Re: Problems using telnet from Console 0

dmunyak · ‎08-11-2004

I am having telnet issue. I CAN connect to the router either from con 0 or a telnet session. However, I cannot copy the running-config of the router to my pc on the lan using tftp. This started after I enabled aaa. I have tried several attempts at modifying Line vty 04...with no success.

I am basically trying to copy run tftp from a console connection to a tftp service on my workstation. It was working in the past, bu I have ben trying to gradually increase access security to the router. Now I can access the router, but I can't offload anything for backup.

Need some help please.

Router#telnet 192.168.222.61

Trying 192.168.222.61 ...

% Connection refused by remote host

Router#copy run tftp

Address or name of remote host []? 192.168.222.61

Destination filename [router-confg]?

.....

%Error opening tftp://192.168.222.61/router-confg (Timed out)

Router#

Router#sho run

Building configuration...

Current configuration : 5080 bytes

!

version 12.2

service nagle

no service pad

service tcp-keepalives-in

service tcp-keepalives-out

service timestamps debug uptime

service timestamps log uptime

service password-encryption

no service dhcp

!

hostname Router

!

no logging buffered

logging console critical

aaa new-model

aaa authentication login default local

enable secret 5 XXXXXXXXXXXXXX.

!

username donmunyak password 7 XXXXXXXXXXXXXX

memory-size iomem 25

clock timezone est -5

clock summer-time edt recurring

ip subnet-zero

no ip source-route

ip tcp synwait-time 10

no ip domain-lookup

!

no ip bootp server

ip audit attack action alarm drop reset

ip audit notify log

ip audit po max-events 100

ip audit smtp spam 25

ip audit name SYSLOG.1 info list 99 action alarm

ip audit name SYSLOG.1 attack action alarm drop reset

ip reflexive-list timeout 120

!

interface FastEthernet0

ip address 192.168.222.1 255.255.255.0 secondary

ip address XX.XX.155.33 255.255.255.240

no ip redirects

no ip unreachables

no ip proxy-arp

ip nat inside

ip audit SYSLOG.1 in

speed auto

no cdp enable

!

interface Serial0

no ip address

encapsulation frame-relay IETF

no fair-queue

frame-relay lmi-type ansi

!

interface Serial0.744 point-to-point

ip address XX.XX.154.230 255.255.255.252

ip access-group inboundfilters in

ip access-group outboundfilters out

no ip redirects

no ip unreachables

no ip proxy-arp

ip nat outside

no cdp enable

frame-relay interface-dlci 744 IETF

!

no ip nat service H225

ip nat pool net-192 XX.XX.155.44 XX.XX.155.44 netmask 255.255.255.240

ip nat inside source list 1 pool net-192 overload

!

! [removed entries]

!

ip classless

ip route 0.0.0.0 0.0.0.0 XX.XX.154.229

no ip http server

!

ip access-list extended inboundfilters

deny tcp any any eq 445

!

! [removed entries]

!

permit udp any any eq domain

permit tcp any any eq domain

permit tcp any any eq 1723

permit udp any any eq isakmp

permit ahp any any

permit esp any any

permit gre any any

evaluate tcptraffic

evaluate udptraffic

evaluate icmptraffic

deny tcp any any log

deny udp any any log

deny icmp any any log

ip access-list extended outboundfilters

permit tcp any any reflect tcptraffic

permit udp any any reflect udptraffic

permit icmp any any reflect icmptraffic

permit tcp any any eq ftp

permit tcp any any eq 1723

permit udp any any eq isakmp

permit esp any any

permit gre any any

!

logging trap debugging

logging source-interface FastEthernet0

logging 192.168.222.61

access-list 1 permit 192.168.222.0 0.0.0.255

access-list 2 permit 192.168.222.0 0.0.0.255 log

no cdp run

!

banner motd ^C

This system is for the use of authorized users only.

^C

!

line con 0

access-class 2 in

access-class 2 out

password 7 XXXXXXXXXXXXXX

transport output telnet

!

line aux 0

password 7 XXXXXXXXXXXXXX

!

line vty 0 4

access-class 2 in

access-class 2 out

exec-timeout 5 0

password 7 XXXXXXXXXXXXXX

transport input telnet

transport output telnet

!

no scheduler allocate

scheduler interval 500

sntp server 129.6.15.29

sntp server 129.6.15.28

end

spremkumar · ‎08-11-2004

Hi

Since ur able to telne from u r local lan hope ur also able to do the same from the tftp server.

try to remove that ip audit SYSLOG.1 in from u r ethernet port for time being and chek whether ur stil facing the same problem.

do chek the tftp server logs also and find whether tftp request is comign to the server or not..

theres nothing to do with AAA config since u r AAA config is local significance and not contacting any RAdius or TACACS server to have any restriction on the access..

regds

prem

rwawrig · ‎08-12-2004

ip address 192.168.222.1 255.255.255.0 secondary

What i think is that the packets are going to the tftp server, but don't know to come back, because the source address is the primary address ( XX.XX.155.33 255.255.255.240).

