tcp 96.253.18.130:49962   192.168.0.102:49962   17.249.124.78:5223    17.249.124.78:5223 tcp 96.253.18.130:50332   192.168.0.102:50332   77.234.41.253:80      77.234.41.253:80 tcp 96.253.18.130:50343   192.168.0.102:50343   69.31.33.97:80        69.31.33.97:80 tcp 96.253.18.130:50757   192.168.0.102:50757   52.3.238.163:2096     52.3.238.163:2096 tcp 96.253.18.130:50762   192.168.0.102:50762   72.21.91.97:443       72.21.91.97:443 tcp 96.253.18.130:50763   192.168.0.102:50763   23.192.43.231:443     23.192.43.231:443 tcp 96.253.18.130:50765   192.168.0.102:50765   204.79.197.200:443    204.79.197.200:443 tcp 96.253.18.130:50766   192.168.0.102:50766   93.184.216.180:443    93.184.216.180:443 tcp 96.253.18.130:50767   192.168.0.102:50767   151.139.237.113:443   151.139.237.113:443 tcp 96.253.18.130:50768   192.168.0.102:50768   108.161.189.121:443   108.161.189.121:443 tcp 96.253.18.130:50770   192.168.0.102:50770   72.21.91.97:443       72.21.91.97:443 tcp 96.253.18.130:50776   192.168.0.102:50776   172.217.7.6:443       172.217.7.6:443 tcp 96.253.18.130:50777   192.168.0.102:50777   172.217.11.46:80      172.217.11.46:80 tcp 96.253.18.130:50779   192.168.0.102:50779   31.13.71.36:443       31.13.71.36:443 tcp 96.253.18.130:50780   192.168.0.102:50780   172.217.6.226:443     172.217.6.226:443 tcp 96.253.18.130:50781   192.168.0.102:50781   23.203.74.48:443      23.203.74.48:443 tcp 96.253.18.130:50782   192.168.0.102:50782   52.85.139.32:443      52.85.139.32:443 tcp 96.253.18.130:50785   192.168.0.102:50785   149.174.28.138:443    149.174.28.138:443 tcp 96.253.18.130:50788   192.168.0.102:50788   172.217.13.228:443    172.217.13.228:443 tcp 96.253.18.130:50789   192.168.0.102:50789   72.21.91.29:80        72.21.91.29:80 tcp 96.253.18.130:50790   192.168.0.102:50790   23.54.187.27:80       23.54.187.27:80 tcp 96.253.18.130:50796   192.168.0.102:50796   13.32.81.60:80        13.32.81.60:80 tcp 96.253.18.130:50799   192.168.0.102:50799   172.217.11.2:443      172.217.11.2:443 tcp 96.253.18.130:50829   192.168.0.102:50829   34.211.171.230:443    34.211.171.230:443 tcp 96.253.18.130:50830   192.168.0.102:50830   172.217.10.42:443     172.217.10.42:443 tcp 96.253.18.130:50839   192.168.0.102:50839   34.211.171.230:443    34.211.171.230:443 tcp 96.253.18.130:50840   192.168.0.102:50840   208.74.205.244:443    208.74.205.244:443 tcp 96.253.18.130:50841   192.168.0.102:50841   208.74.205.244:443    208.74.205.244:443 udp 96.253.18.130:51899   192.168.0.102:51899   4.2.2.2:53            4.2.2.2:53 udp 96.253.18.130:53183   192.168.0.102:53183   4.2.2.2:53            4.2.2.2:53 tcp 96.253.18.130:53321   192.168.0.102:53321   72.247.9.208:80       72.247.9.208:80 tcp 96.253.18.130:53380   192.168.0.102:53380   69.31.33.112:80       69.31.33.112:80 udp 96.253.18.130:53821   192.168.0.102:53821   4.2.2.2:53            4.2.2.2:53 udp 96.253.18.130:55250   192.168.0.102:55250   4.2.2.2:53            4.2.2.2:53 udp 96.253.18.130:55841   192.168.0.102:55841   4.2.2.2:53            4.2.2.2:53 udp 96.253.18.130:57032   192.168.0.102:57032   4.2.2.2:53            4.2.2.2:53 udp 96.253.18.130:57069   192.168.0.102:57069   4.2.2.2:53            4.2.2.2:53 udp 96.253.18.130:58644   192.168.0.102:58644   4.2.2.2:53            4.2.2.2:53 udp 96.253.18.130:58813   192.168.0.102:58813   