topic Re: No Internet Access? in Routing and SD-WAN

No Internet Access?

keithhampshire — Mon, 13 Jan 2020 02:33:55 GMT

I have a test lab environment at home. I have one Cisco 1841 router and a Zyxel Zywall USG 20.

The Zywall connects to my ISP. The Cisco router is behind that.

The Zywall is on the 10.10.10.0/24 network (10.10.10.1)

Router setup:

-fa0/0 10.10.10.254 255.255.255.0 (directly connected to my Zywall)

-no shut

-fa0/1 10.10.11.254 255.255.255.0 (directly connected to my laptop)

-no shut

-No routing protocols are configured on this router (eigrp, rip, ospf, etc...)

Why can't I get out to the internet with my laptop directly connected to the router with static IP of 10.10.11.1/24?

Re: No Internet Access?

Georg Pauwen — Mon, 13 Jan 2020 02:53:28 GMT

Hello,

you probably need to configure NAT on your Cisco router. Add the below to your configuration:

interface FastEthernet0/0

ip nat outside

interface FastEthernet0/1

ip nat inside

ip nat inside source list 1 interface FastEthernet0/0 overload

access-list 1 permit 10.10.11.0 0.0.0.255

ip route 0.0.0.0 0.0.0.0 FastEthernet0/0

Re: No Internet Access?

paul driver — Mon, 13 Jan 2020 09:04:57 GMT

Hello

@keithhampshire wrote:

Router setup:

-fa0/0 10.10.10.254 255.255.255.0 (directly connected to my Zywall)

-no shut

-fa0/1 10.10.11.254 255.255.255.0 (directly connected to my laptop)

-no shut

Why can't I get out to the internet with my laptop directly connected to the router with static IP of 10.10.11.1/24?

Probably because the Fw isn't aware of the 10.10.11.0/24 subnet, you need to add a static route on the FW for that subnet to point towards the rtr and also add this subnet to the NAT FW rule.

Alternatively you can perform NAT on the rtr just for that subnet as stated by @Georg Pauwen

Re: No Internet Access?

paul driver — Mon, 13 Jan 2020 09:13:19 GMT

@Georg Pauwen wrote:

ip route 0.0.0.0 0.0.0.0 FastEthernet0/0

Georg - Specifying a more of a specific static route to would cut down on unnecessary arp requests
ip route 0.0.0.0 0.0.0.0 fa0/0 10.10.10.1

Re: No Internet Access?

keithhampshire — Tue, 14 Jan 2020 21:55:53 GMT

Isn't NAT for routing internal private IP address out to the internet (Public IP address)?

Why would I use NAT when I'm using private IP addresses on both sides of the router? Remember my FireWall is facing the internet and then my router is behind that.

I can ping both sides of the router 10.10.11.254/24 and 10.10.10.254/24.

I can't ping the firewall 10.10.10.1/24

Re: No Internet Access?

Richard Burts — Tue, 14 Jan 2020 22:02:47 GMT

There are at least 2 probable issues that may be causing your problem:

1) the firewall is probably not aware of the subnet where your PC is connected. It needs a route to that subnet. Or you need to configure nat so that the PC address looks like part of the subnet connecting the firewall and your router.

2) the firewall is probably not configured to perform address translation for the address of your PC. If you choose to add a route on the firewall for the subnet of your PC then you also need to add address translation for that subnet.

HTH

Rick

Re: No Internet Access?

paul driver — Tue, 14 Jan 2020 22:35:27 GMT

Hello

@keithhampshire wrote:

Isn't NAT for routing internal private IP address out to the internet (Public IP address)?

Why would I use NAT when I'm using private IP addresses on both sides of the router? Remember my FireWall is facing the internet and then my router is behind that.

No it isn't - It sounds like your FW is natting on 10.10.10.254/24 ONLY.
Regards your fw its ONLY aware of its lan facing subnet (10.10.10.254/24) which is the rtrs wan facing interface
It is most probably as i stated before unaware of that rtrs own lan facing subnet (10.10.11.254/24) So you need to do either of those 2 options suggested.

1) On the FW - add a static route to point to its lan facing interface (the rtrs wan interface) and its ip address and then append its existing nat ruling to incorporate the rtr lan subnet 10.10.11.0/24

2) On the rtr apply nat @Georg Pauwen suggested

Re: No Internet Access?

keithhampshire — Thu, 16 Jan 2020 02:31:00 GMT

Getting closer... I can almost taste it!

After adding the static route to the new subnet (10.10.11.0/24) in the Firwall, I'm able to PING the Firewall's private (internal) IP address from my laptop. I still need to setup NAT for the 10.10.11.0/24 network in the Firewall.

I've never done this before on the Zywall USG 20. I'm not sure of the terms it's asking me.

Re: No Internet Access?

Georg Pauwen — Thu, 16 Jan 2020 08:11:18 GMT

Hello,

you need to create a new object for the 10.10.11.0/24 network and select that from the drop down list:

https://support.zyxel.eu/hc/en-us/articles/360001390934-NAT-Rule-Configuration-on-a-USG-Port-Forwarding-

If you configure the NAT on the 1841, you don't need to add anything on the Zyxel except a static route to the 10.10.11.0/24 network, so that is probably the easier option.

Re: No Internet Access?

keithhampshire — Fri, 17 Jan 2020 02:27:34 GMT

I followed your NAT directions to a "T" but I'm still not able to get out to the internet.

