NAT overload is not working when i configure Double NAT for VPN

I have Cisco 2921 router with OS version 15.1(4)M1.
the router is configured for NAT overload and working fine, i have site to site VPN tunnel with peer with normal NAT translation. now we need to configure Double NAT on the VPN tunnel as we need to free the subnet on peer network. for double nat i use 3.2.21.x - 3.2.23.x / 24 network and apply following command
Double NAT translation
ip nat inside source static network 192.168.10.0 3.2.21.0 /24 no-alias
ip nat inside source static network 192.168.20.0 3.2.22.0/24 no-alias
ip nat inside source static network 192.168.30.0 3.2.23.0 /24 no-alias
Nonat
access-list 101 deny   ip 3.2.21.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny   ip 3.2.22.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny   ip 3.2.23.0 0.0.0.255 3.2.1.0 0.0.0.255
VPN encrypted traffic over the tunnel
access-list 115 permit ip 3.2.21.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 115 permit ip 3.2.22.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 115 permit ip 3.2.23.0 0.0.0.255 3.2.1.0 0.0.0.255
Problem:
as soon as i apply Double NAT translation command the  NAT overload stop working and client cannot reach to the internet
the router partial configuration is as below
REACH-R01(config)#do sh run
Building configuration...
Current configuration : 19233 bytes
! Last configuration change at 09:56:45 MST Tue Jan 29 2013 by admin
! NVRAM config last updated at 13:57:54 MST Wed Jan 30 2013
! NVRAM config last updated at 13:57:54 MST Wed Jan 30 2013
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname REACH-R01
boot-start-marker
boot-end-marker
card type t1 0 0
logging buffered 51200 warnings
no aaa new-model
clock timezone MST -7 0
clock summer-time MST recurring
network-clock-participate wic 0
network-clock-select 1 T1 0/0/0
no ipv6 cef
ip source-route
ip cef
ip dhcp excluded-address 192.168.20.1 192.168.20.99
ip dhcp excluded-address 192.168.20.250 192.168.20.255
ip dhcp pool CISCO_PHONES
network 192.168.20.0 255.255.255.0
default-router 192.168.20.254
option 150 ip 192.168.20.254
no ip domain lookup
ip domain name reach.local
ip inspect name ethernetin ftp timeout 3600
ip inspect name ethernetin h323 timeout 3600
ip inspect name ethernetin http timeout 3600
ip inspect name ethernetin rcmd timeout 3600
ip inspect name ethernetin realaudio timeout 3600
ip inspect name ethernetin smtp timeout 3600
ip inspect name ethernetin sqlnet timeout 3600
ip inspect name ethernetin streamworks timeout 3600
ip inspect name ethernetin tcp timeout 3600
ip inspect name ethernetin tftp timeout 30
ip inspect name ethernetin udp timeout 15
ip inspect name ethernetin vdolive timeout 3600
multilink bundle-name authenticated
isdn switch-type primary-ni
trunk group PRI
crypto pki token default removal timeout 0
crypto pki trustpoint TP-self-signed-3180627716
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3180627716
revocation-check none
rsakeypair TP-self-signed-3180627716
voice-card 0
dsp services dspfarm
voice service voip
allow-connections sip to sip
fax protocol t38 version 0 ls-redundancy 0 hs-redundancy 0 fallback none
sip
voice translation-rule 1
rule 5 /^7804981231/ /401/
voice translation-rule 2
rule 5 // /7804981231/
voice translation-profile DID_INBOUND
translate called 1
voice translation-profile DID_OUTBOUND
translate calling 2
license udi pid CISCO2911/K9 sn FGL1540114P
license accept end user agreement
license boot module c2900 technology-package securityk9
hw-module ism 0
hw-module pvdm 0/0
username test test
redundancy
controller T1 0/0/0
cablelength long 0db
pri-group timeslots 1-6,24
no ip ftp passive
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
crypto isakmp key P@ssw0rd address 33.33.33.33 no-xauth
crypto ipsec transform-set ESP-AES256-SHA esp-aes 256 esp-sha-hmac
crypto map VPN-TUNNEL 1 ipsec-isakmp
description COMPUGEN
set peer 33.33.33.33
set transform-set ESP-AES256-SHA
match address 115
interface Embedded-Service-Engine0/0
no ip address
shutdown
interface GigabitEthernet0/0
description Outside Interface To the Internet
ip address dhcp
ip access-group outside_access_in in