4.2.2.2:53            4.2.2.2:53 udp 96.253.18.130:60341   192.168.0.102:60341   94.245.121.251:3544   94.245.121.251:3544 udp 96.253.18.130:123     192.168.0.103:123     52.168.138.145:123    52.168.138.145:123 tcp 96.253.18.130:49777   192.168.0.103:49777   65.52.108.229:443     65.52.108.229:443 tcp 96.253.18.130:81      192.168.0.200:81      ---                   --- tcp 96.253.18.130:443     192.168.0.201:443     73.142.85.98:50281    73.142.85.98:50281 tcp 96.253.18.130:443     192.168.0.201:443     73.142.85.98:58152    73.142.85.98:58152 tcp 96.253.18.130:443     192.168.0.201:443     183.82.21.246:18508   183.82.21.246:18508 tcp 96.253.18.130:443     192.168.0.201:443     ---                   --- tcp 96.253.18.130:8040    192.168.0.202:8040    ---                   --- tcp 96.253.18.130:8041    192.168.0.202:8041    23.30.128.149:53325   23.30.128.149:53325 tcp 96.253.18.130:8041    192.168.0.202:8041    23.30.128.149:57301   23.30.128.149:57301 tcp 96.253.18.130:8041    192.168.0.202:8041    23.30.128.149:65265   23.30.128.149:65265 tcp 96.253.18.130:8041    192.168.0.202:8041    23.30.136.73:63696    23.30.136.73:63696 tcp 96.253.18.130:8041    192.168.0.202:8041    24.147.248.185:49765  24.147.248.185:49765 tcp 96.253.18.130:8041    192.168.0.202:8041    24.248.59.200:51968   24.248.59.200:51968 tcp 96.253.18.130:8041    192.168.0.202:8041    24.248.59.200:52655   24.248.59.200:52655 Pro Inside global         Inside local          Outside local         Outside global tcp 96.253.18.130:8041    192.168.0.202:8041    24.248.59.200:54261   24.248.59.200:54261 tcp 96.253.18.130:8041    192.168.0.202:8041    24.248.59.200:55463   24.248.59.200:55463 tcp 96.253.18.130:8041    192.168.0.202:8041    32.217.110.140:49176  32.217.110.140:49176 tcp 96.253.18.130:8041    192.168.0.202:8041    32.217.110.140:50648  32.217.110.140:50648 tcp 96.253.18.130:8041    192.168.0.202:8041    32.217.110.140:53605  32.217.110.140:53605 tcp 96.253.18.130:8041    192.168.0.202:8041    32.217.110.140:57469  32.217.110.140:57469 tcp 96.253.18.130:8041    192.168.0.202:8041    32.217.110.140:61688  32.217.110.140:61688 tcp 96.253.18.130:8041    192.168.0.202:8041    45.47.191.158:51935   45.47.191.158:51935 tcp 96.253.18.130:8041    192.168.0.202:8041    50.195.2.38:50254     50.195.2.38:50254 tcp 96.253.18.130:8041    192.168.0.202:8041    50.195.2.38:54492     50.195.2.38:54492 tcp 96.253.18.130:8041    192.168.0.202:8041    50.195.2.38:61850     50.195.2.38:61850 tcp 96.253.18.130:8041    192.168.0.202:8041    50.199.234.121:50573  50.199.234.121:50573 tcp 96.253.18.130:8041    192.168.0.202:8041    50.199.234.121:53488  50.199.234.121:53488 tcp 96.253.18.130:8041    192.168.0.202:8041    50.241.114.241:49680  50.241.114.241:49680 tcp 96.253.18.130:8041    192.168.0.202:8041    50.241.114.241:49697  50.241.114.241:49697 tcp 96.253.18.130:8041    192.168.0.202:8041    50.241.114.241:50959  50.241.114.241:50959 tcp 96.253.18.130:8041    192.168.0.202:8041    50.241.114.241:54320  50.241.114.241:54320 tcp 96.253.18.130:8041    192.168.0.202:8041    50.241.114.241:61015  50.241.114.241:61015 tcp 96.253.18.130:8041    192.168.0.202:8041    52.205.250.85:50408   52.205.250.85:50408 tcp 96.253.18.130:8041    192.168.0.202:8041    66.31.95.77:49565     66.31.95.77:49565 tcp 