2800 NAT & Access Lists

[tourless27]

Hi Folks,

Hope I'm posting in the right section...

I have a 2811 router that I want to configure the F/E 0/0 & 0/1 to be able to communicate.

FE 0/0 is configured with 192.168.16.1/24

FE 0/1 is configured with 10.10.10.10/24

     Physically attached to this port is going to be a wireless router configured with 10.10.10.1.

My question is how to configure and setup the routes properly and do I need to configure NAT and Access Lists.

TIA.

[Joshua Senft]

Well there are a lot of unknown information here but I will give it a shot. First off, if no other routers are connecting to your network then just configure the default gateways properly and you should be all set. Routers always know about directly connected networks so you won't need to configure any static routes. I always configure a routing protocol on my routers because I'm always working on a larger network so I'm not sure if you need to configure a protocol to get the routing engine going but if so, configure something super easy like EIGRP. it doesn't sound lime access lists are really necessary here unless you have some requirements that I don't k ow about.

Sent from Cisco Technical Support iPhone App

[Joshua Senft]

Oh and put the wireless router in AP mode. Otherwise you will have to trunk the connection between the two and put the wireless router on a different subnet.

Sent from Cisco Technical Support iPhone App

[tourless27]

thanks for the reply...

I'll try to fill in some blanks but here's where I'm at.

I'm working with a remote 2811 and a TP-Link Wireless router.  The 2811 is configured as follows...

interface FastEthernet0/0

ip address 192.168.16.1 255.255.255.0

duplex auto

speed auto

no keepalive

!

interface FastEthernet0/1

description fdrvacctv subnet

ip address 10.10.10.10 255.255.255.0

ip access-group 1 in

duplex auto

speed auto

access-list 1 permit 192.168.1.0 0.0.0.255

  access-list 1 permit 192.168.10.0 0.0.0.255

         access-list 1 permit 192.168.11.0 0.0.0.255

         access-list 1 permit 192.168.16.0 0.0.0.255

         access-list 1 permit 192.168.17.0 0.0.0.255

         access-list 1 permit 10.10.10.0 0.0.0.255

Attached to F/E 0/1 is my wireless router via one of it's LAN ports.  The LAN side on the wireless router is set with a static IP of 10.10.10.1.

From my 2811 I can ping 10.10.10.1 or 10.10.10.5 (a pc attached to that wireless).  I can not ping 10.10.10.1 from 192.168.16.1

2811#ping 10.10.10.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.10.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 ms

#ping 10.10.10.1 source 192.168.16.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.10.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.16.1
.....
Success rate is 0 percent (0/5)
2811#

It's this scenario that leads me to belive my problem is with either a static route, access-list, or both.  Perhaps I need ot NAT something?

[tourless27]

Hoping to get a more responses here...

Please help!

[Richard Burts]

The symptoms that you describe suggest that the problem is that the wireless router does not have a default gateway configured with the 2811 address as its gateway. This would explain why you can ping (and receive responses) when in the local subnet but can not ping when the source is remote.

Check the setup of the wireless router and set its default gateway and let us know if it solves your problem with ping.

There are several interesting things about access list 1 which suggest that some changes may be needed.

- there is a line in access list 1 which permits 192.168.16.0 as a source address. But 192.168.16.0 is the network/subnet on FastEthernet0/0. How can addresses that are connected on FastEthernet0/0 going to be source addresses of packets coming in FastEthernet0/1?

- access list 1 suggests that there are multiple networks connected through FastEthernet0/1 (192.168.1.0, 192.168.10.0, 192.168.11.0, and 192.168.17.0). You have not told us (or showed parts of the configuration) whether there is any routing logic (static routes or a routing protocol) to get to those networks.

- you describe the 2811 as a remote router but have not told us whether it is connected to your network or whether it just routes locally. If it is just routing locally then the points above should be sufficient to get it to work. If it is connected to your network then there would need to be some routing logic on the 2811 about how to get to your network and some routing logic in your network about how to get to the networks/subnets on the 2811.

HTH

Rick

[tourless27]

Rick,

Thanks for chiming in here.  I created access-list 1 in my attempt to resolve my issue.  I based it off of an access-list configured on a 2851 that I have at my location.  I've completely removed access-lists 1 and 110, removed the nat and access-list statement from the interfaces and still have the same problem. The full setup is three locations, tied together thru a provider managed MPLS. 

The wireless router is a TP-Link WR941ND and I'm connecting F/E 0/1 to it via one of the LAN ports looking to use it only as an access-point.  The problem is nowhere in it's LAN configuration does it allow you to specify a default gateway.

All I'm to do is get the two interfaces to openly pass traffic back and forth between them.  I agree that there is probably some routing logic that needs to be defined here but I'm not sure what or how.  Please let me know what specific info I need or can provide in order to help facilitate this.

Thank you.

[Richard Burts · Accepted solution]

I have done some Googling on the TP-Link WR941ND and I believe that the issue is that the TP-Link WR941ND configures the default gateway on its WAN port and not on its LAN port.. I suggest that you try connecting your router to the WAN port, configure appropriate address, mask, and default gateway (making sure that the gateway configured on the WAN port is the address of your router.

Give that a try and let us know if it solves the issue of being able to ping the wireless router.

HTH

Rick

[tourless27]

Appologies for the delayed reply but being the one man band of the IT department has a tendency to spread me a little thin sometimes.

I changed the default gateway on the wireless router, keeping the connection through a LAN port, and was able to ping both the wireless router, and PC on the wireless network!  I can connect to the web GUI on the wireless router from a PC local to the 192.168.16 network, as well as, vnc to the wireless PC.  -Thank you Rick for the suggestions and guidance.

[Richard Burts]

I am glad that my response did help you to find a solution to your problem. Thank you for using the function to mark this question as answered (and thanks for the points). It helps make the forum more useful when people can read about a problem and can know that a response did lead to a solution. You have contributed to this process and it helps the forum.

HTH

Rick