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
crypto map VPN-TUNNEL
interface ISM0/0
ip unnumbered GigabitEthernet0/1.20
service-module ip address 192.168.20.2 255.255.255.0
!Application: CUE Running on ISM
service-module ip default-gateway 192.168.20.254
interface GigabitEthernet0/1
no ip address
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
interface GigabitEthernet0/1.10
description VLAN 10 DATA VLAN
encapsulation dot1Q 10
ip address 192.168.10.254 255.255.255.0
ip nat inside
ip inspect ethernetin in
ip virtual-reassembly in
interface GigabitEthernet0/1.20
description VLAN 20 VOICE VLAN
encapsulation dot1Q 20
ip address 192.168.20.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
interface GigabitEthernet0/1.30
description VLAN 30 WIRELESS VLAN
encapsulation dot1Q 30
ip address 192.168.30.254 255.255.255.0
ip nat inside
ip inspect ethernetin in
ip virtual-reassembly in
interface GigabitEthernet0/2
no ip address
shutdown
duplex auto
speed auto
interface ISM0/1
description Internal switch interface connected to Internal Service Module
no ip address
interface Serial0/0/0:23
no ip address
encapsulation hdlc
isdn switch-type primary-ni
isdn incoming-voice voice
trunk-group PRI
no cdp enable
interface Vlan1
no ip address
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip http path flash:CME8.6/GUI
ip nat inside source static tcp 192.168.10.10 443 interface GigabitEthernet0/0 443
ip nat inside source static tcp 192.168.10.10 25 interface GigabitEthernet0/0 25
ip nat inside source static tcp 192.168.10.10 1723 interface GigabitEthernet0/0 1723
ip nat inside source static tcp 192.168.10.10 3389 interface GigabitEthernet0/0 3389
ip nat inside source static tcp 192.168.10.10 123 interface GigabitEthernet0/0 123
ip nat inside source static tcp 192.168.10.10 987 interface GigabitEthernet0/0 987
ip nat inside source list 101 interface GigabitEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 75.152.248.1
ip route 0.0.0.0 0.0.0.0 75.152.248.1 254
ip route 0.0.0.0 0.0.0.0 205.206.0.1 254
ip route 192.168.20.2 255.255.255.255 ISM0/0
ip access-list extended outside_access_in
permit udp any any eq bootps
permit udp any any eq bootpc
permit tcp any host 22.22.22.22 eq 1723
permit tcp any host 22.22.22.22 eq 3389
permit tcp any host 22.22.22.22 eq smtp
permit tcp any host 22.22.22.22 eq 443
permit tcp any host 22.22.22.22 eq domain
permit udp any host 22.22.22.22 eq domain
permit tcp any host 22.22.22.22 eq 123
permit icmp any host 22.22.22.22 unreachable
permit icmp any host 22.22.22.22 echo-reply
permit icmp any host 22.22.22.22 packet-too-big
permit icmp any host 22.22.22.22 time-exceeded
permit icmp any host 22.22.22.22 traceroute
permit icmp any host 22.22.22.22 administratively-prohibited
permit icmp any host 22.22.22.22 echo
permit tcp any host 22.22.22.22 eq 987
permit tcp any host 22.22.22.22 eq 47
permit gre any host 22.22.22.22
permit udp any host 22.22.22.22 eq isakmp
permit esp any host 22.22.22.22
access-list 23 permit any
access-list 101 deny   ip 192.168.20.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny   ip 192.168.30.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny   ip 192.168.10.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny   ip 3.2.21.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny   ip 3.2.22.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny   ip 3.2.23.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 permit ip 192.168.10.0 0.0.0.255 any
access-list 101 permit ip 192.168.20.0 0.0.0.255 any
access-list 101 permit ip 192.168.30.0 0.0.0.255 any
access-list 110 permit ip 0.0.0.0 255.255.255.0 0.0.0.0 255.255.255.0
access-list 115 permit ip 3.2.21.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 115 permit ip 3.2.22.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 115 permit ip 3.2.23.0 0.0.0.255 3.2.1.0 0.0.0.255
Solution: Support forums team

I have the same problem also.  Restarting isn't helping and the auto lock/unlock button is on.  Plus a couple of time when I turn it on it is asking if I want to power off.  That is when I push the button on the front to wake it up.  Not the power button on top.  I have an IPAd 2. Worked fine before the update. 

