Solved: 857W - Configuration Help

ozsoftcisco · ‎01-08-2014

Hi All,

I have managed to configure to configure a 857W - it connects to the internet and everything is good - except that I can't ping the ethernet group or make any connection from either the WAN - > inside or Inside -> WAN.

I think I have mis-configured the ethernet side. Can anyone spot my obvious mistakes or please help point me in the right direction please? I'm starting to struggle and not getting anywhere fast.

Thanks.

Current configuration : 6485 bytes

!

version 12.4

no service pad

service tcp-keepalives-in

service tcp-keepalives-out

service timestamps debug uptime

service timestamps log uptime

service password-encryption

service sequence-numbers

no service dhcp

!

hostname router

!

boot-start-marker

boot-end-marker

!

logging buffered 51200 debugging

!

no aaa new-model

!

resource policy

!

clock timezone AEST 10

clock summer-time DST recurring 1 Sun Oct 2:00 last Sun Mar 2:00

no ip source-route

!

ip cef

ip inspect name firewall tcp

ip inspect name firewall udp

ip inspect name firewall cuseeme

ip inspect name firewall h323

ip inspect name firewall rcmd

ip inspect name firewall realaudio

ip inspect name firewall streamworks

ip inspect name firewall vdolive

ip inspect name firewall sqlnet

ip inspect name firewall tftp

ip inspect name firewall ftp

ip inspect name firewall icmp

ip inspect name firewall sip

ip inspect name firewall esmtp max-data 52428800

ip inspect name firewall fragment maximum 256 timeout 1

ip inspect name firewall rtsp

ip inspect name firewall pptp

ip tcp selective-ack

ip tcp timestamp

no ip bootp server

no ip domain lookup

ip domain name local

!

crypto pki trustpoint TP-self-signed-3456743647

enrollment selfsigned

subject-name cn=IOS-Self-Signed-Certificate-3456743647

revocation-check none

rsakeypair TP-self-signed-3456743647

!

crypto pki certificate chain TP-self-signed-3456743647

certificate self-signed 01

30820244 308201AD A0030201 02020101 300D0609 2A864886 F70D0101 04050030

31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274

69666963 6174652D 33343536 37343336 3437301E 170D3032 30333031 30343135

35335A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649

4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 34353637

34333634 3730819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281

8100C8C0 2F0C226E A39016D8 181C8C7C 1C09F3DE 66966027 145CE938 87817DF4

FD578BB8 6C1C119A B59DC9B8 EBA15A77 04112226 CC9AFBEE D14769A2 C298709F

613B3A81 666F9C33 65C29F18 90DB8438 D7BE7747 0551B783 2DC7440F CD0F3C02

D9F3A660 EC5F348C 85124AF4 8847B5CA E1173318 902C4AD3 A368E8DD 0B14AF26

AA2B0203 010001A3 6C306A30 0F060355 1D130101 FF040530 030101FF 30170603

551D1104 10300E82 0C726F75 7465722E 6C6F6361 6C301F06 03551D23 04183016

801414F2 F8EA9260 969F01A7 6D984B07 025A3EB8 BE0E301D 0603551D 0E041604

1414F2F8 EA926096 9F01A76D 984B0702 5A3EB8BE 0E300D06 092A8648 86F70D01

01040500 03818100 99BAF8D2 E94CAEF5 3DF534DF 18693926 4C66C54E 93CD2394

F4028A65 8F310381 0A0429C6 137E5D4A CFC8E3C1 97B5C0AA 7F7016F7 1A4EFE6F

9CE37C5D 90CAB283 CDE109C0 60642357 E9E8C181 F85EE9C3 9E34E854 81889917

1E9E92F1 DFA840A2 5A7E287C 1595B5CB EF20CB63 EC4462C4 EDADDA56 9028C8E8

AE81924B D967A5C1

quit

file verify auto

username admin privilege 15 secret 5 blah.

