This is quite a complex setup. A site has a primary LAN 172.16.2.0/24 and a secondary LAN 10.183.1.0/24. This secondary LAN has a set of servers that need to be
routed to, but also has its own default gateway to a WAN with other servers that need accessing. Routes have been put on the servers in the secondary LAN so that the
primary LAN can talk to them. BUT... Routes CANNOT be put on the default gateway router to the WAN and the subsequent servers there.
In order to access these, a 3rd port on the router (881) has been set up to NAT to half of the secondary LAN. So the 10.183.1.0/24 LAN has been split in two, one
half routed on one port, the other half NAT on the other port. (for the purposes of this test in the lab, its actually 10.183.1.0/29 NAT and 10.183.1.248/29 routed).
This all works fine. But the next part is where I can't quite get it working. There is a GRE VPN setup through a hub router on the WAN. This is GRE with EIGRP, and
ultimately will be about 15 sites hub and spoke.
In the lab we have this site, and one other connected via the hub router, and LAN to LAN is routed correctly. The other site's LAN is 172.16.3.0/24 and has no other
connections or strangeness. But computers on this LAN need to be able to access the 2 secondary LANs at the other site in the same way, but across the GRE tunnel.
They also need to be able to access the servers on the other side of the secondary LAN's default gateway.
So, Site 1 can do everything it needs to do, route to 10.183.248.0/29 and NAT to 10.183.1.0/29 and also across the WAN we have no control over to 10.50.0.0/16.
I'm struggling to get Site 2 to access both 10.183 ranges in the same way, and then subsequently the 10.50 range.
I have had Site 2 route to 10.183.1.248/29 with EIGRP but that seemed to stop me routing to the LAN address of the router for the NAT subnet.
So current setup has neither working from Site 2, but Site 2 can ping 10.183.1.1 which is the LAN side IP of the router on the range it needs to NAT to.
I have included configs for Site 1 and Site 2. I can draw a diagram on request if this would help.
Thanks for any help you might be able to give!
SITE 1
!
!
!
interface Tunnel3
ip address 10.3.1.2 255.255.255.252
tunnel source 10.78.254.38
tunnel destination 10.10.10.2
!
interface FastEthernet0
switchport access vlan 2
no ip address
!
interface FastEthernet1
switchport access vlan 3
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
switchport access vlan 4
no ip address
!
interface FastEthernet4
description $ETH-WAN$
ip address 10.78.254.38 255.255.255.252
ip virtual-reassembly in
duplex auto
speed auto
!
interface Vlan1
no ip address
!
interface Vlan2
ip address 172.16.2.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Vlan3
ip address 10.183.1.254 255.255.255.248
ip virtual-reassembly in
!
interface Vlan4
ip address 10.183.1.1 255.255.255.248
ip nat outside
ip virtual-reassembly in
!
interface Vlan5
no ip address
!
!
router eigrp 10
network 10.3.1.0 0.0.0.255
network 10.183.1.0 0.0.0.7
network 172.16.2.0 0.0.0.255
!
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
ip nat inside source list 1 interface Vlan4 overload
ip route 0.0.0.0 0.0.0.0 10.78.254.37
ip route 10.50.0.0 255.255.0.0 10.183.1.5
!
access-list 1 permit 172.16.2.0 0.0.0.255
access-list 1 permit 172.16.3.0 0.0.0.255
access-list 23 permit 10.10.10.0 0.0.0.7
no cdp run
!
SITE 2
!
!
interface Tunnel4
ip address 10.4.1.2 255.255.255.252
ip nat outside
ip virtual-reassembly in
tunnel source 10.78.254.2
tunnel destination 10.10.10.2
!
interface FastEthernet0
switchport access vlan 2
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface FastEthernet4
description $ETH-WAN$
ip address 10.78.254.2 255.255.255.252
duplex auto
speed auto
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
no ip address
ip tcp adjust-mss 1452
!
interface Vlan2
ip address 172.16.3.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
!
router eigrp 10
network 10.4.1.0 0.0.0.3
network 172.16.3.0 0.0.0.255
!
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
!
!
interface Tunnel4
ip address 10.4.1.2 255.255.255.252
tunnel source 10.78.254.2
tunnel destination 10.10.10.2
!
interface FastEthernet0
switchport access vlan 2
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface FastEthernet4
description $ETH-WAN$
ip address 10.78.254.2 255.255.255.252
duplex auto
speed auto
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
no ip address
ip tcp adjust-mss 1452
!
interface Vlan2
ip address 172.16.3.254 255.255.255.0
!
!
router eigrp 10
network 10.4.1.0 0.0.0.3
network 172.16.3.0 0.0.0.255
!
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
ip route 0.0.0.0 0.0.0.0 10.78.254.1
!
access-list 1 permit 172.16.4.0 0.0.0.255
access-list 1 permit 172.16.3.0 0.0.0.255
access-list 23 permit 10.10.10.0 0.0.0.7
no cdp run
!
