Cisco Configuration Troubles

T

TechieSooner

Supreme [H]ardness
Joined
Nov 7, 2007
Messages
7,601
So here's my deal.

I can go Cable Modem -> Static Windows Connection
And I can surf the net using these parameters (Changed a few digits... But networks are the same):
IP: 66.66.241.180
Subnet: 255.255.255.240
Gateway: 66.66.241.1
DNS: Open DNS

Like I said, it works.

But when I take that connection into a Cisco 2801 with the following config set on FE0/1, I can't do squat:
interface FastEthernet0/1
ip address 66.66.241.180 255.255.255.240
duplex auto
speed auto
ip route 0.0.0.0 0.0.0.0 66.66.241.1
Click to expand...

Anything you can think of WHY?

I'm afraid it might be something else in my config to do with the NAT or something, but really don't want to post up the whole config here.
 
Last edited:
ill assume the static route is a typo and was meant to be 66.66.241.1

anyways, the subnet masks on both interfaces put the default gateway out of the wan-ip's subnet. your computer might not care but the router will
 
Last edited:
Sounds like it is something else in your config, like NAT or something. Can you post up your whole config here?

PS: Just being funny. See above post.
 
Assuming you have properly configured NAT / PAT, change your default route to fa0/1 instead of 66.66.241.1
 
exstyle said:
Assuming you have properly configured NAT / PAT, change your default route to fa0/1 instead of 66.66.241.1
Click to expand...

Yea, that was a typo.... It's corrected now. I didn't transpose all my numbers correctly :)

But that's in there correctly. I just don't know what else to look at.
 
With a /28 subnet, there is no way you can have a default gateway of .1 and an IP address of .180 and expect it to route properly.


What happens when you make it /24?
 
There is a lot more to a Cisco config if you want to emulate a SOHO firewall. NAT, IOS firewall, etc.
 
Well to ensure your nat is correct, simple example:

If your local side is 192.168.0.0 /24 for example

NAT config would be:

access-list 101 permit 192.168.0.0 0.0.0.255 any

ip nat inside source list 101 interface fastethernet0/1 overload

and if the default route to your .1 doesnt work,

Try a simple ip route 0.0.0.0 0.0.0.0 Fa0/1
 
I'm pretty new to configuring a Cisco IOS myself and I made an easy mistake the other day by forgetting that the NAT access list name is case-sensitive.

access-list NAT 192.168.0.0 0.0.255.255 any
...
ip nat inside source list nat interface fastethernet0/1 overload

It's always stupid crap like that which trips me up.

PS: A thanks to Vito for writing up a good tutorial on how to do this stuff.
 
pacmantravis said:
With a /28 subnet, there is no way you can have a default gateway of .1 and an IP address of .180 and expect it to route properly.


What happens when you make it /24?
Click to expand...
I realize it's on different networks, but like I said... It works 100% perfectly fine on a Windows box.
It's what the ISP gave me as connection information as well...


Tacman said:
Well to ensure your nat is correct, simple example:

If your local side is 192.168.0.0 /24 for example

NAT config would be:

access-list 101 permit 192.168.0.0 0.0.0.255 any

ip nat inside source list 101 interface fastethernet0/1 overload

and if the default route to your .1 doesnt work,

Try a simple ip route 0.0.0.0 0.0.0.0 Fa0/1
Click to expand...

Alright, this is all stuff I need to try out. Thanks!
 
I would start by seeing if the router itself can ping out to the internets. Can the router ping 4.2.2.2? If that works then your issue is probably with NAT/PAT configuration. If you can't ping the internets then you need to look at your IP configuration or default route
Posted via [H] Mobile Device
 
Captain Colonoscopy said:
I would start by seeing if the router itself can ping out to the internets. Can the router ping 4.2.2.2? If that works then your issue is probably with NAT/PAT configuration. If you can't ping the internets then you need to look at your IP configuration or default route
Posted via [H] Mobile Device
Click to expand...
I tried pinging the OpenDNS servers... No dice.


Vito_Corleone said:
This makes zero sense.
Click to expand...

I know. But like I said, it works 100% perfectly fine on Windows.

Should I call the ISP and get a different gateway perhaps (I don't know what good that'd do, I'm assuming everyone on a particular router gets the same gateway)
 
At this point we can spend a few days guessing, or you can post the entire config you are running, and we can correct it, and explain the corrections
 
exstyle said:
At this point we can spend a few days guessing, or you can post the entire config you are running, and we can correct it, and explain the corrections
Click to expand...

Alright, I'll work on that... I've got IPSec tunnels and stuff so I need to obscure some info...
 
Here we go...
If anyone sees something sensitive please let me know so I can edit it :eek:

At any rate I've snipped some stuff, and did a find/replace on my IPs to change it a tiny bit...
Other than that should be OK.

This configuration works just fine on my T1 connection. All I've done is edit to be the new IPs on the Cable connection and it won't work. So I know the NAT *works* I just don't know why it's not working on the cable connection.

!This is the running config of the router: 192.168.0.1
Click to expand...
 