Similar Messages

  • Keyboard backlighting not working when using Windows in Boot Camp

    Hi, I'm posting this for a friend with a new Macbook Air. He says that his keyboard backlighting does not work when he is using it for Windows (don't know which, but probably Vista). Any ideas why? Thanks. Gary

    Install all the drivers needed when running boot camp - try for example inserting a DVD - then press the eject key - See if it comes out - If it doesn't install all the drivers - try Control Panel - If not try re-installing your version of Windows.

  • HP ProBook 440 G2, Finger print reader not working when I upgraded form Win 7 Pro to Win 8.1 Pro

    My HP ProBook 440 G2, Finger print reader not working when I upgraded form Win 7 Pro to Win 8.1 Pro.
    In device manager showing that biometric reader is working properly. But actually the finger printer reader is not reading or senseing. It seems like "dummy" part. Please help me to correctly configure step by step for this issue.
    thankyou
    Hillet
    This question was solved.
    View Solution.

    Have you installed the Validity Sensor Fingerprint driver software for Windows 8.1?
    http://h20564.www2.hp.com/hpsc/swd/public/detail?sp4ts.oid=6943811&swItemId=ob_134806_1&swEnvOid=415...
    See page 64 in the following Windows 8.1 user manual for Validity Fingerprint setup information
    http://h20565.www2.hp.com/hpsc/doc/public/display?sp4ts.oid=6943810&docId=emr_na-c04371762&docLocale...
    ****Please click on Accept As Solution if a suggestion solves your problem. It helps others facing the same problem to find a solution easily****
    2015 Microsoft MVP - Windows Experience Consumer

  • Dynamic Configuration not working with Integrated Configuration

    Hi All,
    Dynamic Configuration works fine in PI 7.3 when Classical Configuration is used. However the same does not work using Integrated Configuration.
    Scenario :
    SOAP -->SOAP Synchronous scenario in PI 7.3 (Dual Stack).
    Trying to save a value from Request mapping using dynamic configuration and use the same in response mapping.
    UDF Code :
    Request Mapping :
    DynamicConfiguration conf = (DynamicConfiguration) container.getTransformationParameters().get(StreamTransformationConstants.DYNAMIC_CONFIGURATION);
    DynamicConfigurationKey Variable = DynamicConfigurationKey.create("http://sap.com/xi/XI/System/SOAP", "Variable1");
    conf.put(Variable, a);
    Response Mapping :
    DynamicConfigurationKey Variable = DynamicConfigurationKey.create("http://sap.com/xi/XI/System/SOAP", "Variable1" );
    string1 = conf.get(Variant);
    Note : Using Integrated Config(AAE Processing) - Response header does not have DynamicConfiguration header node , but Classical Configuration has that.
    Regards,
    Parimala
    Edited by: ParimalaE on Mar 1, 2012 1:33 PM

    For us this is what we had:
    This didn't work (getInputParameters is the newer stuff that doesn't work):
    DynamicConfiguration dc = (DynamicConfiguration)container.getInputParameters().getValue(StreamTransformationConstants.DYNAMIC_CONFIGURATION);
    DynamicConfigurationKey dck = DynamicConfigurationKey.create("http://sap.com/xi/XI/System/SOAP","TServerLocation");
    dc.put(dck,"https://xyz.api-salesforce.com/services/Soap/c/26.0/0DFa00000008jis");
    return "";
    This works for us(we had to remove getInputParameters):
    DynamicConfiguration dc =  (DynamicConfiguration) container.getTransformationParameters().get(StreamTransformationConstants.DYNAMIC_CONFIGURATION);
    DynamicConfigurationKey dck = DynamicConfigurationKey.create("http://sap.com/xi/XI/System/SOAP","TServerLocation");
    dc.put(dck,"https://xyz.api-salesforce.com/services/Soap/c/26.0/00D3000000001X0");
    return "";