Re: No Internet Access?

paul driver — Fri, 17 Jan 2020 07:14:22 GMT

looking at your post
try the following:

1)click on many:1 nat
2) rule name - rtr-nat

3) incoming interface = wan

4) Original/mapped ip range - need to create an object

5) create object - = name rtr1 subnet start 10.10.11.1 end ip - 10.10.11.254

6) create object - = name wan subnet start 1.1.1.1 end ip - 1.1.1.1 ( public ip address)

7) original ip range = rtr1 subnet

😎 mapped ip range = wan subnet

9) port mapping type = any
10) enable rule

Re: No Internet Access?

Georg Pauwen — Fri, 17 Jan 2020 08:02:12 GMT

Hello,

with the 1841 configured for NAT, can you ping the 10.10.11.0 network from the Zyxel ?

To be sure you configured it correctly, post the amended configuration of the 1841 again including the NAT part.

Re: No Internet Access?

keithhampshire — Sat, 18 Jan 2020 01:43:53 GMT

I can not PING the 10.10.11.0/24 (.254 or .1) network from a workstation that is on the 10.10.10.0/24 network. I can PING the FW (10.10.10.1) from a workstation that is on the 10.10.11.0/24.

Lets recap my setup in case we have some new viewers tuning in.

My setup so far:

I have a internet facing Firewall (Zywall USG 20) w/ a LAN IP of 10.10.10.1/24.
I also have a Cisco 1841 route connected to the Firewall w/ a IP 10.10.10.254/24. The other network is 10.10.11.0/24
I have a static route on the Firewall pointing to the 10.10.11.0/24 using the port that has the IP 10.10.10.254
I have NAT setup on the Cisco 1841 w/ an access list allowing the 10.10.11.0/24 to go to the 10.10.10.0/24 network

What else is there to do?

Re: No Internet Access?

Georg Pauwen — Sat, 18 Jan 2020 08:16:21 GMT

Hello,

you must be missing something basic, post the full config of the 1841 again as it is currently configured.

Re: No Internet Access?

Richard Burts — Sat, 18 Jan 2020 17:07:51 GMT

There has been some discussion about configuring the firewall to translate the addresses for network 10.10.11.0 (and to route to that network) and in some respects I consider this to be the more traditional and better solution. But there has also been discussion about configuring the 1841 to translate the 10.10.11.0 addresses and I believe that this is the approach currently being attempted by the original poster. (please correct me if I am not correct about that)

If the 1841 is correctly translating addresses for traffic originated in 10.10.11.0 using the router address in 10.10.10.0 then the firewall should not see anything from 10.10.11.0 and therefore has no need of translation or routing for that subnet. If traffic from that subnet is not working then it suggests that the address translation is not correctly configured. I agree that it would be very helpful to see the complete current running config.

HTH

Rick

Re: No Internet Access?

keithhampshire — Sun, 19 Jan 2020 15:20:21 GMT

Here is my running config on the Cisco 1841.

Also just to add a note, I can PING the WAN side of the Zywall (Public IP address) from the 10.10.11.0/24 network. I'm getting closer I just don't know what I'm missing.

R1#sh run
Building configuration...

Current configuration : 1141 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$OUBD$XFT4F6CbXxRlBO1bhKVAR0
!
no aaa new-model
!
resource policy
!
ip cef
!
!
!
!
no ip domain lookup
!
!
!
!
!
!
interface FastEthernet0/0
ip address 10.10.10.254 255.255.255.0
ip nat outside
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 10.10.11.254 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface Serial0/0/0
no ip address
shutdown
no fair-queue
!
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0
!
!
ip http server
no ip http secure-server
ip nat inside source list 1 interface FastEthernet0/0 overload
!
access-list 1 permit 10.10.11.0 0.0.0.255
!
!
!
control-plane
!
!
banner motd ^C
##########################################################

UNAUTHERIZED ACCESS TO THIS ROUTER IS PROHIBITED!!!

##########################################################
^C
!
line con 0
exec-timeout 0 0
password Password123
logging synchronous
login
line aux 0
line vty 0 4
login
!
scheduler allocate 20000 1000
end

R1#

Re: No Internet Access?

paul driver — Sun, 19 Jan 2020 15:26:46 GMT

Hello

It looks like now after adding a static route on that FW you now have reachabilty to the 10.10.11.0/24 so If your are natting on the Zywall then you dont need nat on the rtr1 so remove it let the Zywall fw to this.

You just now need to create a nat rule for that subnet 10.10.110/24 on the FW as explained before and you should be good to go.

Re: No Internet Access?

keithhampshire — Mon, 20 Jan 2020 16:20:01 GMT

I deleted this one post because I did not want it to confuse people viewing this thread. It was a duplicate post on the Route's running configurations.

Re: No Internet Access?

keithhampshire — Mon, 20 Jan 2020 13:56:53 GMT

Last time I made these settings it brought down the 10.10.10.0/24 network.

Re: No Internet Access?

paul driver — Mon, 20 Jan 2020 15:17:15 GMT

Hello

The Mapped ip subnet/range in the picture needs to be the object used for the wan public ip addressing and not the other lan subnet

I think you would already have an object created for this public ip address/range, if not then create one if so then just append that to the the Mapped ip subnet/range