Try to change for few seconds: remove the XX.XX.155.33 255.255.255.240 address and make the 192.168.222.1 primary address and it will work.

Or don't change anything and add the route in the tftp server, that this should know the 192.168.222.1 ip is reached through XX.XX.155.33 ip. (the tftp server need this).

cheers

Richard Burts · ‎08-12-2004

The title of your question indicates problem with telnet. But your question seems to be saying that telnet is fine and the problem is tftp. Which is it?

Your post suggests that you think that the problem started when you configured aaa. I do not see anything in the aaa configuration that would impact tftp.

I think that Robert may be on the right track. The tftp packet from the router will have a source address of the primary interface address. Does the tftp server know how to reach that address?

Your post included an attempt to telnet to the server. I am not sure what that was supposed to proove but I assume it was intended as a test of accessability. I would suggest that a better test would be for the router to ping the server address. If ping is successful then you have a path to the server and the server has a path back to you.

One other possibility occurs to me. Is it possible that the tftp service has stopped on the server for some reason? When the router attempt to tftp fails, can some other device successfully tftp?

HTH

Rick

HTH

Rick

rwawrig · ‎08-12-2004

Is a little missunderstanding here: the title of the question is wrong. And also "I am having telnet issue" thing is wrong. It is like this: our guy can connect to cisco. From the cisco he was able to save the running-config in a tftp server, but not anymore. He tried to telnet from cisco to tftp server box, he tried also to use the tftp to transfer files from cisco to tftp box. He didn't tried to ping (the basic tool to see if the other side is reachable), but what i think is that also the ping from cisco to the tftp box will fail. What will not fail will be the ping from TFTP server to cisco. The idea is that when the packets are going from cisco to any equipment in the 192.168.222.0 network, will not find the path back, if the equipment is not informed that the source ip (XX.XX.155.33) is reached through 192.168.222.1

(This can be done with the default GW=192.168.222.1)

Another thing. The tftp should work if the default GW on the tftp server is the secondary ip of cisco: 192.168.222.1. In this way - the packets don't know how to go back to the primary IP, and will be sent to the secondary 🙂

dmunyak · ‎08-12-2004

Clarification to my issue.

Network setup:

The 1720 router is a office gateway router. It's the only router.

It is physically mounted in my office.

e0 has two interfaces. One public, One private (192.168.222.1)

My workstation is 192.168.222.61

My workstion has a serial cable to the console port, Con 0

My workstation also has a tftp server application running (solarwinds tftp)

I have added a range of IP's to both transmit and receive, to include public and private LAN.

I have another workstion in my office

I can telnet into the router from this workstation.

I have also installed a second tftp server on this workstation.

I can ping this workstation from the console session from my workstation.

From the console session on my workstation I cannot send the running-config to either tftp server.

From a telnet session running on my workstation I cannot send the running-config to either tftp server.

From a telnet session running on the other workstation I cannot send the running-config to either tftp server.

I can telnet in from any workstation on the LAN

I can make changes to the running-config from any workstation on the LAN, via telnet

When trying to run router# copy run tftp ,The connection times out.

The tftp server is running on my workstation (solarwinds)

The default GW for the LAN is 192.168.222.1 (the router)

The results below occur from either a console or telnet session.

1720#copy run tftp

Address or name of remote host []? 192.168.222.61

Destination filename [1720-confg]?

.....

%Error opening tftp://192.168.222.61/1720-confg (Timed out)

I can ping my workstation from the console session

1720#ping 192.168.222.61

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.222.61, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

1720#

dmunyak · ‎08-12-2004

As a follow-up...

tftp is working on my workstation. From another workstation, I transfered a file from my workstion to the other workstation.

Using ethereal, I captured packets during a console session into the router. ICMP echo/echo-replies were caputured where the router was using the public IP xx.xx.155.33 and the destination was my IP 192.168.222.61

From my workstation I pinged the GW IP 192.168.222.1 with no problem...packets were captured appropiately.

When I tried to "copy run tftp" from a console session, the command timed out and no packets were captured for this process.

I am still very confused.

Thanks for all the suggestions so far.

rwawrig · ‎08-13-2004

Do u have a firewall enabled on your pc ?

You said u transfered a file from your workstion to another workstation. Did you tried to transfer a file from another equipment to your pc by tftp? Is not working only when u try from cisco, or is not working at all, no matter from where u are trying?

Richard Burts · ‎08-13-2004

Your clarification is quite helpful. It shows that it is not a problem with IP connectivity or difficulty with the secondary address, since the ping was successful and you say that you can telnet from your workstation to the router.

Also the fact that you could tftp from another workstation answers one of my previous questions about whether the tftp service might somehow gotten stopped. Obviously it is running.

Doing the packet capture was good. I am puzzled at the fact that you say that when you attempted to tftp that no packets were captured.

I would suggest that you turn on debug tftp packet and also debug tftp event. Make another attempt to tftp and post the results. (If you have telnetted be sure to do term monitor before you attempt the tftp.)

HTH

Rick

HTH

Rick

dmunyak · ‎08-13-2004

Can't get to this today. Remote site visit required. I will post results either over the weeken or on Monaday.

Thanks