williaj2
asked on
Cisco 1811 with 2 vlans, 1 vlan cannot access wan
Have Cisco 1811 router with 2 vlans
vlan10 yourcompanynamehere
vlan20 guest
Vlan10 works with no problems
vlan20 can ping the wan (f0) address but not the wan gateway.
any ideas? oh wise ones!!
since its so late I'm maxing the points. I here a bed calling ZZZZZZZZZZZZZZZZZZZ
vlan10 yourcompanynamehere
vlan20 guest
Vlan10 works with no problems
vlan20 can ping the wan (f0) address but not the wan gateway.
any ideas? oh wise ones!!
since its so late I'm maxing the points. I here a bed calling ZZZZZZZZZZZZZZZZZZZ
version 12.3
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname MY1811
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 debugging
logging console critical
clock timezone PCTime -8
clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
aaa new-model
!
!
aaa authentication login default local
aaa authentication login ciscocp_vpn_xauth_ml_1 local
aaa authorization exec default local
aaa authorization network ciscocp_vpn_group_ml_1 local
aaa session-id common
ip subnet-zero
no ip source-route
!
!
ip cef
ip dhcp excluded-address 192.168.0.11 192.168.0.254
ip dhcp excluded-address X.X.X.150 X.X.X.254
!
ip dhcp pool younamehere
import all
network X.X.X.0 255.255.255.0
dns-server 4.2.2.1 4.2.2.2
default-router X.X.X.253
!
ip dhcp pool Guest
import all
network 192.168.0.0 255.255.255.0
dns-server 4.2.2.1 4.2.2.2
default-router 192.168.0.254
lease 0 4
!
!
ip tcp synwait-time 10
ip name-server 4.2.2.1
ip name-server 4.2.2.2
!
!
!
!
class-map match-any RESTRICTED
description Guest Vlan bandwidth control
match access-group 101
!
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp xauth timeout 15
!
crypto isakmp client configuration group VPNClient
key yea right, like i leave the real key here.
dns 4.2.2.1 4.2.2.2
pool SDM_POOL_1
acl 100
include-local-lan
netmask 255.255.255.0
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto dynamic-map SDM_DYNMAP_1 1
set transform-set ESP-3DES-SHA
reverse-route
!
!
crypto map SDM_CMAP_1 client authentication list ciscocp_vpn_xauth_ml_1
crypto map SDM_CMAP_1 isakmp authorization list ciscocp_vpn_group_ml_1
crypto map SDM_CMAP_1 client configuration address respond
crypto map SDM_CMAP_1 65535 ipsec-isakmp dynamic SDM_DYNMAP_1
!
!
!
interface FastEthernet0
description $ETH-LAN$
ip address X.X.X.26 X.X.X.X
ip mask-reply
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
ip route-cache flow
speed 100
full-duplex
no cdp enable
crypto map SDM_CMAP_1
!
interface FastEthernet3
switchport access vlan 10
no ip address
!
interface FastEthernet9
switchport access vlan 20
no ip address
random-detect
no cdp enable
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-FE 2$$ES_LAN$$FW_INSIDE$
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1452
shutdown
!
interface Vlan10
ip address X.X.X.253 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip flow egress
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1452
!
interface Vlan20
description Guest
ip address 192.168.0.254 255.255.255.0
ip flow ingress
ip flow egress
ip nat inside
ip virtual-reassembly
!
interface Async1
no ip address
!
ip local pool SDM_POOL_1 192.168.15.1 192.168.15.15
ip classless
ip route 0.0.0.0 0.0.0.0 X.X.X25
ip route X.X.X.X 255.255.255.0 X.X.X.238
!
!
ip http server
ip http authentication local
ip http secure-server
ip nat inside source static tcp X.X.X.221 59002 interface FastEthernet0 59002
ip nat inside source route-map SDM_RMAP_1 interface FastEthernet0 overload
!
logging trap debugging
access-list 1 remark CCP_ACL Category=16
access-list 1 permit 10.0.0.0 0.255.255.255
access-list 2 permit 192.0.0.0 0.255.255.255
access-list 100 remark CCP_ACL Category=4
access-list 100 permit ip 10.0.0.0 0.255.255.255 any
access-list 101 permit tcp any host X.X.X.221 eq 59002
access-list 101 permit ip any any
access-list 102 remark CCP_ACL Category=2
access-list 102 deny ip 10.0.0.0 0.255.255.255 host 192.168.15.1
access-list 102 deny ip 10.0.0.0 0.255.255.255 host 192.168.15.2
access-list 102 deny ip 10.0.0.0 0.255.255.255 host 192.168.15.3
access-list 102 deny ip 10.0.0.0 0.255.255.255 host 192.168.15.4
access-list 102 deny ip 10.0.0.0 0.255.255.255 host 192.168.15.5
access-list 102 deny ip 10.0.0.0 0.255.255.255 host 192.168.15.6
access-list 102 deny ip 10.0.0.0 0.255.255.255 host 192.168.15.7
access-list 102 deny ip 10.0.0.0 0.255.255.255 host 192.168.15.8
access-list 102 deny ip 10.0.0.0 0.255.255.255 host 192.168.15.9
access-list 102 deny ip 10.0.0.0 0.255.255.255 host 192.168.15.10
access-list 102 deny ip 10.0.0.0 0.255.255.255 host 192.168.15.11
access-list 102 deny ip 10.0.0.0 0.255.255.255 host 192.168.15.12
access-list 102 deny ip 10.0.0.0 0.255.255.255 host 192.168.15.13
access-list 102 deny ip 10.0.0.0 0.255.255.255 host 192.168.15.14
access-list 102 deny ip 10.0.0.0 0.255.255.255 host 192.168.15.15
access-list 102 permit ip 10.0.0.0 0.255.255.255 any
!
route-map SDM_RMAP_1 permit 1
match ip address 102
!
!
!
!
control-plane
!
What is the network address of vlan 20? 192.168.0.x or 192.168.15.x?
ASKER
192.168.0.0 is the guest vlan
192.168.15.0 is the vpn
192.168.15.0 is the vpn
ASKER
with a 10.X.X.X as vlan 10
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
YAWN!!!! ZZZZZZZZZZ!!!! Everybody must be asleep?!?
You need add the following as Kristofa mentioned:
ip access-list extended 102
permit ip 192.168.0.0 0.255.255.255 any
ip access-list extended 102
permit ip 192.168.0.0 0.255.255.255 any
You need add the following as Kristofa mentioned:
ip access-list extended 102
5 permit ip 192.168.0.0 0.255.255.255 any
ip access-list extended 102
5 permit ip 192.168.0.0 0.255.255.255 any
ikalmar: You keep repeating what I already recommended. I see this as an recurring approach from you.
/Kvistofta
/Kvistofta
Kvistofta: yep, i've missed that the last line is permit not deny....:)
but permit ip 192.168.0.0 0.0.0.255 any is enough
ASKER
YOU THE MAN.
Must be late for me to miss that one.
Now I can catch some ZZZZZZ!!!!
Thanks!!!
Must be late for me to miss that one.
Now I can catch some ZZZZZZ!!!!
Thanks!!!
ASKER
The Best!!!!!