asked on

Have you checked your interfaces to make sure that they are up?
Also, after you issue a ping have you looked at your arp requests to see if they are coming up incomplete or are populating with a value?
Your interfaces and routing seem to be configured appropriately but I'm wondering where you are testing from?

kyleb84

I can't see anything wrong with the parameter's you've been given, and the config you've done...

You can ping devices on the /28 side?

If there are no devices, got a laptop? Set it's IP address to 78.127.187.250 255.255.255.248 and try ping .249

Then try ping your /30 side of your router.

Let me know how you go...

kyleb84

Is there a speed/duplex mismatch on the WAN FE?

Do a "show log"

bslattery

ASKER

I am now checking all provided suggestions.

thank you for the quick responses.

sincerely,
bob

RobertKwon

Well with a speed mismatch the interface wouldn't come up.
With a duplex mismatch you'll see CRC errors but you should be able to ping a couple of times.

I would suggest checking your interface status
sh ip int bri

Also, I personally don't feel that auto-negotiation of duplex ever really works well. I would hard set it if possible since on Fast Ethernet you are going to default to half duplex if negotiation is not successful.

bslattery

ASKER

Robert,
Interface status shows ok for both interfaces

Kyle,
No errors in the log, I am configuring a spare laptop to connect to the /29 side of the router, FE1.

RobertKwon

So just to understand, when you ping the ip address of the lan side of your isp from your router you are not getting a response? It could very well be that they are filtering ICMP. But if you are unable to reach the outside network it could be a multitude of issues.

Were you able to look at your arp tables when you issued the ping?
Can you verify that you are pinging from the router or where you are pinging from?
Were you able to verify with the isp that their side has the right IP addresses configured?
If they are filtering against ICMP you can use the get command to get http data and see if that works.

Sorry from reading your original post I would recommend you confirm with your ISP that their interface is configured correctly.

RobertKwon

Also, if you need to provide proof to your isp you can set up a short acl to confirm your router is sending data out that port. Something like:

access-list 101 permit icmp any any
access-list 101 permit ip any any

interface f0
ip access-group 101 out

then do "sh access-list 101" and see if there are any hits after you try to ping. That would be proof that you are sending packets out that way since you will see the counters incrementing.

To elaborate on the get command you would do it this way.
telnet www.google.com:80 or port 80... the syntax escapes me at this moment.
get http

and you should see some recognizable text.

Note: google.com is an example not sure if they have port 80 open and allowed

bslattery

ASKER

Kyle,
I configure a laptop with .250 (/29) and connected directly to FE1. I could not ping the router @ 78.127.187.249

Robert,
I have confirmed the information not only with the provider of the /29 (Digiweb/Ireland) but also with THEIR provider who they proxy the /30 (ENET/Ireland) for. ENET confirmed the can see their interface on the fibre box is up and linked to the router.
Also, sh arp has this:
SNN-C1811#sh arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 82.148.148.22 - 0017.9523.df32 ARPA FastEthernet0
Internet 78.127.187.249 - 0017.9523.df33 ARPA FastEthernet1

kyleb84

This is a long shot, but worth a mention....

I see a "no ip gratuitous-arps" command in there, if in fact the ISP has got it wrong, and it's router is .22, your logs wouldn't show up any errors.

kyleb84

Humor me and do a no shut on Vlan1 int?

ASKER CERTIFIED SOLUTION

RobertKwon

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

bslattery

ASKER

Question, on a router are the WAN ports (FE0/FE1) by default in vlan1? If so, is the shutdown command on vlan1 an issue?

RobertKwon

I'm thinking it wouldn't be since int fe0 and 1 are routed interfaces. I believe you would have to do switchport to make it go into using vlans.

You can also check if the command is available by doing "sh int status" or "sh vlans"

I guess according to the cisco website these interfaces are switched.. but this is a bit odd, I didn't think you could assign ip addresses to switched interfaces unless you assigned it to the vlan or made it a routed port.

bslattery

ASKER

I see we were thinking the same thing. I removed the shutdown and still have the same results:

Cannot ping from laptop conntected directly to FE1 and config'd in the same /29.
Cannot ping from my 1811 to anywhere (Internet, /30 gateway, /29 laptop)

Man I suck at this!!

bslattery

ASKER

You are correct, the sh int status does not include fe0/fe1 in the vlan list

kyleb84

I agree with rob.

On the laptop, if you ping the router then immediately do a "arp -a", does the router have a MAC address assigned to it?

kyleb84

Maybe try ping the Laptop from the router and then do a "sh arp" on the router...

RobertKwon

Can you provide with a "sh int status" or "sh vlans" output.

I'm thinking if they are switched ports, that the ip on the interface isn't doing any good. But at the same time your arp output makes me believe otherwise.

