871w as an additional access point

Unanswered Question
Apr 26th, 2012

Hello everyone,

I have an 871w set up to add wireless connectivity to an existing network. When adding a client to the physical interfaces to test VLAN internet connectivity, however, a DHCP address is assigned but internet traffic on the terminal never reaches the network nor does the network recognize the IP the terminal shows as being 'connected'. Also, pings sourced from the VLAN do reach destinations. I've attached my config file, I think it's a routing issue of some kind, anybody with a suggestion conccur? is the existing network. is an existing 871w router set as the DHCP server for that network and is a Windows Server 2003 DNS box. VLAN 2 and DHCP pool alpha were control sets for trialing DNS settings.


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Henrik Grankvist Thu, 04/26/2012 - 14:33


I dont really understand the problem. Does the clients connected physically get an IP address from the router but can't reach the internet?

All1edservices2... Thu, 04/26/2012 - 18:20

Exactly, my issue is with getting a DHCP-assigned address from the router on VLAN1, but not actually getting internet access or seeing the assigned address as "connected" from the router. Would any other debug commands be helpful?

Henrik Grankvist Fri, 04/27/2012 - 00:52

If you can ping your internal network, like the other router (

And you can ping that address, add a default route:

csdd(config)#ip route fastethernet4

jan.ifkovitz Fri, 04/27/2012 - 01:14

hi at the first look there is a little thing... on the vlan interface configuration

interface Vlan1

ip address

ip helper-address

ip nat inside

ip virtual-reassembly

bridge-group 1

bridge-group 1 spanning-disabled


interface Vlan2

ip address

ip nat inside

ip virtual-reassembly

ip nat inside source list nat interface FastEthernet4 overload


you configure ip nat inside... but as i understand you want to integrate the router in an existing network. right ?

if this is an router on the stick you can abstain nat.... or do you want to do mascarding ?

then i see you have configured

rip and a static route...

can you post a "sh ip route" ? thinking about administrativ distances.....

All1edservices2... Fri, 04/27/2012 - 07:12

For simplicity sake, I'd like to abstain nat entirely if it would still function without it. In that case should I simply remove the nat inside/outside lines? I configured RIP originally on the network because I thought that would have prevented this problem, but after it happened anyway, I also added a direct static line thinking that would fix the issue, but it didn't.

also here are the reports to show ip, some ping attemps and a screenshot of my terminal's ip display:

All1edservices2... Fri, 04/27/2012 - 07:09

Alas, I thought that would have worked originally, and it did not, so I thought the more specific route ( -> would have worked better. Using the no ip route command and deleting that route, and adding the route back you had above suggested however, didn't get it either unfortunatly. 

Henrik Grankvist Fri, 04/27/2012 - 07:51

Yeah you can remove NAT by doing "no ip nat inside/outside" on the interfaces.

You could try removing: "bridge-group 1" and  "bridge-group 1 spanning-disabled" from interface vlan1, I don't know if  that is causing and issue, but you are not using a bridged interface at  this point so it wouldn't hurt.

And for the pings, when you pinged the client from the router, that could just be the firewall on the computer.

And from what I can see, the computer does not have a  DNS server configured, so it's not reveiving that from the server. Just  try to set like manually and see if that solves anything.

All1edservices2... Fri, 04/27/2012 - 08:26

Didn't I set up a bridged interface between the dot11radio0.1 and vlan1 so I could connect wireless users to the vlan though?

Also, setting the terminal machine's adapter settings for IPv4, in the DNS field, manually to (google's public DNS) and, as well as manually setting it to our networks' actually-designated DNS server @, didn't work yet either.

Would I configure the pointers (#dns-server a.b.c.d) to (or whatever DNS server I end up using) in the VLAN interface, the DHCP pool, or just the global configuration? Can I automatically use a public or default (isp-assigned) dns server and still maintain network connectivity to an existing local domain network?

To further clarify the specific situation, in case any of this is context-sensitive:

These are lab settings I'm building for a deployment. When I get to the actual site, I'll be handling a Windows 2008 (possibly 2003) server set up as a dns/dhcp server for an existing network going into a switch (esentially as a router from the modem). I was going to put the 871 on the switch at the site, to recieve the DHCP-assigned address from the switch into F4. To make sure these users are added to the csdd.local domain (to use local printer pools and such), do I absolutely have to specifically route towards the existing DNS server (the windows box) somewhere in the 871w config file to direct traffic or is that irrelevant for domain functionality?

Henrik Grankvist Fri, 04/27/2012 - 11:21

If you used bridged interfaces it would look something like this. Notice the BVI1 interface. It is what connects the two and it is on that interface you set the IP-address. (BVI = Bridged Virtual Interface).

interface Dot11Radio0

no ip address

no ip route-cache


encryption mode ciphers aes-ccm


ssid GruppQ-WPA2-Enterprise


speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0

station-role root

bridge-group 1

bridge-group 1 subscriber-loop-control

bridge-group 1 block-unknown-source

no bridge-group 1 source-learning

no bridge-group 1 unicast-flooding

bridge-group 1 spanning-disabled


interface FastEthernet0

no ip address

no ip route-cache

duplex auto

speed auto

bridge-group 1

no bridge-group 1 source-learning

bridge-group 1 spanning-disabled

hold-queue 160 in


interface BVI1

ip address

no ip route-cache

If you want the clients to get an IP address from the Windows configured DHCP-server you need to do a "ip helper-address" on vlan1 (or bvi1, if you will use that) that points to the servers IP address.

Henrik Grankvist Fri, 04/27/2012 - 11:23

But it is still weird that the client can't get out on the internet, sounds like it may not be this router's problem. Maybe it's your router that is directly connected to the internet.

Maybe the subnet the client is on isn't allowed to be NAT:ed? I'm a bit confused at the moment.


This Discussion

Related Content