Assumption:

* Single router with multiple WAN interfaces. In this case, one WAN is Cable Internet (DHCP Client) and another WAN is ADSL PPPoE
* There are dual equal-cost gateway routes; one goes to Cable Internet and another goes to ADSL
* Public servers are using Cable Internet Public IP addresses; therefore inbound traffic from the Internet to servers and outbound traffic from servers to the Internet must always use Cable Internet
* To go out to the Internet with specific destination TCP/UDP port number, outbound traffic from Inside to the Internet must take Cable Internet
* Any other outbound traffic take the ADSL
* DMZ traffic to Inside is restricted where Inside traffic to DMZ in unrestricted

Sample Configuration

version 12.3
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
no ip source-route
ip cef
!
interface FastEthernet0
 description Inside
 ip address 192.168.10.1 255.255.255.0
 ip access-group 100 in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
 ip route-cache flow
 no cdp enable
 ip policy route-map Inside-route
!
interface FastEthernet1
 description DMZ
 ip address 192.168.20.1 255.255.255.0
 ip access-group 103 in
 ip helper-address 192.168.10.254
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
 ip route-cache flow
 no cdp enable
 ip policy route-map DMZ-route
!
interface FastEthernet2
 description WAN to ADSL modem
 no ip address
 pppoe-client dial-pool-number 1
 no cdp enable
!
interface FastEthernet3
 switchport mode trunk
 duplex full
 speed 100
!
interface FastEthernet4
 description Cable Internet - DHCP Client
 ip address dhcp client-id FastEthernet4
 ip access-group 101 in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
 ip route-cache flow
 duplex auto
 speed auto
 no cdp enable
!
interface Dialer1
 description ADSL Internet - PPPoE Client
 ip address negotiated
 no ip proxy-arp
 ip mtu 1492
 ip pim sparse-dense-mode
 ip nat outside
 ip inspect SERVICE out
 ip virtual-reassembly
 encapsulation ppp
 ip route-cache flow
 ip tcp adjust-mss 1452
 dialer pool 1
 dialer-group 2
 no cdp enable
 ppp authentication chap pap callin
 ppp chap hostname *******
 ppp chap password 7 ******
 ppp pap sent-username ****** password 7 ******
 ppp ipcp dns request
 ppp ipcp route default
 ppp ipcp address accept
!
no ip http server
no ip http secure-server
ip nat inside source list 151 interface FastEthernet4 overload
ip nat inside source list nat-ADSL interface Dialer1 overload
ip nat inside source static udp 192.168.10.140 3074 interface FastEthernet4 3074
ip nat inside source static tcp 192.168.10.140 3074 interface FastEthernet4 3074
ip nat inside source static tcp 192.168.10.141 9999 interface FastEthernet4 9999
ip nat inside source static udp 192.168.10.254 47624 interface FastEthernet4 47624
ip nat inside source static tcp 192.168.10.254 80 interface FastEthernet4 80
ip nat inside source static tcp 192.168.10.254 22 interface FastEthernet4 22
!
access-list 1 remark VTY Access-class list
access-list 1 permit 192.168.10.0 0.255.255.255
access-list 100 remark ACL Inside
access-list 100 deny   udp any any eq 3544
access-list 100 deny   udp any eq 3544 any
access-list 100 deny   ip host 255.255.255.255 any
access-list 100 deny   ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
!
access-list 101 remark ACL Outside Cable
access-list 101 deny   ip 10.0.0.0 0.0.0.255 any
access-list 101 deny   ip 172.16.0.0 0.0.15.255 any
access-list 101 deny   ip 192.168.0.0 0.0.255.255 any
access-list 101 deny   ip 127.0.0.0 0.255.255.255 any
access-list 101 deny   ip host 255.255.255.255 any
access-list 101 permit udp host 192.43.244.18 eq ntp any eq ntp
access-list 101 permit tcp any any eq www
access-list 101 permit tcp any any eq 9999
access-list 101 permit udp any eq bootps any eq bootpc
access-list 101 permit icmp any any echo-reply
access-list 101 permit icmp any any time-exceeded
access-list 101 permit icmp any any unreachable
access-list 101 permit udp any any eq 47624
access-list 101 permit tcp any any eq 47624
access-list 101 permit udp any any eq 3074
access-list 101 permit tcp any any eq 3074
access-list 101 permit udp any eq domain any
access-list 101 permit tcp any any established
!
access-list 102 remark ACL Outside ADSL
access-list 102 deny   ip 10.0.0.0 0.0.0.255 any
access-list 102 deny   ip 172.16.0.0 0.0.15.255 any
access-list 102 deny   ip 192.168.0.0 0.0.255.255 any
access-list 102 deny   ip 127.0.0.0 0.255.255.255 any
access-list 102 deny   ip host 255.255.255.255 any
access-list 102 permit icmp any any echo-reply
access-list 102 permit icmp any any time-exceeded
access-list 102 permit icmp any any unreachable
access-list 102 permit udp any eq domain any
access-list 102 permit tcp any any established
!
access-list 103 remark ACL DMZ
access-list 103 permit udp any eq bootps any eq bootpc
access-list 103 permit udp any eq bootpc any eq bootps
access-list 103 permit ip 192.168.20.0 0.0.0.255 host 192.168.10.254
access-list 103 deny   ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 103 permit ip any any
!
access-list 151 deny ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255
access-list 151 permit udp host 192.168.10.140 eq 3074 any
access-list 151 permit tcp host 192.168.10.140 eq 3074 any
access-list 151 permit tcp host 192.168.10.141 eq 9999 any
access-list 151 permit tcp host 192.168.10.254 eq 22 any
access-list 151 permit tcp host 192.168.10.254 eq 80 any
access-list 151 permit udp host 192.168.10.254 eq 47624 any
access-list 151 permit tcp 192.168.10.0 0.0.0.255 any eq 6667
access-list 152 permit ip 192.168.10.0 0.0.0.255 any
access-list 153 deny ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 153 permit ip 192.168.20.0 0.0.0.255 any
!
dialer-list 2 protocol ip permit
!
!
route-map Inside-route permit 10
match ip address 151
set interface Dialer1
!
route-map Inside-route permit 20
match ip address 152
set interface FastEthernet4
!
route-map Inside-route permit 30
!
!
route-map DMZ-route permit 10
match ip address 153
set interface Dialer1
!
route-map DMZ-route permit 20
!
route-map nat-ADSL permit 10
match ip address 152
set interface Dialer1
!
route-map nat-ADSL permit 20
match ip address 153
set interface Dialer1
!
route-map nat-ADSL permit 30
!
control-plane
!
banner login 
                   Unauthorized Use Is Prohibited
       All access to this device and network are logged. If
          you do not own this device or have access you
                   must disconnect immediately

!
line con 0
line aux 0
line vty 0 4
 access-class 1 in
 transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
ntp clock-period 17175114
ntp server 192.168.10.254 prefer
!
end
 

Some Discussions

»[HELP] Cisco Router Config (2811) with two ISPs

got feedback? got feedback?

Any feedback you provide is sent to the owner of this FAQ for possible incorporation and shown publically as well.

by aryoba
last modified: 2011-11-17 13:06:49