Solved

Cisco 870 not getting the Internet

Posted on 2009-03-31
12
1,157 Views
Last Modified: 2012-05-06
have a 870 with the following configuration that can get to the VPN but not to the Internet. I am brain dead from looking at it all day. Can someone assist? HELP!!


version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname Estero
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 4096
logging console critical
enable secret 5 $1$x2YZ$meRsNv4JZyUBcdW7PXyWj1
!
no aaa new-model
clock timezone PCTime -5
clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
!
crypto pki trustpoint TP-self-signed-2940161907
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2940161907
revocation-check none
rsakeypair TP-self-signed-2940161907
!
!
crypto pki certificate chain TP-self-signed-2940161907
certificate self-signed 01
quit
dot11 syslog
no ip source-route
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 10.10.160.1 10.10.160.4
ip dhcp excluded-address 10.10.160.26 10.10.160.254
!
ip dhcp pool sdm-pool1
import all
network 10.10.160.0 255.255.255.0
default-router 10.10.160.1
dns-server 10.10.100.207 4.2.2.2
domain-name ********.local
netbios-name-server 10.10.100.207
!
!
no ip bootp server
ip domain name Westcodeus.local
ip name-server 10.10.100.207
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
multilink bundle-name authenticated
!
!
username ******** privilege 15 secret 5 $1$/3rY$JDVknScyoVzzkqK7stdYV0
!
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key HG45FV00HN address 146.145.35.**
!
!
crypto ipsec transform-set vpnset esp-3des esp-md5-hmac
no crypto ipsec nat-transparency udp-encaps
!
crypto map main 10 ipsec-isakmp
set peer 146.145.35.**
set transform-set vpnset
match address 100
!
archive
log config
hidekeys
!
!
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
!
bridge irb
!
!
interface ATM0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
no atm ilmi-keepalive
dsl operating-mode auto
!
interface ATM0.1 point-to-point
pvc 8/35
encapsulation aal5snap
!
bridge-group 1
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1452
bridge-group 2
!
interface BVI1
mac-address 0000.0c52.05cc
ip address 71.2.59.2 255.255.255.128
ip nat outside
ip virtual-reassembly
crypto map main
!
interface BVI2
ip address 10.10.160.1 255.255.255.0
ip tcp adjust-mss 1452
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 71.2.59.1
!
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 101 interface BVI1 overload
ip nat inside source static 10.10.160.2 71.2.59.3 route-map nonat
!
logging trap debugging
access-list 1 permit 10.10.160.0 0.0.0.255
access-list 100 permit ip 10.10.160.0 0.0.0.255 10.10.100.0 0.0.0.255
access-list 100 permit ip 10.10.160.0 0.0.0.255 10.10.200.0 0.0.0.255
access-list 100 permit ip 10.10.160.0 0.0.0.255 10.10.150.0 0.0.0.255
access-list 101 deny ip 10.10.160.0 0.0.0.255 10.10.150.0 0.0.0.255
access-list 101 deny ip 10.10.160.0 0.0.0.255 10.10.100.0 0.0.0.255
access-list 101 deny ip 10.10.160.0 0.0.0.255 10.10.200.0 0.0.0.255
access-list 101 permit ip 10.10.160.0 0.0.0.255 any
!
!
!
route-map nonat permit 10
match ip address 101
!
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
bridge 2 protocol ieee
bridge 2 route ip
banner exec 
% Password expiration warning.
-----------------------------------------------------------------------
Cisco Router and Security Device Manager (SDM) is installed on this device and
it provides the default username "cisco" for one-time use. If you have already
used the username "cisco" to login to the router and your IOS image supports the
"one-time" user option, then this username has already expired. You will not be
able to login to the router with this username after you exit this session.
It is strongly suggested that you create a new username with a privilege level
of 15 using the following command.
username <myuser> privilege 15 secret 0 <mypassword>
Replace <myuser> and <mypassword> with the username and password you want to
use.
-----------------------------------------------------------------------
banner login Authorized access only!

Disconnect IMMEDIATELY if you are not an authorized user!
!
line con 0
login local
no modem enable
transport output telnet
line aux 0
login local
transport output telnet
line vty 0 4
privilege level 15
login local
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end
0
Comment
Question by:wellsjs
  • 4
  • 4
  • 2
  • +1
12 Comments
 
LVL 5

Assisted Solution

by:Melaleuca
Melaleuca earned 125 total points
ID: 24035680
I don't see a that ip routing is enabled. type ip routing in config mode.
0
 

Author Comment

by:wellsjs
ID: 24035751
Thanks for responding, but that didn't work.
0
 
LVL 6

Assisted Solution

by:cosmicfox
cosmicfox earned 125 total points
ID: 24035794
Have you tried putting ip nat outside on the bvi2 interface? Also why are you using two BVI interfaces?
0
 

Author Comment

by:wellsjs
ID: 24035824
<cosmicfox> I would get rid of the BVI interface if I could figure out how to remove the ip address without locking up the router.  I would add the ip address 10.10.160.1 to the vlan 1 interface.  If I can't get it out then i'll try the ip nat outside as you suggest.
0
 
LVL 43

Accepted Solution

by:
JFrederick29 earned 250 total points
ID: 24038102
The BVI2 interface is missing "ip nat inside".

Add this:

conf t
int bvi2
ip nat inside
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 

Author Comment

by:wellsjs
ID: 24038149
Ya'll, I connected the console and added the inside ip to the vlan1 that effectively took out the BVI 2 and then removed the Bridge-group 2 entry in the vlan and now everything works fine.
I think the issue with me not able to remove or really modify the vlan or BVI entries was I was using putty to access the router. Using the console cable made the difference. I'll split the points with everyone if that's ok.
0
 
LVL 43

Expert Comment

by:JFrederick29
ID: 24038166
Split works for me.

The issue was the fact that the BVI2 interface was missing "ip nat inside".  It would have worked if you added that.  But, since you moved the IP to VLAN1 which was already configured with "ip nat inside", it works.  Better to remove the BVI2 anyway since it isn't necessary.
0
 
LVL 43

Expert Comment

by:JFrederick29
ID: 24038250
Oops, looks like you didn't split.  I'll have it re-opened so you can split points if you want.
0
 

Author Comment

by:wellsjs
ID: 24038302
Ok so how do I get it split? As you can see I don't put up very many questions. I have had great success with the answers I see without asking :>)
0
 
LVL 43

Expert Comment

by:JFrederick29
ID: 24038319
No problem at all.

Click the "Request Attention" button at the top and instruct the moderators that you want the question re-opened so you can split points.
0
 
LVL 6

Expert Comment

by:cosmicfox
ID: 24039175
Sorry for my mistype on my last post, it should of been ip nat inside. good thing Jfrederick29 is here to catch my mistakes. I would say a split is valid.
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

I have seen some questions on problems with SSH/telnet access to Cisco routers that may occur despite the fact that from a PC connected to your LAN, Internet connectivity is in place and users can access Internet sites without any issues.  There are…
We've been using the Cisco/Linksys RV042 for years as: - an internet Gateway - a site-to-site VPN device - a leased line site-to-site subnet-to-subnet interface (And, here I'm assuming that any RV0xx behaves the same way as an RV042.  So that's …
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now