I think you can get around this issue by possibly assigning the ip addresses to the vlan but then it still wouldn't work because of dot1q or ISL (tagging/framing). Your isp may need to work with you on this to tag the correct vlan on their interface which I'm not sure they would want or can even support. But still not being able to ping your interface. Can you try moving your fe1 ip address to the vlan and remove it from fe1. Also ensure that it is in no shutdown and ensure that the vlan is assigned to fe1.

bslattery

ASKER

the arp -a returns "No ARP entries found"

SOLUTION

kyleb84

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

bslattery

ASKER

From the router:
SNN-C1811#sh vlans

No Virtual LANs configured.

SNN-C1811#sh nt status
SNN-C1811#sh int status

Port Name Status Vlan Duplex Speed Type
Fa2 disabled 1 auto auto 10/100BaseTX
Fa3 disabled 1 auto auto 10/100BaseTX
Fa4 disabled 1 auto auto 10/100BaseTX
Fa5 disabled 1 auto auto 10/100BaseTX
Fa6 disabled 1 auto auto 10/100BaseTX
Fa7 disabled 1 auto auto 10/100BaseTX
Fa8 disabled 1 auto auto 10/100BaseTX
Fa9 disabled 1 auto auto 10/100BaseTX

RobertKwon

Ok I think I found your problem. According to Cisco you can not assign ip addresses and them routed ports so those ip addresses need to move to the vlan.

Can you add fe0 and fe1 to vlan 1 and then remove the ip addresses from fe0 and fe1. After that add the first ip address then add the second ip address to the vlan as a secondary and that should solve your issue. Let me know if you want exact commands.

RobertKwon

i'm hoping that when you remove the ip addresses from fe0 and fe1 they will start being in vlan 1 if not you would want to make this interface a trunk or access depending on your network layout.

RobertKwon

From Cisco's website on the product.

Q. Can the individual ports be configured as routed ports?
A. No, the Cisco EtherSwitch HWICs do not support routed ports. This means you cannot assign an IP address directly to the interface and make it a Layer 3 interface.

http://www.cisco.com/en/US/prod/collateral/routers/ps5853/prod_qas0900aecd8016c026.html

I'm guessing this is the card you have installed.

kyleb84

Rob do you agree it would be better to create 2 Vlan interfaces, assign an ip to each Vlan int, and make Fa0 an access member of one, and Fa1-6 an access member of the other?

kyleb84

Then you would have your WAN uplink as Fa0, and 6 ports ready for each device in your /29?

bslattery

ASKER

Kyle, sure as friggin s***, I had the cables switched. Now FE1 is up and I can ping it from the /29 laptop (with some seriously high times). So, color me stupid on that one. Monster kudos to you for working that out. I swear to god the jet lag is killing me!!!

However, fe0 will not come up now.

Robert, please allow me to digest your last 2 entries.

RobertKwon

I honestly don't feel that would make a difference since Vlan 1 should be native if using dot1q which is what I'm hoping. I think that would create better separation but at the same time I don't know what his/her network design is ultimately that's why I was suggesting using Vlan1 for both to speed things along. But both will work.

RobertKwon

bslattey,
I would be worried about high times depending on how high. Since that will only add on to your latency as you go through your carriers network.

kyleb84

No worries b.

Credit where it's due, Rob did suggest this in a previous post, I just made the request a bit more official :P

bslattery

ASKER

Here is my cookie cutter network layout overview used in 7 countries
Limerick-Internet-Connection-Ove.jpg

RobertKwon

Ok that's what I was imagining it to look like.. so I'm going to assume you would want trunked ports between your switch and your 1811. Looking at that lets tackle one issue at a time. I believe first would be bringing up the WAN interface fe0 since that would be easiest and then you can hash out your design woes ;).

do this command on global config mode

default int f0
"this will cause your interface to go to default"

then do int vlan 1
ip address "address of wan"
no shut

then go to exec mode and do "sh int status"
make sure fe0 is in vlan 1

let me know if this fixes your wan issue first.

bslattery

ASKER

Robert, roger that.

Also, 9 minutes(according to the logs) after switching the cables, fe0 came up, but still cannot ping anywhere from the router.

I will now perform your requested actions

RobertKwon

if not you may have to do
switchport mode access
switchport access vlan 1

I can't remember switch syntaxes to save my life..

also after that check to make sure that the interface is behaving as configured

int f0 switchport
int f0 trunk

let me know what you get.

RobertKwon

Yeah just I guess my assumption but I don't think assigning those ip addresses is doing anything for you. Honestly, I've never messed with 1811 so I don't even know where to begin assuming how that router is behaving.

bslattery

ASKER

Robert,

All comands accepted however fe0 does/will not show up in vlan1. Only fa2-fa9 appear in the vlan.