96.253.18.130:8041    192.168.0.202:8041    66.31.95.77:61001     66.31.95.77:61001 tcp 96.253.18.130:8041    192.168.0.202:8041    66.31.95.77:62140     66.31.95.77:62140 tcp 96.253.18.130:8041    192.168.0.202:8041    66.31.95.77:65278     66.31.95.77:65278 tcp 96.253.18.130:8041    192.168.0.202:8041    66.162.5.126:52706    66.162.5.126:52706 tcp 96.253.18.130:8041    192.168.0.202:8041    67.231.75.119:53970   67.231.75.119:53970 tcp 96.253.18.130:8041    192.168.0.202:8041    68.15.32.236:51476    68.15.32.236:51476 tcp 96.253.18.130:8041    192.168.0.202:8041    68.15.32.236:51493    68.15.32.236:51493 tcp 96.253.18.130:8041    192.168.0.202:8041    68.15.32.236:54541    68.15.32.236:54541 tcp 96.253.18.130:8041    192.168.0.202:8041    68.15.32.236:65390    68.15.32.236:65390 tcp 96.253.18.130:8041    192.168.0.202:8041    68.15.36.142:50587    68.15.36.142:50587 tcp 96.253.18.130:8041    192.168.0.202:8041    68.15.36.142:60346    68.15.36.142:60346 tcp 96.253.18.130:8041    192.168.0.202:8041    68.15.58.104:58500    68.15.58.104:58500 tcp 96.253.18.130:8041    192.168.0.202:8041    68.15.58.104:62777    68.15.58.104:62777 tcp 96.253.18.130:8041    192.168.0.202:8041    68.109.229.60:59845   68.109.229.60:59845 tcp 96.253.18.130:8041    192.168.0.202:8041    70.184.15.169:54888   70.184.15.169:54888 tcp 96.253.18.130:8041    192.168.0.202:8041    71.174.230.21:1582    71.174.230.21:1582 tcp 96.253.18.130:8041    192.168.0.202:8041    71.174.230.21:49956   71.174.230.21:49956 tcp 96.253.18.130:8041    192.168.0.202:8041    71.174.230.21:54961   71.174.230.21:54961 tcp 96.253.18.130:8041    192.168.0.202:8041    71.174.230.21:58859   71.174.230.21:58859 tcp 96.253.18.130:8041    192.168.0.202:8041    71.174.230.21:63357   71.174.230.21:63357 tcp 96.253.18.130:8041    192.168.0.202:8041    71.235.17.11:57693    71.235.17.11:57693 tcp 96.253.18.130:8041    192.168.0.202:8041    71.235.17.11:59218    71.235.17.11:59218 tcp 96.253.18.130:8041    192.168.0.202:8041    71.235.17.11:59407    71.235.17.11:59407 tcp 96.253.18.130:8041    192.168.0.202:8041    71.235.18.154:12833   71.235.18.154:12833 tcp 96.253.18.130:8041    192.168.0.202:8041    72.28.249.24:49680    72.28.249.24:49680 tcp 96.253.18.130:8041    192.168.0.202:8041    72.28.249.24:52790    72.28.249.24:52790 tcp 96.253.18.130:8041    192.168.0.202:8041    72.87.103.245:60390   72.87.103.245:60390 tcp 96.253.18.130:8041    192.168.0.202:8041    72.200.172.191:49855  72.200.172.191:49855 tcp 96.253.18.130:8041    192.168.0.202:8041    72.200.173.60:52186   72.200.173.60:52186 tcp 96.253.18.130:8041    192.168.0.202:8041    72.215.234.12:51998   72.215.234.12:51998 tcp 96.253.18.130:8041    192.168.0.202:8041    72.215.234.12:55726   72.215.234.12:55726 tcp 96.253.18.130:8041    192.168.0.202:8041    72.215.234.12:57225   72.215.234.12:57225 tcp 96.253.18.130:8041    192.168.0.202:8041    72.215.234.12:57341   72.215.234.12:57341 tcp 96.253.18.130:8041    192.168.0.202:8041    72.215.234.12:58842   72.215.234.12:58842 tcp 96.253.18.130:8041    192.168.0.202:8041    72.215.234.12:58885   72.215.234.12:58885 tcp 96.253.18.130:8041    192.168.0.202:8041    73.4.247.127:64749    73.4.247.127:64749 tcp 96.253.18.130:8041    192.168.0.202:8041    73.38.192.238:51937   73.38.192.238:51937 tcp 