interface FastEthernet0
 description *** Outside Interface ***
 ip address x.x.9.10 255.255.255.248
 ip nat outside
 ip virtual-reassembly
 crypto map normal
!
interface Vlan1
 description *** Inside Interface ***
 ip address 172.29.0.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
ip route 0.0.0.0 0.0.0.0 x.x.9.9
!
ip nat inside source list 120 interface FastEthernet0 overload
!
access-list 120 remark *** NAT ***
access-list 120 deny   ip any 172.29.1.0 0.0.0.15
access-list 120 deny   ip any 172.29.2.0 0.0.0.15
access-list 120 deny   ip any 172.29.3.0 0.0.0.15
access-list 120 permit ip 172.29.0.0 0.0.0.255 any

Ping fra Vlan1 (innside) til Internett viser at ..

XXXX-B31092#ping 217.13.4.24 source vlan1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 217.13.4.24, timeout is 2 seconds:
Packet sent with a source address of 172.29.0.1 
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/13/16 ms
xxxx-B31092#


Extended IP access list 120
    10 deny ip any 172.29.1.0 0.0.0.15 (56 matches)
    20 deny ip any 172.29.2.0 0.0.0.15
    30 deny ip any 172.29.3.0 0.0.0.15
    40 permit ip 172.29.0.0 0.0.0.255 any (4 matches)

.. men ingen klienter i 172.29.0.0/24 kommer ut på nett ..