I am working on configuring a Cisco 881G router and I am not finding very good information on configuring the cellular interface and 3G modem. Can someone give me an example of the activation process as well as configuring the cellular 0 interface as a secondary interface. My design is to use the WAN as the primary and have it automatically fail over to the 3G card when the WAN fails. I am doing LAN to LAN VPN and need it to route over as well.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
I have been working from this document. It says the dialer watch is for configuring remote managment in case the primary fails using aux or console port. I am not looking for remote management but need all trafic, existing VPN included, to fail over and use the Cellular modem interface that has a dynamic IP address, in the event that the primary fails.
In general terms, do you have a default route that uses the
route 0.0.0.0 0.0.0.0 PrimaryInterface weight
add to it
route 0.0.0.0 0.0.0.0 secondaryinterface lowerweight
weight<lowerweight (for failover)
weight=lowerweight (load balancing)
The higher the number assigned to weight the lower the preference.
i.e. 10 will be primary 100 will be secondary.
The issue is that the VPN likely depends on the source IP and unless the VPN server is configured to accept connections from the broadband connection as well, the VPN will not be established.
You may have a situation that both VPN session will be active upon router boot and until idle timeout kicks in on the broadband connection or you have the broadband interface setup to demand dial type.
Could you post the config?
Is the floating route you are using references an IP or the interface?
refernces to the interface will result in the route being removed when the interface goes down.
A route referencing an IP, remains in place and will see intermittent functionality only if the two routes are of equal weight.
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname CUA_RTR_01
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
no logging console
enable secret 5 $1$RatL$nPniMwdlksAe1PBRHf
enable password 7 130815010803163A7C7378
!
no aaa new-model
memory-size iomem 10
clock timezone EST -5
!
!
ip source-route
!
!
ip dhcp excluded-address 10.22.255.1
!
ip dhcp pool dpool1
import all
network 10.22.255.0 255.255.255.0
dns-server 205.210.xx.xx
default-router 10.22.255.1
!
!
ip cef
no ip domain lookup
ip name-server 205.10.xx.xx
no ipv6 cef
!
!
multilink bundle-name authenticated
chat-script 3G "" "ATDT*99*1#" TIMEOUT 30 "CONNECT"
!
!
!
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
!
crypto isakmp policy 20
authentication pre-share
crypto isakmp key xxxx address 12.200.xx.xx
crypto isakmp key xxxx address 12.159.xx.xx
!
!
crypto ipsec transform-set 3DES esp-3des esp-sha-hmac
crypto ipsec transform-set DES esp-des esp-sha-hmac
!
crypto map vpn 10 ipsec-isakmp
set peer 12.200.xx.xx
set transform-set 3DES
match address 100
crypto map vpn 20 ipsec-isakmp
set peer 12.159.xx.xx
set transform-set 3DES
match address 101
!
archive
log config
hidekeys
!
!
!
!
!
interface FastEthernet0
switchport access vlan 255
!
interface FastEthernet1
switchport access vlan 255
!
interface FastEthernet2
shutdown
!
interface FastEthernet3
shutdown
!
interface FastEthernet4
ip address 12.159.xx.xx 255.255.255.240
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map vpn
!
interface Cellular0
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer in-band
dialer pool-member 2
async mode interactive
!
interface Vlan1
no ip address
no routing dynamic
!
interface Vlan255
ip address 10.22.255.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
ip default-gateway 12.159.xx.xx
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 12.xx.xx.xx
no ip http server
no ip http secure-server
!
!
ip nat pool pool1 12.159.xx.xx 12.159.xx.xx netmask 255.255.255.240
ip nat inside source route-map nonat pool pool1 overload
!
access-list 100 permit ip 10.22.0.0 0.0.255.255 10.13.0.0 0.0.255.255
access-list 101 permit ip 10.22.0.0 0.0.255.255 10.5.0.0 0.0.255.255
access-list 2000 deny ip 10.22.0.0 0.0.255.255 10.13.0.0 0.0.255.255
access-list 2000 deny ip 10.22.0.0 0.0.255.255 10.5.0.0 0.0.255.255
access-list 2000 permit ip 10.22.0.0 0.0.255.255 any
!
!
!