96.253.18.130:8041    192.168.0.202:8041    73.38.192.238:58904   73.38.192.238:58904 tcp 96.253.18.130:8041    192.168.0.202:8041    73.142.84.18:49699    73.142.84.18:49699 tcp 96.253.18.130:8041    192.168.0.202:8041    73.142.85.98:60337    73.142.85.98:60337 Pro Inside global         Inside local          Outside local         Outside global tcp 96.253.18.130:8041    192.168.0.202:8041    73.142.211.152:52021  73.142.211.152:52021 tcp 96.253.18.130:8041    192.168.0.202:8041    73.159.224.142:49158  73.159.224.142:49158 tcp 96.253.18.130:8041    192.168.0.202:8041    73.159.224.142:49676  73.159.224.142:49676 tcp 96.253.18.130:8041    192.168.0.202:8041    74.92.21.69:49695     74.92.21.69:49695 tcp 96.253.18.130:8041    192.168.0.202:8041    74.92.21.69:49761     74.92.21.69:49761 tcp 96.253.18.130:8041    192.168.0.202:8041    74.92.21.69:50115     74.92.21.69:50115 tcp 96.253.18.130:8041    192.168.0.202:8041    74.92.21.69:50742     74.92.21.69:50742 tcp 96.253.18.130:8041    192.168.0.202:8041    74.92.21.69:50867     74.92.21.69:50867 tcp 96.253.18.130:8041    192.168.0.202:8041    74.92.21.69:52069     74.92.21.69:52069 tcp 96.253.18.130:8041    192.168.0.202:8041    74.92.21.69:57094     74.92.21.69:57094 tcp 96.253.18.130:8041    192.168.0.202:8041    74.92.21.69:65187     74.92.21.69:65187 tcp 96.253.18.130:8041    192.168.0.202:8041    74.93.17.145:53171    74.93.17.145:53171 tcp 96.253.18.130:8041    192.168.0.202:8041    75.136.103.62:59160   75.136.103.62:59160 tcp 96.253.18.130:8041    192.168.0.202:8041    75.144.178.205:49159  75.144.178.205:49159 tcp 96.253.18.130:8041    192.168.0.202:8041    75.144.178.205:50928  75.144.178.205:50928 tcp 96.253.18.130:8041    192.168.0.202:8041    75.144.178.205:53638  75.144.178.205:53638 tcp 96.253.18.130:8041    192.168.0.202:8041    75.144.178.205:59282  75.144.178.205:59282 tcp 96.253.18.130:8041    192.168.0.202:8041    88.98.45.178:35673    88.98.45.178:35673 tcp 96.253.18.130:8041    192.168.0.202:8041    88.98.45.178:63410    88.98.45.178:63410 tcp 96.253.18.130:8041    192.168.0.202:8041    96.81.97.229:51778    96.81.97.229:51778 tcp 96.253.18.130:8041    192.168.0.202:8041    96.238.23.70:49784    96.238.23.70:49784 tcp 96.253.18.130:8041    192.168.0.202:8041    98.175.220.253:52708  98.175.220.253:52708 tcp 96.253.18.130:8041    192.168.0.202:8041    98.175.220.253:58651  98.175.220.253:58651 tcp 96.253.18.130:8041    192.168.0.202:8041    98.175.220.253:63644  98.175.220.253:63644 tcp 96.253.18.130:8041    192.168.0.202:8041    98.179.142.155:61573  98.179.142.155:61573 tcp 96.253.18.130:8041    192.168.0.202:8041    107.3.102.51:60448    107.3.102.51:60448 tcp 96.253.18.130:8041    192.168.0.202:8041    107.3.103.31:52206    107.3.103.31:52206 tcp 96.253.18.130:8041    192.168.0.202:8041    107.3.103.31:52928    107.3.103.31:52928 tcp 96.253.18.130:8041    192.168.0.202:8041    107.3.103.31:57211    107.3.103.31:57211 tcp 96.253.18.130:8041    192.168.0.202:8041    107.3.103.31:60276    107.3.103.31:60276 tcp 96.253.18.130:8041    192.168.0.202:8041    107.3.103.31:63125    107.3.103.31:63125 tcp 96.253.18.130:8041    192.168.0.202:8041    107.3.103.42:50059    107.3.103.42:50059 tcp 96.253.18.130:8041    192.168.0.202:8041    108.34.147.34:49164   108.34.147.34:49164 tcp 96.253.18.130:8041    