Last edited:
I see several things I suspect are incorrect or simply not needed, but I will let the more advanced guys address those. For starters your nat is not correctly configured, in the access-list used to match which traffic should be translated (access-list 111 which I have listed below)

access-list 111 deny ip host 192.168.0.5 10.220.2.0 0.0.0.255
access-list 111 deny ip host 192.168.0.5 10.220.1.0 0.0.0.255
access-list 111 deny ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 111 permit ip 192.168.0.0 0.0.0.255 any

Line 3 you deny all your LAN traffic before permitting it, remove line 3 and NAT should function properly.

If I'm incorrect here one of the more skilled guys will let you know.

Also change your route command to use the interface, instead of the actual default gateway IP address.

ip route 0.0.0.0 0.0.0.0 fa0/1
 
exstyle said:
I see several things I suspect are incorrect or simply not needed, but I will let the more advanced guys address those. For starters your nat is not correctly configured, in the access-list used to match which traffic should be translated (access-list 111 which I have listed below)

access-list 111 deny ip host 192.168.0.5 10.220.2.0 0.0.0.255
access-list 111 deny ip host 192.168.0.5 10.220.1.0 0.0.0.255
access-list 111 deny ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 111 permit ip 192.168.0.0 0.0.0.255 any

Line 3 you deny all your LAN traffic before permitting it, remove line 3 and NAT should function properly.

If I'm incorrect here one of the more skilled guys will let you know.

Also change your route command to use the interface, instead of the actual default gateway IP address.

ip route 0.0.0.0 0.0.0.0 fa0/1
Click to expand...

His NAT statement is likely denying VPN traffic from being NATed, it shouldn't affect NAT functionality.

Doing a default with the interface isn't usually the best way as your router will think all of your destinations are directly connected and it will send ARP requests for everything.
 
This is why I was waiting on you or xphil3 to respond, but Ill take a stab at defending my selections in the interest of learning. As far as the default route generally speaking of course you are correct, BUT since he doesnt have a route to the address (it being in a different network) wouldnt this allow it to work?

Also, with the NAT ACL, I see that he is using it to deny traffic to the two addresses which are VPN traffic, wouldnt line 3 then deny all his LAN addresses from having NAT applied?
 
exstyle said:
This is why I was waiting on you or xphil3 to respond, but Ill take a stab at defending my selections in the interest of learning. As far as the default route generally speaking of course you are correct, BUT since he doesnt have a route to the address (it being in a different network) wouldnt this allow it to work?

Also, with the NAT ACL, I see that he is using it to deny traffic to the two addresses which are VPN traffic, wouldnt line 3 then deny all his LAN addresses from having NAT applied?
Click to expand...

His default route is wrong and is probably a big issue. He should fix is as opposed to working around it.

The third line in his ACL is saying don't NAT traffic from 192.168.0.x to 192.168.1.x. It won't affect NAT to the rest of the world.
 
I misread ACL entirely lol, missed the 1 in the destination on line 3. Thanks Vito!
 
Putting the Cisco stuff aside, are you sure your ISP isn't holding onto your Windows MAC as the only allowed MAC?

And of course the obvious point that your default route is outside of the public network range.
 
Vito_Corleone said:
His default route is wrong and is probably a big issue. He should fix is as opposed to working around it.

The third line in his ACL is saying don't NAT traffic from 192.168.0.x to 192.168.1.x. It won't affect NAT to the rest of the world.
Click to expand...
Yea, it was for VPN purposes...


Valnar said:
Putting the Cisco stuff aside, are you sure your ISP isn't holding onto your Windows MAC as the only allowed MAC?

And of course the obvious point that your default route is outside of the public network range.
Click to expand...
I never thought about the MAC.
So what's your suggestion?? Grab the MAC off my Windows PC and assign it to the interface? If so, I have no idea how to do that on the Cisco (MAC Cloning)?
 
Yeah, the gateway issue is a pretty big issue.

I spent all day onsite once trying to troubleshoot a net connection and it turns out the the ISP gave me the wrong subnet mask. Once that was corrected they were able to get on the net.
 
TechieSooner said:
I never thought about the MAC.
So what's your suggestion?? Grab the MAC off my Windows PC and assign it to the interface? If so, I have no idea how to do that on the Cisco (MAC Cloning)?
Click to expand...

No, simply call your ISP and tell them you've changed PC's. Or try rebooting your broadband router first. It may only hold onto it temporarily.
 
They gave me the wrong subnet. It's not 255.255.255.240, but rather should be 255.255.255.0

Which puts that gateway in the correct network. So hopefully changing the subnet on that should fix it?
 
Yeah, try changing the subnet mask. Once that's changed and if its still not fixed then you can look at your NAT configs.
 
Just to let you guys know... Changing the subnet worked.

Lesson: Always second guess your ISP.
 
TechieSooner said:
Just to let you guys know... Changing the subnet worked.

Lesson: Always second guess your ISP.
Click to expand...


Nice. :D

I learned that lesson a long time ago from having to deal with a local small ISP that may or may not be called SouthSlope. Five times in a row they gave me the wrong static IP address information for new DSL installs for five different businesses. It was awesome. :eek:
 
Captain Colonoscopy said:
Nice. :D

I learned that lesson a long time ago from having to deal with a local small ISP that may or may not be called SouthSlope. Five times in a row they gave me the wrong static IP address information for new DSL installs for five different businesses. It was awesome. :eek:
Click to expand...

Now that's pretty bad right there... Five times? Wow.
 
You must log in or register to reply here.
Back
Top