Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

HTTP Page problem

--begin ciscomoderator note-- The following post has been edited to remove potentially confidential information. Please refrain from posting confidential information on the site to reduce security risks to your network. -- end ciscomoderator note --

I have a 1720 router which I use for VPN and internet use. The vpn works fine and so does the internet, however users cannot open internet pages. HTTPS works fine so does FTP but 90% of HTTP does not.

I have included my config so any help would be much appreciated.

Current configuration : 3918 bytes


version 12.2

service timestamps debug uptime

service timestamps log uptime

service password-encryption


hostname --moderator edit-- Router


logging buffered 16000 debugging

no logging monitor

enable secret 5 --moderator edit--


memory-size iomem 15

clock timezone London 0

mmi polling-interval 60

no mmi auto-configure

no mmi pvc

mmi snmp-timeout 180

ip subnet-zero



no ip domain-lookup

ip dhcp excluded-address


ip dhcp pool local



dns-server --moderator edit--

lease 20


no ip bootp server

ip inspect name IOSFirewall cuseeme timeout 3600

ip inspect name IOSFirewall ftp timeout 3600

ip inspect name IOSFirewall http timeout 3600

ip inspect name IOSFirewall smtp timeout 3600

ip inspect name IOSFirewall tftp timeout 3600

ip inspect name IOSFirewall udp timeout 3600

ip inspect name IOSFirewall tcp timeout 3600

ip audit notify log

ip audit po max-events 100

vpdn enable


vpdn-group pppoe


protocol pppoe



crypto isakmp policy 1

hash md5

authentication pre-share


crypto isakmp policy 2

authentication pre-share

group 2

crypto isakmp key ******** address IP address no-xauth



crypto ipsec transform-set cisco-Paris esp-des esp-sha-hmac


crypto map Jeyes local-address Dialer1

crypto map Jeyes 2 ipsec-isakmp

set peer IP address

set security-association lifetime kilobytes

set security-association lifetime seconds 86400

set transform-set cisco-Paris

match address 110





interface Ethernet0

description Connected to the Internet

no ip address

ip access-group 199 in

no keepalive


pppoe enable

pppoe-client dial-pool-number 1

crypto map Jeyes


interface FastEthernet0

description Paris Site

ip address

ip access-group 101 in

ip nat inside

ip inspect IOSFirewall in

ip tcp adjust-mss 1452

speed 10


interface Dialer1

description connected to the internet

ip address --moderator edit--

ip access-group 199 in

ip mtu 1492

ip nat outside

encapsulation ppp

dialer pool 1

dialer-group 2

ppp authentication chap pap callin

ppp chap hostname ******************

ppp chap password 7 ******************

ppp pap sent-username **************** password 7 *****************

crypto map Jeyes


ip nat inside source list 100 interface Dialer1 overload

ip classless

ip route Dialer1

no ip http server

ip pim bidir-enable



access-list 100 deny ip --moderator edit--

access-list 100 permit ip any

access-list 101 permit tcp any

access-list 101 permit udp any

access-list 101 permit icmp any

access-list 101 deny ip any any

access-list 110 permit ip --moderator edit--

access-list 199 deny ip any

access-list 199 permit esp any any

access-list 199 permit udp any any eq isakmp

access-list 199 permit tcp --moderator edit--

access-list 199 permit udp --moderator edit--

access-list 199 permit icmp --moderator edit--

access-list 199 permit tcp any host --moderator edit-- eq smtp

access-list 199 permit icmp any any echo

access-list 199 permit icmp any any echo-reply

access-list 199 permit icmp any any unreachable

access-list 199 permit icmp any any time-exceeded

access-list 199 permit icmp any any traceroute

access-list 199 deny ip any any

dialer-list 2 protocol ip permit



line con 0

password 7 --moderator edit--

logging synchronous

line aux 0

line vty 0 4

password 7 --moderator edit--


line vty 5 15



Re: HTTP Page problem

Pl. check to see if removing the following line from config helps:

ip inspect name IOSFirewall http timeout 3600

If it fixes your problem, then the most of the sites you are browsing are serving java applet. When you inspect http, you are blocking all the java applet.

New Member

Re: HTTP Page problem

I have the same problem which is actually with you. I have installed the router 1710. If you know how to configure it, please let me know. I got another problem in this environment. I cannot receive some of the e-mail from Internet. Do you have a same problem?


New Member

Re: HTTP Page problem

I resolved the problem by assigning static IP addresses to the clients. This then made them work. I also get the email problem but not all the time. If you have solved this then please let me know


New Member

Re: HTTP Page problem

I have had a similar problem with the emails. If I recall correctly it was related to the fact that microsoft uses esmtp and since you are inspecting smtp, some esmtp commands will be invalid and discarded. Try to remove the line inspect smtp.


New Member

Re: HTTP Page problem

Same problem, a little different.

I am having the same trouble. We cannot send/receive mail with a small number of domains. We discovered that the trouble is related to a NAT statement on the router, - 'IP nat inside source' (not real numbers).

If the previous message concerning inspecting smtp doesn't answer your question, maybe it NAT related. I'd do more than point you in the direction, however, I still haven't worked out a solution.

Good luck

CreatePlease to create content