RobertKwon

can you give me output of

sh int f0 switchport
sh int f0 trunk
sh vlan

bslattery

ASKER

Here are the outputs of the 3 commands:

SNN-C1811#sh int f0 switchport
% Fa0 is not a switchable port
SNN-C1811#sh int f0 trunk

SNN-C1811#sh vlan
% Ambiguous command: "sh vlan"
SNN-C1811#sh vlan1
^
% Invalid input detected at '^' marker.

SNN-C1811#sh vlan 1
% Ambiguous command: "sh vlan 1"
SNN-C1811#show vlan 1
% Ambiguous command: "show vlan 1"
SNN-C1811#

RobertKwon

haha not fun.. its stating that the interface is not a switchport. Just to get this thing up would you mind moving the cable f0 to f2 and provide an output for

sh int f2 switchport
sh int f2 trunk
sh int status

I think getting this thing up would be more paramount and then troubleshoot the f0 issue unless you would like to work f0 all the way through.

RobertKwon

Sorry to add would you provide me with

sh run int f0
sh run int vlan1

I would like to see what's going on

bslattery

ASKER

Robert, we can work it fromthe f2 perspective first if u think that's best. I have no probs with it. Here is the outut from the commands plus a sh run int f2.

SNN-C1811#sh int f2 switchport
Name: Fa2
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Disabled
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Trunking VLANs Enabled: ALL
Trunking VLANs Active: 1
Protected: false
Priority for untagged frames: 0
Override vlan tag priority: FALSE
Voice VLAN: none
Appliance trust: none
SNN-C1811#sh int f2 trunk

Port Mode Encapsulation Status Native vlan
Fa2 off 802.1q not-trunking 1

Port Vlans allowed on trunk
Fa2 1

Port Vlans allowed and active in management domain
Fa2 1

Port Vlans in spanning tree forwarding state and not pruned
Fa2 none
SNN-C1811#sh int status

Port Name Status Vlan Duplex Speed Type
Fa2 connected 1 a-half a-100 10/100BaseTX
Fa3 disabled 1 auto auto 10/100BaseTX
Fa4 disabled 1 auto auto 10/100BaseTX
Fa5 disabled 1 auto auto 10/100BaseTX
Fa6 disabled 1 auto auto 10/100BaseTX
Fa7 disabled 1 auto auto 10/100BaseTX
Fa8 disabled 1 auto auto 10/100BaseTX
Fa9 disabled 1 auto auto 10/100BaseTX
SNN-C1811#sh run int f0
Building configuration...

Current configuration : 71 bytes
!
interface FastEthernet0
no ip address
duplex auto
speed auto
end

SNN-C1811#sh run int vlan1
Building configuration...

Current configuration : 143 bytes
!
interface Vlan1
ip address 83.147.148.22 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
ip tcp adjust-mss 1452
end

SNN-C1811#sh run int f2
Building configuration...

Current configuration : 31 bytes
!
interface FastEthernet2
end

SNN-C1811#

RobertKwon

So are you able to ping out now to the internet and ISP?

RobertKwon

Can you go to int f0 and issue command switchport.

then provide sh outputs

sh run int f0
sh int f0 switchport

bslattery

ASKER

I cannot ping either one.

bslattery

ASKER

It will not allow me issue that command:
SNN-C1811#config t
Enter configuration commands, one per line. End with CNTL/Z.
SNN-C1811(config)#int f0
SNN-C1811(config-if)#switchport
^
% Invalid input detected at '^' marker.

kyleb84

int Fa0
switchport access vlan 1
switchport mode access

int Vlan2
ip address 78.127.187.249 255.255.255.248
no ip redirects
no ip unreachables
no ip proxy-arp
duplex full
speed 100

int Fa2
switchport access vlan 2
switchport mode access

Try that :)

RobertKwon

go to interface f2 and lets force it to vlan 1

int f2
switchport mode access
switchport access vlan 1

then verify it with

sh int f2 switchport
sh run int f2

RobertKwon

That F0 port is behaving very oddly. According to docs its a switched interface but it doesn't want to be a switched interface. I'm wondering whether you may have to reload to clear that sort of like when you reload a router when you want to change a serial interface from ptp to mtp or vice versa. but that's another matter.. this is behaving weirdly since the port comes up and it says that access vlan 1 is default on fa2 but its not routing out that vlan... hmm when you do a ping can you do an extended ping to specify the source interface

so it'll be like

ping

then follow the prompts.

kyleb84

Good point,

He's got 10 ports 0 - 9 inclusive, one will be a routable FE, the other members of the switch module which are not routable.

I'd put my money on Fa0 being the routable one.