!

interface ATM0

no ip address

no ip redirects

no ip unreachables

no ip proxy-arp

ip route-cache policy

ip route-cache flow

no atm ilmi-keepalive

dsl operating-mode auto

!

interface ATM0.1 point-to-point

description $ES_WAN$

no snmp trap link-status

pvc 8/35

encapsulation aal5mux ppp dialer

dialer pool-member 1

!

interface FastEthernet0

!

interface FastEthernet1

!

interface FastEthernet2

!

interface FastEthernet3

!

interface Dot11Radio0

no ip address

shutdown

speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0

station-role root

!

interface Vlan1

ip address 192.168.10.251 255.255.255.0

ip access-group 102 in

ip nat inside

ip virtual-reassembly

bridge-group 1

bridge-group 1 spanning-disabled

!

interface Dialer0

ip address negotiated

ip access-group 101 in

no ip redirects

no ip unreachables

ip inspect firewall out

ip nat outside

ip virtual-reassembly

encapsulation ppp

dialer pool 1

dialer-group 1

no cdp enable

ppp pap sent-username blah blah

ppp ipcp dns request

ppp ipcp route default

!

ip http server

ip http authentication local

ip http secure-server

ip http timeout-policy idle 60 life 86400 requests 10000

ip nat inside source list 1 interface Dialer0 overload

ip nat inside source static tcp 192.168.10.31 3389 interface Dialer0 3389

!

access-list 1 remark The local LAN.

access-list 1 permit 192.168.10.0 0.0.0.255

access-list 2 remark Where management can be done from.

access-list 2 permit 192.168.10.0 0.0.0.255

access-list 101 remark Traffic allowed to enter the router from the Internet

access-list 101 deny ip 0.0.0.0 0.255.255.255 any

access-list 101 deny ip 10.0.0.0 0.255.255.255 any

access-list 101 deny ip 127.0.0.0 0.255.255.255 any

access-list 101 deny ip 169.254.0.0 0.0.255.255 any

access-list 101 deny ip 172.16.0.0 0.15.255.255 any

access-list 101 deny ip 192.0.2.0 0.0.0.255 any

access-list 101 deny ip 192.168.0.0 0.0.255.255 any

access-list 101 deny ip 198.18.0.0 0.1.255.255 any

access-list 101 deny ip 224.0.0.0 0.15.255.255 any

access-list 101 deny ip any host 255.255.255.255

access-list 101 permit tcp any any eq 1723

access-list 101 permit gre any any

access-list 101 deny icmp any any echo

access-list 101 deny ip any any log

access-list 102 remark Traffic allowed to enter the router from the Ethernet

access-list 102 permit ip any host 192.168.10.251

access-list 102 deny ip any host 192.168.10.255

access-list 102 deny udp any any eq tftp log

access-list 102 deny ip any 0.0.0.0 0.255.255.255 log

access-list 102 deny ip any 10.0.0.0 0.255.255.255 log

access-list 102 deny ip any 127.0.0.0 0.255.255.255 log

access-list 102 deny ip any 169.254.0.0 0.0.255.255 log

access-list 102 deny ip any 172.16.0.0 0.15.255.255 log

access-list 102 deny ip any 192.0.2.0 0.0.0.255 log

access-list 102 deny ip any 192.168.0.0 0.0.255.255 log

access-list 102 deny ip any 198.18.0.0 0.1.255.255 log

access-list 102 deny udp any any eq 135 log

access-list 102 deny tcp any any eq 135 log

access-list 102 deny udp any any eq netbios-ns log

access-list 102 deny udp any any eq netbios-dgm log

access-list 102 permit ip 192.168.10.0 0.0.0.255 any

access-list 102 permit ip any host 255.255.255.255

access-list 102 deny ip any any log

access-list 102 deny tcp any any eq 445 log

dialer-list 1 protocol ip permit

!

control-plane

!

line con 0

no modem enable

line aux 0

line vty 0 4

access-class 2 in

privilege level 15

login local

transport input telnet ssh

!

scheduler max-task-time 5000

end

johnlloyd_13 · ‎01-09-2014

try debug ppp negotation to see if your router sucessfully negotiated an IP address.

also try to report to ISP to check their side and if your PPP settings are correct.

View solution in original post

johnlloyd_13 · ‎01-08-2014

hi,

can you do below:

bridge irb

bridge 1 route ip

interface Vlan1

no ip address

no ip access-group 102 in <<< TEMPORARILY REMOVED FIRST FOR TESTING

ip nat inside

ip virtual-reassembly

bridge-group 1

interface BVI1

ip address 192.168.10.251 255.255.255.0

ip nat inside

ip virtual-reassembly

interface Dot11Radio0

no shutdown

encryption mode ciphers tkip

ssid

bridge-group 1

bridge-group 1 subscriber-loop-control

bridge-group 1 spanning-disabled

bridge-group 1 block-unknown-source

no bridge-group 1 source-learning

no bridge-group 1 unicast-flooding

ip route 0.0.0.0 0.0.0.0 Dialer0

ozsoftcisco · ‎01-08-2014

Thanks John,

Thanks for your reply I saw the gateway problem earlier but it didn't help much- here is my current config. Still can't seem to connect to things.