Here is the NAT order of operations in a Cisco router: http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080133ddd.shtml#topic1
I just put something together in the lab, not sure if this is what you want to accomplish, but it works like this: interface FastEthernet0/0 INSIDE INTERFACE ip address 192.168.1.1 255.255.255.0 ip nat inside ip virtual-reassembly ip policy route-map PBR speed 100 full-duplex ! interface FastEthernet0/1 OUTSIDE 1 (your ethernet) ip address 172.18.1.1 255.255.255.0 ip nat outside ip virtual-reassembly speed 100 full-duplex ! interface FastEthernet1/0 OUTSIDE 2 (your Dialer3) ip address 10.10.10.1 255.255.255.0 ip nat outside ip virtual-reassembly speed 100 full-duplex This is just to simulate Internet access on both routers. Behind Fa0/1 is a router with a loopback that has 1.1.1.1/24, the same goes for Fa1/0. ip route 0.0.0.0 0.0.0.0 172.18.1.2 ip route 0.0.0.0 0.0.0.0 10.10.10.2 ! standard PAT config. ACL 100 denys ICMP. Which means that SNMP will never be NAT:ed on Fa0/1. In your case this needs to be HTTP/HTTPS deny. ip nat inside source list 100 interface FastEthernet0/1 overload ip nat inside source list 101 interface FastEthernet1/0 overload ! access-list 100 deny icmp any any access-list 100 permit ip 192.168.1.0 0.0.0.255 any access-list 101 permit ip 192.168.1.0 0.0.0.255 any Then we do PBR, basically when the protocol is ICMP. Send it out of the Fa1/0 interface (Dialer3, again this should be web traffic for you) access-list 150 permit icmp any any ! ! route-map PBR permit 10 match ip address 150 set interface FastEthernet1/0 So when I ping 1.1.1.1 from the client, PBR kicks in and sends it to Fa1/0, and it gets NAT:ed isp2> *Mar 1 00:49:17.799: ICMP: echo reply sent, src 1.1.1.1, dst 10.10.10.1 *Mar 1 00:49:17.955: ICMP: echo reply sent, src 1.1.1.1, dst 10.10.10.1 *Mar 1 00:49:18.095: ICMP: echo reply sent, src 1.1.1.1, dst 10.10.10.1 *Mar 1 00:49:18.147: ICMP: echo reply sent, src 1.1.1.1, dst 10.10.10.1 *Mar 1 00:49:18.199: ICMP: echo reply sent, src 1.1.1.1, dst 10.10.10.1 And when I try a telnet to 1.1.1.1 PBR will not kick in, and it will just NAT it to Fa0/1. client#telnet 1.1.1.1 Trying 1.1.1.1 ... Open User Access Verification Password: isp1> Again, I'm not sure this will suit your environment. but perhaps you can get something from it .. Regards Roger On Mon, Aug 30, 2010 at 10:25 PM, Ray Davis <ray-li...@carpe.net> wrote: > Hi y'all, > > Got a customer router (2801, IOS 12.4(15)T10) with two upstream interfaces. > Both need to do NAT (private IPs inside). One is the default route, the > other should be used for web traffic. After trying various configs, I got > rerouting web traffic out the 2nd interface working, but it's not NATed > properly (going out with the default interface IP. I can also get multiple > NAT working, but not with the reroute web traffic route-map (only with static > routes). > > Has anyone done this? Is it even possible with IOS or am I missing something > here? It seems like the "which interface am I NATing" part occurs before the > "which interface do I need to send this packet through" part. > > Below are the "relevant" parts of this config first, then the whole config > (in case something else is mucking me up). There is also some VPN & VoIP > Appliance priority stuff. Any clues would be much appreciated! > > TIA, > Ray > > ---------------------------------------------------------------------- > > interface FastEthernet0/0 > description Internal LAN > ip address 192.168.8.254 255.255.255.0 > ip nat inside > ip policy route-map RerouteWebTraffic > > interface FastEthernet0/1 > description Upstream SDSL (123.123.123.104 /29) > ip address 123.123.123.108 255.255.255.248 > ip nbar protocol-discovery > ip nat outside > crypto map CustVPNs > service-policy output StarfacePolicy > > interface Dialer3 > description Upstream VDSL (dynamic ip) > ip nat outside > > ip route 0.0.0.0 0.0.0.0 123.123.123.105 > ip route 10.0.0.1 255.255.255.255 Dialer3 > > ip nat inside source route-map sdsl interface FastEthernet0/1 overload > ip nat inside source route-map vdsl interface Dialer3 overload > > access-list 110 remark ***** ACL route-map RerouteWebTraffic ***** > access-list 110 permit tcp any any eq www > access-list 110 permit tcp any any eq 443 > > route-map sdsl permit 10 > match ip address NAT_Exempt > ! > route-map sdsl permit 20 > match interface FastEthernet0/1 > ! > route-map vdsl permit 10 > match interface Dialer3 > ! > route-map RerouteWebTraffic permit 10 > match ip address 110 > set ip default next-hop 10.0.0.1 > > ---------------------------------------------------------------------- > > I also tried this instead of the next-hop route-map above, but no-workie: > > route-map RerouteWebTraffic permit 10 > match ip address 110 > set interface Dialer3 > > ===== Whole Config =================================================== > > ! > ! Last configuration change at 18:19:40 CEDT Fri Aug 20 2010 by ray > ! NVRAM config last updated at 18:05:03 CEDT Fri Aug 20 2010 by ray > ! > version 12.4 > service nagle > no service pad > service tcp-keepalives-in > service tcp-keepalives-out > service timestamps debug datetime msec localtime show-timezone > service timestamps log datetime msec localtime show-timezone > service password-encryption > ! > hostname cust-wi-r0 > ! > boot-start-marker > boot-end-marker > ! > logging buffered 51200 > logging console critical > enable secret 5 blablabla > ! > aaa new-model > ! > ! > aaa authentication login default local > aaa authentication login xauth_list local > aaa authentication ppp default local > aaa authorization exec default local > ! > ! > aaa session-id common > clock timezone CET 1 > clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 2:00 > dot11 syslog > no ip source-route > ip cef > ! > ! > no ip dhcp use vrf connected > ip dhcp excluded-address 192.168.8.0 192.168.8.9 > ip dhcp excluded-address 192.168.8.200 192.168.8.254 > ! > ip dhcp pool cust-wi-internal > network 192.168.8.0 255.255.255.0 > default-router 192.168.8.254 > dns-server 192.168.8.1 > ! > ip dhcp pool ORACLE > host 192.168.8.25 255.255.255.0 > hardware-address 0019.991b.fb4a > client-name ORACLE > ! > ip dhcp pool DSS > host 192.168.8.66 255.255.255.0 > hardware-address 0016.7674.6195 > client-name DSS > ! > ip dhcp pool LEXMARK > host 192.168.8.99 255.255.255.0 > hardware-address 00c0.026a.03bd > client-name LEXMARK > ! > ip dhcp pool NPI29E03B > host 192.168.8.22 255.255.255.0 > hardware-address 001f.2929.e03b > client-name NPI29E03B > ! > ip dhcp pool HP_LaserJet_Flur > host 192.168.8.16 255.255.255.0 > hardware-address 001f.2928.79da > client-name HP_LaserJet_Flur > ! > ! > ip inspect max-incomplete high 1100 > ip inspect max-incomplete low 900 > ip inspect one-minute high 1100 > ip inspect one-minute low 900 > ip inspect name Internal_FE00 tcp > ip inspect name Internal_FE00 udp > ip inspect name Internal_FE00 cuseeme > ip inspect name Internal_FE00 ftp > ip inspect name Internal_FE00 h323 > ip inspect name Internal_FE00 rcmd > ip inspect name Internal_FE00 realaudio > ip inspect name Internal_FE00 streamworks > ip inspect name Internal_FE00 vdolive > ip inspect name Internal_FE00 tftp > ip inspect name Internal_FE00 ntp > ip inspect name Internal_FE00 sip > ip inspect name Internal_FE00 sip-tls > ip inspect name External_FE01 smtp > ip inspect name External_FE01 tcp > ip inspect name External_FE01 