192.168.0.202:8041    108.34.147.34:51171   108.34.147.34:51171 tcp 96.253.18.130:8041    192.168.0.202:8041    108.34.147.34:61750   108.34.147.34:61750 tcp 96.253.18.130:8041    192.168.0.202:8041    108.34.190.129:49674  108.34.190.129:49674 tcp 96.253.18.130:8041    192.168.0.202:8041    108.34.243.180:55226  108.34.243.180:55226 tcp 96.253.18.130:8041    192.168.0.202:8041    137.103.106.57:51934  137.103.106.57:51934 tcp 96.253.18.130:8041    192.168.0.202:8041    173.9.72.90:52176     173.9.72.90:52176 tcp 96.253.18.130:8041    192.168.0.202:8041    173.69.43.38:52707    173.69.43.38:52707 tcp 96.253.18.130:8041    192.168.0.202:8041    173.69.43.38:63088    173.69.43.38:63088 tcp 96.253.18.130:8041    192.168.0.202:8041    198.0.158.245:49157   198.0.158.245:49157 tcp 96.253.18.130:8041    192.168.0.202:8041    198.0.158.245:49159   198.0.158.245:49159 tcp 96.253.18.130:8041    192.168.0.202:8041    198.0.158.245:50146   198.0.158.245:50146 tcp 96.253.18.130:8041    192.168.0.202:8041    198.0.158.245:51679   198.0.158.245:51679 tcp 96.253.18.130:8041    192.168.0.202:8041    198.0.158.245:51733   198.0.158.245:51733 tcp 96.253.18.130:8041    192.168.0.202:8041    198.0.158.245:52866   198.0.158.245:52866 tcp 96.253.18.130:8041    192.168.0.202:8041    198.0.158.245:57001   198.0.158.245:57001 tcp 96.253.18.130:8041    192.168.0.202:8041    198.0.158.245:61199   198.0.158.245:61199 tcp 96.253.18.130:8041    192.168.0.202:8041    198.0.158.245:63355   198.0.158.245:63355 tcp 96.253.18.130:8041    192.168.0.202:8041    208.103.76.60:61116   208.103.76.60:61116 tcp 96.253.18.130:8041    192.168.0.202:8041    216.255.173.171:58742 216.255.173.171:58742 tcp 96.253.18.130:8041    192.168.0.202:8041    ---                   --- tcp 96.253.18.130:8250    192.168.0.203:8250    ---                   --- tcp 96.253.18.130:48520   192.168.0.216:48520   ---                   --- tcp 96.253.18.130:49162   192.168.0.216:49162   77.234.42.239:80      77.234.42.239:80 tcp 96.253.18.130:49760   192.168.0.216:49760   173.240.170.112:443   173.240.170.112:443 tcp 96.253.18.130:49879   192.168.0.216:49879   69.31.33.97:80        69.31.33.97:80 tcp 96.253.18.130:49883   192.168.0.216:49883   77.234.42.252:443     77.234.42.252:443 tcp 96.253.18.130:48521   192.168.0.217:48521   ---                   --- Pro Inside global         Inside local          Outside local         Outside global tcp 96.253.18.130:49159   192.168.0.217:49159   77.234.41.34:80       77.234.41.34:80 tcp 96.253.18.130:52355   192.168.0.217:52355   165.254.0.33:80       165.254.0.33:80 tcp 96.253.18.130:53170   192.168.0.217:53170   69.31.33.97:80        69.31.33.97:80 tcp 96.253.18.130:53251   192.168.0.217:53251   77.234.42.252:80      77.234.42.252:80 tcp 96.253.18.130:48522   192.168.0.218:48522   ---                   --- tcp 96.253.18.130:49161   192.168.0.218:49161   77.234.42.249:80      77.234.42.249:80 tcp 96.253.18.130:51714   192.168.0.218:51714   72.247.9.208:80       72.247.9.208:80 tcp 96.253.18.130:52280   192.168.0.218:52280   77.234.42.253:80      77.234.42.253:80 ... View more