Sorry b, pleas try paste this in:

int Fa0
ip address 83.147.148.22 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
ip tcp adjust-mss 1452
!
int Vlan1
ip address 78.127.187.249 255.255.255.248
no ip redirects
no ip unreachables
no ip proxy-arp
duplex full
speed 100
!
!
int FaX
switchport mode access
switchport access vlan 1
!
end

(Where FaX is the port where your laptop is plugged in to)

RobertKwon

Kyle,
he had that before and I don't believe it was working, I was thinking the same thing that since the 1811 is classified as a router it should have a routed port.. but hopefully that works.. if not I guess back to VLANS :)

bslattery

ASKER

Robert,
Commands issued, verified. Although the sh run int f2 will not show the default vlan 1.

SNN-C1811#sh int f2 switchport
Name: Fa2
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Disabled
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Trunking VLANs Enabled: ALL
Trunking VLANs Active: 1
Protected: false
Priority for untagged frames: 0
Override vlan tag priority: FALSE
Voice VLAN: none
Appliance trust: none
SNN-C1811#sh ru int f2
Building configuration...

Current configuration : 31 bytes
!
interface FastEthernet2
end

bslattery

ASKER

SNN-C1811#ping
Protocol [ip]:
Target IP address:
% Bad IP address
SNN-C1811#ping
Protocol [ip]:
Target IP address: 4.2.2.2
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.2.2.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
SNN-C1811#

RobertKwon

Are you able to ping?

RobertKwon

can you do a sh ip route.

and try an extended ping originating the source address from your wan side.

bslattery

ASKER

Kyle,

Working on it, give me a minute

kyleb84

Ah but it does, according to Cisco.com:

1811
- 2 WAN FE Interfaces
- 8 Switch Ports

The question is which FE's are the WAN ports?

The Cisco's 851 WAN port is the last one, Fa4...

Maybe its Fa8 + Fa9 on the 1811?

Can I grace this thread with a quick test config?

default Fa0
default Fa1
default Fa2
default Fa3
!
int Vlan1
no ip address
!
int Fa9
ip address 83.147.148.22 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
duplex full
speed 100
no shut
!
ip address 78.127.187.249 255.255.255.248
no ip redirects
no ip unreachables
no ip proxy-arp
duplex full
speed 100
no shut
!

I'm gonna put money on this one.

kyleb84

Sorry b,

Put you through all this re-configs lol!

As the saying goes, to many chefs ruin the broth.

RobertKwon

Kyle,
All you. I need to get some sleep but hopefully that is the issue.. damn cisco and weird numbering if it is so :P

RobertKwon

Kyle,
All you. I need to get some sleep but hopefully that is the issue.. damn cisco and weird numbering if it is so :P

bslattery

ASKER

Kyle,

no go on your suggestion, could ping fa2 from the laptop, couldn't ping ISP or Internet

bslattery

ASKER

Fe0 and fe1 look to be the WAN ports, They are grouped together and separate from the switchports

bslattery

ASKER

Correction on earlier, could NOT ping from laptop to router

kyleb84

Looking at config guides on the net, Fa0+1 are the routable ones.

Dont waste your time with the Fa9+8 based config b.

bslattery

ASKER

working on your test config now

bslattery

ASKER

scratch that won't do the fa8 + fa9 as we agree it's fa0 and fa1

kyleb84

Looks like your original config was completely correct...

If you go back to that.

erase startup-config
(confirm)
reload

Was the issue all this time just that you has the cable the wrong way around?

RobertKwon

Last idea before I'm off to bed.

bslattery,
can you configure your laptop with the wan ip address then connect it directly to your isp and ping. So take the router out of the picture completely. See if that works to ensure they are done correctly.

bslattery

ASKER

I don't think so as I could never ping the ISP or the internet even after switching cables. I will reload that config and check again.

bslattery

ASKER

I will do that Kyle. thanks for all your help! Robert too!!

Pray for me!

bslattery

ASKER

did you want me to whack the startup config or the running config?

kyleb84

startup-config, then just paste your original in...

maybe try Rob's idea first, it'll save you some hassle if it doesn't work then....

kyleb84

Any success?

Let me know!

bslattery

ASKER

Sorry, I though you retired for the evening.

I connected a laptop directly to the fiber node and assigned the /30 ip and could not ping the other side of the ISP or the Internet.

I sent the ISP NOC an email and I am waiting for a response. I will most certainly update the thread as soon s I know anything. Based on everything we have tested, something certainly seems amiss with the ISP. until they prove otherwise, I will blame them!!!

Paranormastic

show port status -- this should give you an idea of what is plugged in, try with one cable plugged in at a time to make sure you get the port numbering straight, and links.

I also noticed that you have one port set to 100-full static - are you sure that this is correct? If it is a wan port I am wondering if it maybe should be 100 half or 10 half?

Configure 1811 Router as other end of ISP /30 network