Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.
Cisco 870 not getting the Internet
have a 870 with the following configuration that can get to the VPN but not to the Internet. I am brain dead from looking at it all day. Can someone assist? HELP!!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname Estero
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 4096
logging console critical
enable secret 5 $1$x2YZ$meRsNv4JZyUBcdW7PX
!
no aaa new-model
clock timezone PCTime -5
clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
!
crypto pki trustpoint TP-self-signed-2940161907
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certifi
revocation-check none
rsakeypair TP-self-signed-2940161907
!
!
crypto pki certificate chain TP-self-signed-2940161907
certificate self-signed 01
quit
dot11 syslog
no ip source-route
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 10.10.160.1 10.10.160.4
ip dhcp excluded-address 10.10.160.26 10.10.160.254
!
ip dhcp pool sdm-pool1
import all
network 10.10.160.0 255.255.255.0
default-router 10.10.160.1
dns-server 10.10.100.207 4.2.2.2
domain-name ********.local
netbios-name-server 10.10.100.207
!
!
no ip bootp server
ip domain name Westcodeus.local
ip name-server 10.10.100.207
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
multilink bundle-name authenticated
!
!
username ******** privilege 15 secret 5 $1$/3rY$JDVknScyoVzzkqK7st
!
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key HG45FV00HN address 146.145.35.**
!
!
crypto ipsec transform-set vpnset esp-3des esp-md5-hmac
no crypto ipsec nat-transparency udp-encaps
!
crypto map main 10 ipsec-isakmp
set peer 146.145.35.**
set transform-set vpnset
match address 100
!
archive
log config
hidekeys
!
!
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
!
bridge irb
!
!
interface ATM0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
no atm ilmi-keepalive
dsl operating-mode auto
!
interface ATM0.1 point-to-point
pvc 8/35
encapsulation aal5snap
!
bridge-group 1
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1452
bridge-group 2
!
interface BVI1
mac-address 0000.0c52.05cc
ip address 71.2.59.2 255.255.255.128
ip nat outside
ip virtual-reassembly
crypto map main
!
interface BVI2
ip address 10.10.160.1 255.255.255.0
ip tcp adjust-mss 1452
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 71.2.59.1
!
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 101 interface BVI1 overload
ip nat inside source static 10.10.160.2 71.2.59.3 route-map nonat
!
logging trap debugging
access-list 1 permit 10.10.160.0 0.0.0.255
access-list 100 permit ip 10.10.160.0 0.0.0.255 10.10.100.0 0.0.0.255
access-list 100 permit ip 10.10.160.0 0.0.0.255 10.10.200.0 0.0.0.255
access-list 100 permit ip 10.10.160.0 0.0.0.255 10.10.150.0 0.0.0.255
access-list 101 deny ip 10.10.160.0 0.0.0.255 10.10.150.0 0.0.0.255
access-list 101 deny ip 10.10.160.0 0.0.0.255 10.10.100.0 0.0.0.255
access-list 101 deny ip 10.10.160.0 0.0.0.255 10.10.200.0 0.0.0.255
access-list 101 permit ip 10.10.160.0 0.0.0.255 any
!
!
!
route-map nonat permit 10
match ip address 101
!
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
bridge 2 protocol ieee
bridge 2 route ip
banner exec
% Password expiration warning.
--------------------------
Cisco Router and Security Device Manager (SDM) is installed on this device and
it provides the default username "cisco" for one-time use. If you have already
used the username "cisco" to login to the router and your IOS image supports the
"one-time" user option, then this username has already expired. You will not be
able to login to the router with this username after you exit this session.
It is strongly suggested that you create a new username with a privilege level
of 15 using the following command.
username <myuser> privilege 15 secret 0 <mypassword>
Replace <myuser> and <mypassword> with the username and password you want to
use.
--------------------------
banner login Authorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!
!
line con 0
login local
no modem enable
transport output telnet
line aux 0
login local
transport output telnet
line vty 0 4
privilege level 15
login local
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname Estero
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 4096
logging console critical
enable secret 5 $1$x2YZ$meRsNv4JZyUBcdW7PX
!
no aaa new-model
clock timezone PCTime -5
clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
!
crypto pki trustpoint TP-self-signed-2940161907
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certifi
revocation-check none
rsakeypair TP-self-signed-2940161907
!
!
crypto pki certificate chain TP-self-signed-2940161907
certificate self-signed 01
quit
dot11 syslog
no ip source-route
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 10.10.160.1 10.10.160.4
ip dhcp excluded-address 10.10.160.26 10.10.160.254
!
ip dhcp pool sdm-pool1
import all
network 10.10.160.0 255.255.255.0
default-router 10.10.160.1
dns-server 10.10.100.207 4.2.2.2
domain-name ********.local
netbios-name-server 10.10.100.207
!
