IEOC - Internetwork Expert's Online Community

Hi all,

I have  a wording question to this task:

As I understand, all traffic from R8 to the internet should be nated. This does not include the traffic to R8 and behind.  So the accesslist on R6 should change to:

ip access-list extended R8
 permit ip 10.1.8.0 0.0.0.255 222.22.2.0 0.0.0.255
 permit ip 10.1.8.0 0.0.0.255 222.20.3.0 0.0.0.255
 permit ip 10.1.8.0 0.0.0.255 192.10.1.0 0.0.0.255
 permit ip 10.1.8.0 0.0.0.255 205.90.31.0 0.0.0.255
 permit ip 10.1.8.0 0.0.0.255 10.1.17.0 0.0.0.255
 permit ip 10.1.68.0 0.0.0.255 222.22.2.0 0.0.0.255
 permit ip 10.1.68.0 0.0.0.255 222.20.3.0 0.0.0.255
 permit ip 10.1.68.0 0.0.0.255 192.10.1.0 0.0.0.255
 permit ip 10.1.68.0 0.0.0.255 205.90.31.0 0.0.0.255
 permit ip 10.1.68.0 0.0.0.255 10.1.17.0 0.0.0.255
!
route-map R8_NAT deny 10
 match ip address R8
!
route-map R8_NAT permit 100
!
! (I preffer to do Nat with route-maps)
ip nat inside source route-map R8_NAT pool R8_PUBLIC vrf VPN_A overload
!

If you not exclude the addresses from R7 you couln'd reach those addresses from R8 anymore cause the adresses from R8 to R7 would be nated and R7 does not know a route back to the public 34.X.100.0/24 net - as requierd by the lst point of this task.

Or did I understand something wrong?

Än Gruess
Ueli

I agree with your point. But you miss one acess-list for 10.X.7.0/24 which advertis into VPN_A in task 5.2.

I agree, although I really do hate questions like this. You spend more time searching for all the various configured IP addresses than you do demonstrating an understanding of the technology. I'm really hoping Cisco don't put questions like this into the real lab.