Help with Cisco 871

[aimjay2]

Hey im new in the forum =)
Sory to bother you all and sory for my english.. im from Argentina.

Well i bought this router and i cant make it work, someone can help me?
I tried to configure ir by SDM but i cant get the pcs to navigate internet. The topology would be somwthing like this :
- Routers ip (192.168.1.41).
- lan connected through fe0 -> ip range 192.168.1.1 - 192.168.1.130
- WAN connected through fe4 (wan port) with static ip 201.253.xxx.xx /29 with d. gateway 201.253.xxx.xx This cable comes from a router provided by the isp connected with a G.SHDSL modem (3mbps)

- Dns provided by ISP (i dont remember them right now)

I just want to get it to work with a basic config and then configure firewall and security win the SDM. But putting this data in the SDM doesnt work and i dont know why. Theres no space to put the default gateway so i thught it was thay tge problem, but i put in the CLI "ip route 0.0.0.0 0.0.0.0 201.253.xxx.xx" and it worked but tooo slow, and many pages didnt open.
Well... if someone could help me i would appreciate it very much
Ty all

 

[aimjay2]

This is the running config

Building configuration...

Current configuration : 5687 bytes
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname xxxx
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 51200 debugging
logging console critical
enable secret 5 $1$h6gukaTL0u7cJIpSu9HNdGhl.
!
no aaa new-model
!
resource policy
!
clock timezone PCTime -2
ip subnet-zero
no ip source-route
ip cef
!
!
!
!
ip tcp synwait-time 10
no ip bootp server
ip name-server 200.45.191.40
ip name-server 200.45.191.35
ip ssh time-out 60
ip ssh authentication-retries 2
ip inspect name DEFAULT100 cuseeme
ip inspect name DEFAULT100 ftp
ip inspect name DEFAULT100 h323
ip inspect name DEFAULT100 icmp
ip inspect name DEFAULT100 netshow
ip inspect name DEFAULT100 rcmd
ip inspect name DEFAULT100 realaudio
ip inspect name DEFAULT100 rtsp
ip inspect name DEFAULT100 esmtp
ip inspect name DEFAULT100 sqlnet
ip inspect name DEFAULT100 streamworks
ip inspect name DEFAULT100 tftp
ip inspect name DEFAULT100 tcp
ip inspect name DEFAULT100 udp
ip inspect name DEFAULT100 vdolive
!
!
crypto pki trustpoint TP-self-signed-2073555186
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2073555186
revocation-check none
rsakeypair TP-self-signed-2073555186
!
!
crypto pki certificate chain TP-self-signed-2073555186
certificate self-signed 01
30820241 308201AA A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F3 2D060355 0326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32303 355351 3836301E 170D3032 30333031 30303035
33355A17 0D323030 31303130 30303030 305A3312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 30373335
35353138 3630819F 300D0609 2A864886 F8B6C124 574D080B
AE72057E D1518200 D05A6C9 D4BDACCF 7F28EAAD 2965242A 55F7C796 4152C3C0
62F10203 01001A3 69306730 0F060355 1D130101 FF040530 030101FF 30140603
551D1104 C17856C6 C134CAB06092A86 4886F70D 01010405
00038181 0013F6AD C9419D3 57C1032A 4F2DBE36 7BAA378B 632F2452 B97D8E39
3655F308 524CED73 C04422F9 54ACF37 BBB7BA22 4435BB38 66062994 EC38406C
0B4F66C6 6267B645E4507D0 C225AF9 074C307C 6ADDA3D4 16B9083 A544EC3
FCF5ED19 39A74DB4CBE959E 125CB5 1CD2CF16 71A32E62 78D026D8 3CE9398F
2F38E575 36
quit
username microquim privilege 15 secret 5 $1$p8n$8$gSeXvWjeJiXPR8M1GW2zs1
!
!
!
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description $ES_WAN$$FW_OUTSIDE$
ip address 201.253.xxx.xx 255.255.255.248
ip access-group 101 in
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip inspect DEFAULT100 out
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
ip address 192.168.1.41 255.255.255.0
ip access-group 100 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1452
!
ip classless
ip route 0.0.0.0 0.0.0.0 FastEthernet4
!
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 1 interface FastEthernet4 overload
!
logging trap debugging
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 100 remark auto generated by Cisco SDM Express firewall configuration
access-list 100 remark SDM_ACL Category=1
access-list 100 deny ip 201.253.xxx.xx 0.0.0.7 any
access-list 100 deny ip host 255.255.255.255 any
access-list 100 deny ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
access-list 101 remark auto generated by Cisco SDM Express firewall configuration
access-list 101 remark SDM_ACL Category=1
access-list 101 permit udp host 200.45.191.40 eq domain host 201.253.xxx.xx
access-list 101 permit udp host 200.45.191.35 eq domain host 201.253.xxx.xx
access-list 101 deny ip 192.168.1.0 0.0.0.255 any
access-list 101 permit icmp any host 201.253.xxx.xx echo-reply
access-list 101 permit icmp any host 201.253.xxx.xx time-exceeded
access-list 101 permit icmp any host 201.253.xxx.xx unreachable
access-list 101 deny ip 10.0.0.0 0.255.255.255 any
access-list 101 deny ip 172.16.0.0 0.15.255.255 any
access-list 101 deny ip 192.168.0.0 0.0.255.255 any
access-list 101 deny ip 127.0.0.0 0.255.255.255 any
access-list 101 deny ip host 255.255.255.255 any
access-list 101 deny ip host 0.0.0.0 any
access-list 101 deny ip any any
no cdp run
!
!
control-plane
!
banner login ^CAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!^C
!
line con 0
login local
no modem enable
transport output telnet
line aux 0
login local
transport output telnet
line vty 0 4
privilege level 15
login local
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end

 

[gigabyte1024]

I'm probably not qualified to answer your qestions however...
first don't ever post encrypted passwords!

second: I don't use VLANS but I think you need to give FE0 an internal IP address.

Third: instead of "IP ROUTE 0.0.0.0 0.0.0.0 FE4" I think you need "IP ROUTE 0.0.0.0 0.0.0.0 x.x.x.x" where x.x.x.x is your ISP defualt gateway

 

[aimjay2]

Thanks for your reply gigabyte. I tried changing what you´ve said and it works, but extremely slowly and algo i cant enter most web pages :S :S any ideas?

TY!!

 

[Arch]

Your config, while far from perfect, should work fine. It shouldn't be any faster / slower than what you had previously.

The fe0-3 interfaces are just switch ports, so there's no IP addresses to configure on there.

What does "show interface f4" show? This will let you check the interface for errors and the like.