Hi Francesco that did not work - the pages still do not load with the following statements:   access-list 100 permit ip 192.168.0.0 0.0.3.255 any access-list 100 deny   ip 192.168.0.0 0.0.3.255 host 55.55.55.55 access-list 100 deny   ip 192.168.0.0 0.0.3.255 host 55.55.55.56   I did add the ip into the statements you sent over below.  In addition, I did update the route maps.   However, the nslookup still returns the public IP address, but the page does not load.   Any other suggestions that you might have?  Willing to try anything. ... View more

Hi Francesco,   As requested here is the running configuration:   hostname Test-Router ! boot-start-marker boot-end-marker ! aqm-register-fnf ! no aaa new-model clock timezone EST -5 0 ! !          ! ! ! ! ! ip dhcp excluded-address 192.168.0.1 192.168.0.99 ip dhcp excluded-address 192.168.0.200 192.168.0.254 ! ip dhcp pool internal  network 192.168.0.0 255.255.255.0  dns-server 192.168.0.213 4.2.2.2 8.8.8.8  domain-name test.local  default-router 192.168.0.1  lease 14 ! ! ! ip domain name router.testrouter.local ip cef no ipv6 cef !          ! ! ! ! multilink bundle-name authenticated ! ! ! ! ! ! ! license udi pid C891F-K9 ! ! ! ! ! ! ip ssh version 2 !          class-map match-all Voice  match ip dscp ef ! policy-map EGNVoice  class Voice   priority 25000 ! ! ! ! ! ! ! ! ! ! ! interface BRI0  no ip address  encapsulation hdlc  shutdown  isdn termination multidrop !          interface FastEthernet0  no ip address  duplex auto  speed auto ! interface GigabitEthernet0  no ip address ! interface GigabitEthernet1  no ip address ! interface GigabitEthernet2  no ip address ! interface GigabitEthernet3  no ip address ! interface GigabitEthernet4  no ip address ! interface GigabitEthernet5  no ip address !          interface GigabitEthernet6  no ip address ! interface GigabitEthernet7  no ip address ! interface GigabitEthernet8  description 1GBPS Fiber  ip address 55.55.55.56 255.255.255.0 secondary  ip address 55.55.55.55 255.255.255.0  ip nat outside  ip virtual-reassembly in  duplex auto  speed auto  service-policy output EGNVoice ! interface Vlan1  ip address 192.168.0.1 255.255.252.0  ip nat inside  ip virtual-reassembly in ! interface Async3  no ip address  encapsulation slip ! ip default-gateway 55.55.55.1 ip forward-protocol nd no ip http server no ip http secure-server ! ! ip nat inside source route-map FE0_General_Failover interface FastEthernet0 overload ip nat inside source route-map GE8_General_Failover interface GigabitEthernet8 overload ip nat inside source static tcp 192.168.0.200 81 55.55.55.55 81 extendable ip nat inside source static tcp 192.168.0.201 443 55.55.55.55 443 extendable ip nat inside source static tcp 192.168.0.202 8040 55.55.55.55 8040 extendable ip nat inside source static tcp 192.168.0.202 8041 55.55.55.55 8041 extendable ip nat inside source static tcp 192.168.0.203 8250 55.55.55.55 8250 extendable ip route 0.0.0.0 0.0.0.0 55.55.55.1 ! ! route-map GE8_General_Failover permit 1  match ip address 1  match interface GigabitEthernet8 ! route-map FE0_General_Failover permit 1  match ip address 1  match interface FastEthernet0 ! access-list 1 permit 192.168.0.0 0.0.3.255   Let me know exactly what you would like to test and I'd be more then happy to try any configuration you think would allow the internal VLAN workstations (192.168.0.0 /255.255.252.0) to access to internal servers without error messages and DNS resotluion problems when using the public DNS Servers.   Thank you. ... View more