Cisco – Can a Cisco SG300 Layer 3 Switch act as a NAT router

Can you show output of 'sh ip nat stat' and 'sh ip nat tran'?

I think the config looks correct, did you try applying an ACL on the outside interface to specifically allow the traffic?

interface GigabitEthernet0/0
 ip access-group OUTBOUND out
!
ip access-list extended OUTBOUND
 permit ip any any

here's a working example from a 1800 series:

interface FastEthernet0
 description $FW_OUTSIDE$
 bandwidth 34000
 ip address 1.2.3.141 255.255.255.240
 ip access-group OUTBOUND out
 ip verify unicast reverse-path
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
 load-interval 60
 duplex auto
 speed auto
!
interface FastEthernet1
 description $FW_INSIDE$
 bandwidth 34000
 ip address 192.168.0.254 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
 load-interval 60
 duplex auto
 speed auto
!
ip nat pool GLOBAL_IP_POOL 1.2.3.139 1.2.3.141 prefix-length 24
ip nat inside source route-map natmap pool GLOBAL_IP_POOL overload
!
ip access-list extended natrules
 deny   ip 192.168.0.0 0.0.0.255 10.180.3.0 0.0.0.255
 permit ip 192.168.0.0 0.0.255.255 any
!
route-map natmap permit 10
 match ip address natrules

Hope this helps.

Edited:

I cannot spot anything weird with your config. Since you seem not to have any hits in translation tables at all, there must be a problem either on the connectivity or configuration on the client, or simply an access-list that denies the traffic.

Can you:

1) ping from the router, make sure you do it from the correct interface by entering:

ping 8.8.8.8 source 10.1.1.1

2) show access-lists

show access-lists

I set up three routers in a lab and configured rip + nat, and it works just as it is. The router in question and the remote router that specifically denies the internal network of 'the router in question'.

It sounds like you have multiple routers and multiple networks. If the two machines aren't on the same network, it won't work. Since each machine sees the other machine's IP address as inside its local network IP range, it assumes it's on the same network. If it's not, it won't work.

If you have two networks both numbered 192.168.0.0/24, a machine one one network won't be able to reach a machine on the other network. Your ping is reaching a different machine on the same network with the same IP address as the machine you were trying to to reach.

When the wireless system happens to connect to the same network, then it all works.

You can confirm this theory as follows: Ping the default gateway on both machines. Then find the default gateway in the ARP table. See if the MAC addresses are the same. If they're not, that's the issue. They're using different routers.

Update: I like Tony Roth's theory. Maybe you have a web proxy configured that's outside of (or not allowing connections to) the local network.