  • I have Cisco TelePresence SX10 and content sharing is not working when I am dialing through the bridge

    I have Cisco TelePresence SX10 and content sharing is not working when I am dialing through the bridge, I can share the content if I drag and drop from RMX, but if schedule the call in Resource manager or manually dial in from device the content is not going to other hand, I have tried to turn off encryption as well but still same issue. can you please help me out with this. I am from Lion co and purchased sx 10 recently.
    regards
    Hemang

    Can you please provide us with a little more information on your systems and configuration / topology, such as, what call control are you using (Cisco VCS, CUCM, other?). what type of "Bridge" are you using (is this a Cisco MCU, or Cisco TelePresence Server, or other device?), what versions of the software are on each of the devices, etc.  The more information we have about your environment will help us assist you better.  But saying that, if all your core equipment isn't Cisco, you may have more luck in the forums for the manufacturer of such equipment (ie Polycom's Support Community).
    Wayne
    Please remember to rate responses and to mark your question as answered if appropriate.

  • Why does the mail not work when i updated my 5s to iOs 8?

    why does the mail not work when i updated my 5s to iOs 8?

    Thank you for the reply. But can you tell me what this configuration is about and how I should do this?

  • I bought my iphone 5s a week before and now its volume "up" button is not working when pressed.Does anybody know what to do to make it work?I have a one year warranty.Should i give it to apple retail shop or is there any way to solve this problem?

    I bought my iphone 5s a week before and now its volume "up" button is not working when pressed.Does anybody know what to do to make it work?I have a one year warranty.Should i give it to apple retail shop or is there any way to solve this problem?

    IF it is a manufacturing defect and you bought the device from Apple or an authorized Apple retailer, then take it into Apple.

  • Just upgraded to Lion an am discovering that I cannot send email photos from within iPhoto. Error message says bad Internet connection or server not working, when that's not the case. Never happened in Snow Leopard! Help!!!

    Just upgraded to Lion an am discovering that I cannot send email photos from within iPhoto. Error message says bad Internet connection or server not working, when that's not the case. Never happened in Snow Leopard! Help!!!

    what email service - Yahoo mail have been acting up lately
    you can try setting Mail as your email client - it resolves this pfoblem for some people
    LN

  • Partner function not working when creating PO with ref to PReq

    Partner function is not working when creating a Purchase Order with ref to a Purchase Requistion, Partner functions maintained in the vendor master are VN, OA & PI.
    But OA & PI are not appearing in the PO header partner tab when created with ref to PR.
    however it works when i create the PO directly ( without the PR ref )
    I am using the same material & Plant for both manual PO & PR to PO.
    Any idea what could be wrong .
    I have maintained the settings for schema groups for vendor master & purchasing doc in the partner determination.
    Thanks
    Dkmurthy

    Hi,
    I have also an issue that seems similar to one you are discussing.
    When we use ME59N and create a PO with ref. from a PR (created from a sales order), the message determination works well, it reads the condition set in MN04 (condition records for messages), and creates a message (with output type for EDI , medium: 6, and partner function LS: Logical system). Message is created and idoc is sent.
    When we try with ME21N, ME21 and we create the PO with ref. to the same PR, either by entering manually the PR in the document overview of ME21N or by selecting the PR (without entering the PR number), i.e with date, the message is not created in the PO.
    Company code is assigned to purchase organization, and so is purchase organization to plant.
    Any idea why there is no automatic message determination in the case of the transaction: ME21N
    Note: If I try ME21N, and enter the output type and partner, manually, I receive a warning message
    VN006 (Partner XXXX does not exist for partner function LS). If I accept this warning message, then message is saved- idoc is sent. However I can not overcome the warning message, if it plays any role, because I can not assign partner function LS to the vendor.Then I receive message CZ 327 (Can not use this partner role).
    Any input is wellcome.

  • The built-in dictionary on my iPad only works with certain sites.  What do I need to do so that I can it all the time. (For example, it does not work when I read e-newspaper.)

    What do I need to do so that I can use the built-in dictionary all the time? My iPad 2's dictionary functions on Japanese e-newspapers but not on the Arizona Republic or other e-newspapers.