!
route-map nonat permit 1
match ip address 2000
!
!
control-plane
!
!
line con 0
password 7 000911150754191658761C
login
no modem enable
line aux 0
line 3
no exec
rxspeed 3100000
txspeed 1800000
line 4
exec-timeout 0 0
timeout login response 0
privilege level 0
modem answer-timeout 0
modem dtr-delay 0
activation-character 0
data-character-bits 8
exec-character-bits 8
special-character-bits 8
no exec
length 0
width 0
no history
no editing
transport preferred none
transport input none
transport output none
escape-character soft 0
escape-character 0
no ip tcp input-coalesce-threshold
callback forced-wait 0
callback nodsr-wait 0
stopbits 1
speed 115000
line vty 0 4
password 7 000911150754191658761C
login
!
scheduler max-task-time 5000
end
You have defined a default-gateway which should not be used unless you have routing disabled.
This entry is likely what interfered with your failover ip route setup.
The VPN policies you have will need work on the other side to get them working
remove the ip defalt-gateway entry
replace the explicit ip route
ip route 0.0.0.0 0.0.0.0 12.x.x.x
with
ip route 0.0.0.0 0.0.0.0 FastEther4 10
ip route 0.0.0.0 0.0.0.0 cellular0 50
Why are you using:
ip nat pool pool1 12.159.xx.xx 12.159.xx.xx netmask 255.255.255.240
ip nat inside source route-map nonat pool pool1 overload
It will take more effort, but does each individual internal system needs to have a public IP?
show ip nat tranlation
If you have a need to have an internal system accessible from the outdie, using a ip nat (inside,outside ) might be a better way to go then to automap the Public IP range over the private IP range.
I have made some ddr changes to the configuation as well as the static routes.
When I set the primary default gateway as an interface rather than an IP address, all routing stops.
When I have the following config.
ip route 0.0.0.0 0.0.0.0 12.x.x.x 1
ip route 0.0.0.0 0.0.0.0 cellular 0 10
I can still route our the primary Fa4 interface when connected.
When I disconnect Fa4, the route goes away and then the cellular 0 route shows up. Also, now when this happens, my cellular 0 interface shows UP, UP but still will not pass traffic. Any ideas on why it would not pass traffic through the Cellular 0 interface. Below is the latest config.
Current configuration : 3601 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname CUA_RTR_01
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
no logging console
enable secret 5 $1$RatL$nPniMwdlksAe1PBRHf
enable password 7 130815010803163A7C7378
!
no aaa new-model
memory-size iomem 10
clock timezone EST -5
!
!
ip source-route
!
!
ip dhcp excluded-address 10.22.255.1
!
ip dhcp pool dpool1
import all
network 10.22.255.0 255.255.255.0
dns-server 205.210.42.205
default-router 10.22.255.1
!
!
ip cef
no ip domain lookup
ip name-server 205.10.42.205
no ipv6 cef
!
!
multilink bundle-name authenticated
chat-script 3G "" "ATDT*99*1#" TIMEOUT 30 "CONNECT"
!
!
!
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
!
crypto isakmp policy 20
authentication pre-share
crypto isakmp key xxxxx address 12.200.x.x
crypto isakmp key xxxxx address 12.159.x.x
!
!
crypto ipsec transform-set 3DES esp-3des esp-sha-hmac
crypto ipsec transform-set DES esp-des esp-sha-hmac
!
crypto map vpn 10 ipsec-isakmp
set peer 12.200.x.x
set transform-set 3DES
match address 100
crypto map vpn 20 ipsec-isakmp
set peer 12.159.x.x
set transform-set 3DES
match address 101
!
archive
log config
hidekeys
!
!
!
!
!
interface FastEthernet0
switchport access vlan 255
!
interface FastEthernet1
switchport access vlan 255
!
interface FastEthernet2
shutdown
!
interface FastEthernet3
shutdown
!
interface FastEthernet4
backup interface Cellular0
ip address 12.159.x.x 255.255.255.240
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map vpn
!
interface Cellular0
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer in-band
dialer idle-timeout 30
dialer string 3G
dialer-group 1
async mode interactive
!
interface Vlan1
no ip address
no routing dynamic
!
interface Vlan255
ip address 10.22.255.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
ip default-gateway 12.159.x.x
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 FastEthernet4
ip route 0.0.0.0 0.0.0.0 12.159.x.x
ip route 0.0.0.0 0.0.0.0 Cellular0 10
no ip http server
no ip http secure-server
!