!
no ip bootp server
ip domain name Westcodeus.local
ip name-server 10.10.100.207
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
multilink bundle-name authenticated
!
!
username ******** privilege 15 secret 5 $1$/3rY$JDVknScyoVzzkqK7st
!
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key HG45FV00HN address 146.145.35.**
!
!
crypto ipsec transform-set vpnset esp-3des esp-md5-hmac
no crypto ipsec nat-transparency udp-encaps
!
crypto map main 10 ipsec-isakmp
set peer 146.145.35.**
set transform-set vpnset
match address 100
!
archive
log config
hidekeys
!
!
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
!
bridge irb
!
!
interface ATM0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
no atm ilmi-keepalive
dsl operating-mode auto
!
interface ATM0.1 point-to-point
pvc 8/35
encapsulation aal5snap
!
bridge-group 1
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1452
bridge-group 2
!
interface BVI1
mac-address 0000.0c52.05cc
ip address 71.2.59.2 255.255.255.128
ip nat outside
ip virtual-reassembly
crypto map main
!
interface BVI2
ip address 10.10.160.1 255.255.255.0
ip tcp adjust-mss 1452
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 71.2.59.1
!
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 101 interface BVI1 overload
ip nat inside source static 10.10.160.2 71.2.59.3 route-map nonat
!
logging trap debugging
access-list 1 permit 10.10.160.0 0.0.0.255
access-list 100 permit ip 10.10.160.0 0.0.0.255 10.10.100.0 0.0.0.255
access-list 100 permit ip 10.10.160.0 0.0.0.255 10.10.200.0 0.0.0.255
access-list 100 permit ip 10.10.160.0 0.0.0.255 10.10.150.0 0.0.0.255
access-list 101 deny ip 10.10.160.0 0.0.0.255 10.10.150.0 0.0.0.255
access-list 101 deny ip 10.10.160.0 0.0.0.255 10.10.100.0 0.0.0.255
access-list 101 deny ip 10.10.160.0 0.0.0.255 10.10.200.0 0.0.0.255
access-list 101 permit ip 10.10.160.0 0.0.0.255 any
!
!
!
route-map nonat permit 10
match ip address 101
!
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
bridge 2 protocol ieee
bridge 2 route ip
banner exec
% Password expiration warning.
--------------------------
Cisco Router and Security Device Manager (SDM) is installed on this device and
it provides the default username "cisco" for one-time use. If you have already
used the username "cisco" to login to the router and your IOS image supports the
"one-time" user option, then this username has already expired. You will not be
able to login to the router with this username after you exit this session.
It is strongly suggested that you create a new username with a privilege level
of 15 using the following command.
username <myuser> privilege 15 secret 0 <mypassword>
Replace <myuser> and <mypassword> with the username and password you want to
use.
--------------------------
banner login Authorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!
!
line con 0
login local
no modem enable
transport output telnet
line aux 0
login local
transport output telnet
line vty 0 4
privilege level 15
login local
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end
Asked:
4-
4
2- +1
3 Solutions
Have you tried putting ip nat outside on the bvi2 interface? Also why are you using two BVI interfaces?
<cosmicfox> I would get rid of the BVI interface if I could figure out how to remove the ip address without locking up the router. I would add the ip address 10.10.160.1 to the vlan 1 interface. If I can't get it out then i'll try the ip nat outside as you suggest.
Ya'll, I connected the console and added the inside ip to the vlan1 that effectively took out the BVI 2 and then removed the Bridge-group 2 entry in the vlan and now everything works fine.
I think the issue with me not able to remove or really modify the vlan or BVI entries was I was using putty to access the router. Using the console cable made the difference. I'll split the points with everyone if that's ok.
I think the issue with me not able to remove or really modify the vlan or BVI entries was I was using putty to access the router. Using the console cable made the difference. I'll split the points with everyone if that's ok.
Split works for me.
The issue was the fact that the BVI2 interface was missing "ip nat inside". It would have worked if you added that. But, since you moved the IP to VLAN1 which was already configured with "ip nat inside", it works. Better to remove the BVI2 anyway since it isn't necessary.
The issue was the fact that the BVI2 interface was missing "ip nat inside". It would have worked if you added that. But, since you moved the IP to VLAN1 which was already configured with "ip nat inside", it works. Better to remove the BVI2 anyway since it isn't necessary.
Ok so how do I get it split? As you can see I don't put up very many questions. I have had great success with the answers I see without asking :>)
No problem at all.
Click the "Request Attention" button at the top and instruct the moderators that you want the question re-opened so you can split points.
Click the "Request Attention" button at the top and instruct the moderators that you want the question re-opened so you can split points.
Question has a verified solution.
Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.
Have a better answer? Share it in a comment.
Join & Write a Comment Already a member? Login.
Featured Post
Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.
Tackle projects and never again get stuck behind a technical roadblock.
Join Now