udp > no ip bootp server > ip domain name blablabla.net > ip name-server 101.102.103.138 > ip name-server 103.102.101.153 > ! > multilink bundle-name authenticated > vpdn enable > ! > ! > ! > crypto pki trustpoint TP-self-signed-545859614 > enrollment selfsigned > subject-name cn=IOS-Self-Signed-Certificate-545859614 > revocation-check none > rsakeypair TP-self-signed-545859614 > ! > ! > crypto pki certificate chain TP-self-signed-545859614 > certificate self-signed 01 > 30820253 308201BC 6E65642D 43657274 (...junk...) > quit > ! > ! > username foo password 7 blablabla > archive > log config > hidekeys > ! > ! > crypto isakmp policy 10 > encr 3des > authentication pre-share > group 2 > crypto isakmp key blablabla address 1.2.3.4 no-xauth > crypto isakmp key blablabla address 5.6.7.8 no-xauth > ! > ! > crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac > ! > crypto map CustVPNs 10 ipsec-isakmp > description VPN RemoteOffice1 (1.2.3.4) > set peer 1.2.3.4 > set transform-set ESP-3DES-SHA > match address VPN_RemoteOffice1 > crypto map CustVPNs 20 ipsec-isakmp > description VPN RemoteOffice2 (5.6.7.8) > set peer 5.6.7.8 > set transform-set ESP-3DES-SHA > match address VPN_RemoteOffice2 > ! > ! > ! > ip tcp synwait-time 10 > ip ssh time-out 60 > ip ssh authentication-retries 2 > ! > class-map match-any StarfaceTraffic > match access-group name Starface > ! > ! > policy-map StarfacePolicy > class StarfaceTraffic > priority percent 70 > class class-default > fair-queue > ! > ! > ! > ! > interface FastEthernet0/0 > description Internal LAN > ip address 192.168.8.254 255.255.255.0 > no ip redirects > no ip proxy-arp > ip inspect Internal_FE00 in > ip nat inside > ip virtual-reassembly > ip policy route-map RerouteWebTraffic > no ip mroute-cache > duplex auto > speed auto > no cdp enable > ! > interface FastEthernet0/1 > description Upstream SDSL (123.123.123.104 /29) > bandwidth 5836 > ip address 123.123.123.108 255.255.255.248 > no ip redirects > no ip proxy-arp > ip nbar protocol-discovery > ip inspect External_FE01 in > ip nat outside > ip virtual-reassembly > no ip mroute-cache > duplex auto > speed auto > no cdp enable > crypto map CustVPNs > service-policy output StarfacePolicy > ! > interface FastEthernet0/3/0 > ! > interface FastEthernet0/3/1 > ! > interface FastEthernet0/3/2 > switchport access vlan 3 > ! > interface FastEthernet0/3/3 > switchport access vlan 2 > ! > interface Vlan1 > no ip address > ! > interface Vlan2 > no ip address > no ip proxy-arp > ip tcp adjust-mss 1452 > no ip mroute-cache > pppoe enable group global > pppoe-client dial-pool-number 2 > ! > interface Vlan3 > no ip address > no ip proxy-arp > ip tcp adjust-mss 1452 > no ip mroute-cache > pppoe enable group global > pppoe-client dial-pool-number 3 > ! > interface Dialer2 > description Pay no attention the man behind the curtain! (currently unused) > mtu 1456 > ip address negotiated > ip nat outside > ip virtual-reassembly > encapsulation ppp > ip tcp adjust-mss 1452 > dialer pool 2 > dialer idle-timeout 30 > dialer hold-queue 100 > dialer-group 2 > no keepalive > no cdp enable > ppp authentication pap callin > ppp chap refuse > ppp pap sent-username kakamole-static password 7 blablabla > ! > interface Dialer3 > description Upstream VDSL (dynamic ip) > mtu 1456 > ip address negotiated > ip nat outside > ip virtual-reassembly > encapsulation ppp > ip tcp adjust-mss 1452 > dialer pool 3 > dialer hold-queue 100 > dialer-group 3 > no keepalive > no cdp enable > ppp authentication pap callin > ppp chap refuse > ppp pap sent-username foobarmumble password 7 blablabla > ! > ip forward-protocol nd > ip route 0.0.0.0 0.0.0.0 123.123.123.105 > ip route 10.0.0.1 255.255.255.255 