!
ip nat pool pool1 12.159.x.x 12.159.x.x netmask 255.255.255.240
ip nat inside source route-map nonat pool pool1 overload
!
access-list 1 permit 10.22.0.0 0.0.255.255
access-list 100 permit ip 10.22.0.0 0.0.255.255 10.13.0.0 0.0.255.255
access-list 101 permit ip 10.22.0.0 0.0.255.255 10.5.0.0 0.0.255.255
access-list 2000 deny ip 10.22.0.0 0.0.255.255 10.13.0.0 0.0.255.255
access-list 2000 deny ip 10.22.0.0 0.0.255.255 10.5.0.0 0.0.255.255
access-list 2000 permit ip 10.22.0.0 0.0.255.255 any
dialer-list 1 protocol ip list 1
!
!
!
!
route-map nonat permit 1
match ip address 2000
!
!
control-plane
!
!
line con 0
password 7 000911150754191658761C
login
no modem enable
line aux 0
line 3
script dialer 3G
no exec
rxspeed 3100000
txspeed 1800000
line 4
exec-timeout 0 0
timeout login response 0
privilege level 0
modem answer-timeout 0
modem dtr-delay 0
activation-character 0
data-character-bits 8
exec-character-bits 8
special-character-bits 8
no exec
length 0
width 0
no history
no editing
transport preferred none
transport input none
transport output none
escape-character soft 0
escape-character 0
no ip tcp input-coalesce-threshold
callback forced-wait 0
callback nodsr-wait 0
stopbits 1
speed 115000
line vty 0 4
password 7 000911150754191658761C
login
!
scheduler max-task-time 5000
end
Arnold:
I made the route configuration changes you suggested and when I do neither interface will pass traffic.
The Fa4 will only pass traffic when ip route is set to an ip address.
As far as the NAT is concerned, this is how it was suggested by Cisco. The IP NAT pools is a single private IP that all inside devices are translated to (PAT).
I think I need to validate that my cellular interface is working properly but I am not sure what I am looking for. I am attaching some code snippets to see if anyone can see a problem with the cellular interface. The only thing I notice for Profile 1 is that there is no IP address assigned.
show ip route
show ip nat translation
You have a pool1 defined that maps the wired allocated Ips via Fast4 in a one to one map.
Do you really need that?
What is the purpose of your VLAN255 to include all your LAN ips?
Does a system with IP 10.22.255.2-14 (pool1 range) behaves in the same manner as a system with an IP outside that range?
Arnold, below are my responses to your requests. Thanks. Please note, I worked on the config this weekend. I have the cellular interface now working and getting an IP address. I am still unable to get the LAN routing out the cellular interface.
show ip route
show ip nat translation
You have a pool1 defined that maps the wired allocated Ips via Fast4 in a one to one map.
Do you really need that? Yes, need to hide internal addresses from the internet (PAT).
What is the purpose of your VLAN255 to include all your LAN ips? For now, just during testing, once completed, VLAN 255 will only be used for the default gateway for the LAN and the router will no longer be doing DHCP, I will have a 3570 doing DHCP and Inter Vlan Routing for the LAN.
Does a system with IP 10.22.255.2-14 (pool1 range) behaves in the same manner as a system with an IP outside that range? You lost me here, the pool is .2-254.
Not sure why you are defining a PAT pool versus binding the outgoing traffic to a single IP. You would then be able to use the other IPs for other inbound services.
ip nat inside source list 1 interface Fast4 overload
You need to add a similar NAT translation rule for the cellular interface.
ip nat inside source list 1 interface cellular0 overload
Business Accounts
Answer for Membership
by: arnoldPosted on 2009-10-27 at 04:35:25ID: 25671139
My guess would be that you need to contact sprint if you have not done so at this point and register the device with them.
Once sprint is setup for the device, I think it should auto-connect and get an IP.
See if the following discussion leads you in the right direction to solve your issue.
http://forums.whirlpool.ne