Help with Cisco config.

Si. · 8 Oct 2015 at 12:57

Hi,

I thought it was about time I learnt some cisco config skills, but i'm failing at the first step.

I've got an old Cisco 867w I'm going to use as my router but I'm struggling to get it working. I have the ADSL connection working, the internal Access point, DHCP and DNS also. I can ping things vis the Dialer1 interface but no matter what I do I can't get a client on the inside to ping out.. Can anyone point me in the correct direction.

Building configuration...

Current configuration : 5963 bytes
!
! Last configuration change at 00:01:20 UTC Mon Mar 1 1993 by admin
!
version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname yourname
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
!
no aaa new-model
memory-size iomem 10
!
crypto pki trustpoint TP-self-signed-3525387451
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3525387451
revocation-check none
rsakeypair TP-self-signed-3525387451
!
!
crypto pki certificate chain TP-self-signed-3525387451
certificate self-signed 01
3082024F 308201B8 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 33353235 33383734 3531301E 170D3933 30333031 30303030
34375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 35323533
38373435 3130819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100B0F4 78611165 FA44F0FE 5EDF6B7A DB8FE15C 0E837475 E2C6AA25 62E17AAD
61A4A59B 93554614 A036C88A 30C1168F E3B54D36 8C8C18C0 FC0E5EDF 5703586A
3C18A511 0ED66427 57D9CB9D DEAF3A69 4FAB7777 467E0096 348A4CF1 E6CF5F81
FBAEF85F EEE6C6ED AA51D0AD FF02752B 0DA5938D 0136498D 9BA9BDFC 5FDF0621
ACB10203 010001A3 77307530 0F060355 1D130101 FF040530 030101FF 30220603
551D1104 1B301982 17796F75 726E616D 652E796F 7572646F 6D61696E 2E636F6D
301F0603 551D2304 18301680 14BB4155 2EAA3DA9 1A471077 7A059463 6BDC5E4C
D5301D06 03551D0E 04160414 BB41552E AA3DA91A 4710777A 0594636B DC5E4CD5
300D0609 2A864886 F70D0101 04050003 818100AA 02A512ED 3DA0FF4A 25F56B08
75FA3BCF 7E7FB44E 3F721A28 F2360805 4904A9EB 9459A504 1EFCBC09 B6E1E9E1
BA6620A3 41DBE662 9F7CC79D 47A27186 9DBBB685 756218CF 7A78B321 CDFAA834
2F3EDBB0 18D3364A EB67B8E9 88BE02BB D8E7DA02 3BE6151C A015B947 1DCD1BA2
53ED919E 9874F1BF EA6966CF 087AB39F B590B1
quit
ip source-route
!
!
ip dhcp excluded-address 10.10.10.1 10.10.10.9
ip dhcp excluded-address 10.10.10.101 10.10.10.254
!
ip dhcp pool ccp-pool
import all
network 10.10.10.0 255.255.255.0
default-router 10.10.10.1
dns-server 10.10.10.1
lease 7
!
!
ip cef
ip domain name yourdomain.com
ip name-server 8.8.8.8
!
!
!
!
interface ATM0
no ip address
ip virtual-reassembly
load-interval 30
no atm ilmi-keepalive
pvc 8/35
pppoe-client dial-pool-number 1
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface wlan-ap0
description Service module interface to manage the embedded AP
ip unnumbered Vlan1
arp timeout 0
!
interface Wlan-GigabitEthernet0
description Internal switch interface connecting to the embedded AP
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
ip address 10.10.10.1 255.255.255.0
ip tcp adjust-mss 1452
!
interface Dialer1
ip address negotiated
ip access-group INBOUND in
ip mtu 1492
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication pap callin
ppp chap hostname XXXXXXXX
ppp chap password 0 XXXXXXX
ppp pap sent-username XXXXXXXX password 0 XXXXXXXX
no cdp enable
!
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip dns server
ip nat inside source list NAT interface Dialer1 overload
ip route 0.0.0.0 0.0.0.0 Dialer1 permanent
!
ip access-list extended NAT
remark CCP_ACL Category=18
permit ip any any log
!
access-list 23 permit 10.10.10.0 0.0.0.7
no cdp run

!
control-plane
!
line con 0
login local
no modem enable
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
line vty 0 4
access-class 23 in
privilege level 15
login local
transport input telnet ssh
!
scheduler max-task-time 5000
end

GhostlyPea · 8 Oct 2015 at 13:36

You have no ip nat inside command on vlan 1. Also take off that access-group command on the dialer

- GP

Edit - sort out your service password encryption, get set up for ssh v2 on your vty lines and turn of ip source route

Si. · 9 Oct 2015 at 08:47

I've tried those suggestions and still no luck

the-evaluator · 9 Oct 2015 at 09:23

Give this a try:

int vlan 1
ip nat inside

no ip nat inside source list NAT interface Dialer1 overload

ip nat inside source list 100 interface Dialer1 overload

access-list 100 remark Match traffic for NAT
access-list 100 permit ip 10.10.10.0 0.0.0.255 any

Do you see any active NAT translations if you do 'show ip nat translation'?

GhostlyPea · 9 Oct 2015 at 17:27

Also, when connected try and ping from the router out to 8.8.8.8 and see if you get a response.You also seem to be missing your dialer protocol statement

dialer-list 1 protocol ip permit

- GP

the-evaluator · 9 Oct 2015 at 20:04

I'd be shoving some NTP config in there too - might as well have the box using the correct date and time.

Si. · 10 Oct 2015 at 03:28

the-evaluator said:
Give this a try:

int vlan 1
ip nat inside

no ip nat inside source list NAT interface Dialer1 overload

ip nat inside source list 100 interface Dialer1 overload

access-list 100 remark Match traffic for NAT
access-list 100 permit ip 10.10.10.0 0.0.0.255 any

Do you see any active NAT translations if you do 'show ip nat translation'?

Great, that seemed to fix it and I've now got connectivity out to the internet from all internal machines, even via the Wireless AP that's built into it.

My next problem.. I was using Cisco CCP to do the wireless config and monitoring (and was hoping to use it for the Firewall config) but since adding in some of those commands via SSH Cisco CCP will no longer discover the device, it comes up with a Communication or HTTP error.

the-evaluator · 10 Oct 2015 at 07:20

I've never used CCP (or any other GUI) as I do everything at the command line so I can't be of too much help but you mention CCP uses HTTP. Do you get a login prompt if you try to visit the web interface of the router from your browser?

My only suggestion for now is to check the IP address of the client you're running CCP on as the ACL for the HTTP server doesn't allow all of 10.10.10.0/24 to access it. Only 10.10.10.1 to 10.10.10.7 are allowed. I know you're using the same ACL for the vty lines but I don't know if you're accessing the config via a console cable.

If you can say what firewall the stuff you want I'm sure we can generate the config for you.