    Rikirannu wrote:
    My iPad 2's dictionary functions on Japanese e-newspapers but not on the Arizona Republic or other e-newspapers.
    Are you talking about the English dictionary?  Mine seems to work ok on the AZ republic web page.  Does yours not work on all webpages?  Does it not work when you type an English word in Notes and then do select and define?

  • I have i phone 4s i there is problem of wifi my wifi is not working when i go to the wifi there is no working on off when i update it as a 6.1 ios on that time again it was good but after 2 days again the same problem i am too tired

    I have i phone 4s i there is problem of wifi my wifi is not working when i go to the wifi there is no working on off when i update it as a 6.1 ios on that time again it was good but after 2 days again the same problem i am too tired and i also reset network setting but nothing gonna be worked

    Sounds like the device was dropped at some point and damaged as a result.
    Take it to Apple for evaluation and a replacement.

  • I tunes is not working. when i go to update apps nothing happens go to itunes page is blank

    itunes not working. when i go to update apps nothing happens. if i go to itunes store page is blank and does not go to the store

    http://support.apple.com/kb/ts1567

  • HT5622 my apple id is not working when i sign in from my laptop it works but when i sign in from my iphone4 then its not working it gives the message of "your aapleid or password is incorrect"? how can i solve this problem please help

    my apple id is not working when i sign in from my laptop it works but when i sign in from my iphone4 then its not working it gives the message of "your aapleid or password is incorrect"? how can i solve this problem please help

    Hey nocillado,
    Thanks for using Apple Support Communities.
    It sounds like you have 2 things you want to address. These articles can help you use iCloud with your existing Apple ID.
    Get help activating your iPhone
    http://support.apple.com/kb/ts3424
    Using your Apple ID for Apple services
    http://support.apple.com/kb/ht4895
    Using the same Apple ID for Store purchases and iCloud (recommended)
    Have a nice day,
    Mario

  • The touch screen is not working when I am in the Music app of my iPod Touch.  How do I get it to begin working?  It just stopped today.

    The touch screen is not working when I am in the Music app of my iPod Touch.  How do I get it to begin working?  It just stopped today.
    Does anyone know what I can do?  I am unable to switch screens, and I can not see the track that is playing.  The only was I can switch between songs is to use the controls on my headphones.

    Try the stamdard fixes to rule out a software problem:
    - Reset. Nothing will be lost
    Reset iPod touch:  Hold down the On/Off button and the Home button at the same time for at
    least ten seconds, until the Apple logo appears.
    - Restore from backup
    - Restore to factory defaults/new iPod.

  • My volume is not working when on the ringer what do I do

    My iPhone volume is not working when I have the volume set on. It will work with the headphones but other then that nothing. What's going on with it?

    supposedly from what I have read it is a software issue. I actually am also having this problem it worked after I performed a full reset,  but now it has started again tomorrow I am going to the apple store to find out what I can do as I bought my 4s right before the 5 was released.

Maybe you are looking for

  • BAPI call via UDF in mapping - error handling/stopping processing

    Hi, We are calling a BAPI in an ECC system from a UDF in message mapping.  The BAPI then calls other BAPIs to perform translations and validations on the message data.  An error could occur during a translation (for example), and an error flag would

  • Backup External Drive.

    Want a relatively inexpensive enclosure to put a spare SATA drive in to serve as backup plus misc. Would probably partition it. I know that I could put it in the Mac Pro to that end but would prefer to have independence of Power Supply and motherboar

  • How to View Donloaded video on T.V. with  video iPOD

    I would like to view my donloaded video on my tv from my ipod, I have the apple ac cable but all i get is sound when playing the video, how can i get picture? dell   Windows XP  

  • Unsorted bookmarks not visable

    after Wednesday upgrade i can no longer access unsorted bookmarks form library or side bar. the book marks still exist i have several folders in unsorted book marks i f i go to page it will still have the bookmark star and give the location i can cha

  • Formatter for Flex/AS Code ?

    Hi AM trying to set up the FlexFormatter to my Flex/AS code, i happen to download the jar files from sourceforge (http://sourceforge.net/projects/flexformatter/) and placed the jar fiiles  at C:\Program Files\Adobe\Flex Builder 3 Plug-in\eclipse\plug