Dialer3 > ! > ip http server > ip http access-class 23 > ip http authentication local > ip http secure-server > ip http timeout-policy idle 60 life 86400 requests 10000 > ip nat inside source route-map sdsl interface FastEthernet0/1 overload > ip nat inside source route-map vdsl interface Dialer3 overload > ip nat inside source static tcp 192.168.8.1 443 123.123.123.108 443 extendable > ip nat inside source static tcp 192.168.8.1 1723 123.123.123.108 1723 > extendable > ip nat inside source static tcp 192.168.8.1 3389 123.123.123.108 3389 > extendable > ip nat inside source static udp 192.168.8.1 3389 123.123.123.108 3389 > extendable > ip nat inside source static tcp 192.168.8.200 5222 123.123.123.108 5222 > extendable > ! > ip access-list extended NAT_Exempt > deny ip 192.168.8.0 0.0.0.255 192.168.6.0 0.0.0.255 > deny ip 192.168.8.0 0.0.0.255 192.168.7.0 0.0.0.255 > permit ip 192.168.8.0 0.0.0.255 any > ip access-list extended Starface > permit ip any host 192.168.68.200 > permit ip host 192.168.68.200 any > ip access-list extended VPN_RemoteOffice2 > permit ip 192.168.8.0 0.0.0.255 192.168.6.0 0.0.0.255 > ip access-list extended VPN_RemoteOffice1 > permit ip 192.168.8.0 0.0.0.255 192.168.7.0 0.0.0.255 > ! > access-list 23 permit 192.168.8.0 0.0.0.255 > access-list 23 permit 212.96.136.32 0.0.0.31 > access-list 101 remark ***** ACL on Inbound Interface ***** > access-list 101 remark *** allow ssh/telnet to this router (but see acl 170) > access-list 101 permit tcp any host 123.123.123.108 eq 22 > access-list 101 permit tcp any host 123.123.123.108 eq telnet > access-list 101 remark *** allow icmp > access-list 101 permit icmp any any > access-list 101 remark *** allow to 192.168.68.1 > access-list 101 permit tcp any host 123.123.123.108 eq 143 > access-list 101 permit tcp any host 123.123.123.108 eq 1723 > access-list 101 permit gre any host 123.123.123.108 > access-list 101 remark *** allow to 192.168.68.200 > access-list 101 permit tcp any host 123.123.123.108 eq 5222 > access-list 101 deny ip any any > access-list 110 remark ***** ACL route-map RerouteWebTraffic ***** > access-list 110 permit tcp any any eq www > access-list 110 permit tcp any any eq 443 > access-list 170 remark ***** allowed telnet access > access-list 170 permit ip 192.168.6.0 0.0.0.255 any > access-list 170 deny ip any any log > dialer-list 2 protocol ip permit > dialer-list 3 protocol ip permit > no cdp run > ! > ! > route-map sdsl permit 10 > match ip address NAT_Exempt > ! > route-map sdsl permit 20 > match interface FastEthernet0/1 > ! > route-map vdsl permit 10 > match interface Dialer3 > ! > route-map RerouteWebTraffic permit 10 > match ip address 110 > set ip default next-hop 10.0.0.1 > ! > route-map nonat permit 10 > match ip address NAT_Exempt > ! > ! > ! > control-plane > ! > line con 0 > exec-timeout 0 0 > password 7 blablabla > transport output all > escape-character 27 > line aux 0 > exec-timeout 0 0 > password 7 blablabla > transport output all > escape-character 27 > line vty 0 4 > access-class 170 in > exec-timeout 60 0 > privilege level 15 > password 7 blablabla > transport input telnet ssh > transport output all > escape-character 27 > line vty 5 15 > access-class 170 in > privilege level 15 > password 7 blablabla > transport input telnet ssh > transport output all > escape-character 27 > ! > scheduler allocate 20000 1000 > end > ---------------------------------------------------------------------- > > > > _______________________________________________ > cisco-nsp mailing list cisco-...@puck.nether.net > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > _______________________________________________ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
