router cisco ISR 4351 not connect to internet

[josecervini]

I have been trying to configure my router for several days but I have not been able to get it to log in or out of the internet. I would be very grateful if you could help me since my business depends on this router, this is my running-config:

Building configuration...

Current configuration : 2872 bytes
!
! Last configuration change at 10:15:52 UTC Tue Jun 25 2024
!
version 16.6
service timestamps debug datetime msec
service timestamps log datetime msec
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
platform hardware throughput level 400000
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
enable secret 5 xxxxxxxxxxxxx
enable password xxxxxxxx
!
no aaa new-model

!
!
subscriber templating

!
!
multilink bundle-name authenticated
passthru-domain-list jose
match lolyschicken.com
match 192.168.1.1
match cisco.com
match www.goolge.com

!
!
license udi pid ISR4351/K9 sn xxxxxxxxx
license accept end user agreement
license boot level appxk9
diagnostic bootup level minimal
spanning-tree extend system-id
service-template webauth-global-inactive
inactivity-timer 3600
service-template DEFAULT_LINKSEC_POLICY_MUST_SECURE
linksec policy must-secure
service-template DEFAULT_LINKSEC_POLICY_SHOULD_SECURE
linksec policy should-secure
service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
voice vlan
!
!
!
username xxxxx privilege 15 secret 9 xxxxxxxx
!
redundancy
mode none
!
!
!
parameter-map type webauth global
login-auth-bypass ip-access-list 100 domain-name-list jose

!
!
interface GigabitEthernet0/0/0 (wan dhcp)
ip address dhcp hostname R1
ip nat outside
ip access-group 100 out
negotiation auto
spanning-tree portfast disable
!
interface GigabitEthernet0/0/1
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip access-group 100 in
negotiation auto
no mop enabled
spanning-tree portfast disable
!
interface GigabitEthernet0/0/2
no ip address
shutdown
negotiation auto
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
no ip address
shutdown
negotiation auto
!
ip nat pool 1 192.168.1.0 192.168.1.254 netmask 255.255.255.0
ip nat inside source route-map track-primary-if interface GigabitEthernet0/0/0 overload
ip nat inside source list 1 interface GigabitEthernet0/0/0 overload
ip nat outside source list 100 pool 1
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip http secure-trustpoint CISCO_IDEVID_SUDI
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0
!
ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr
ip ssh client algorithm encryption aes128-ctr aes192-ctr aes256-ctr
!
access-list 100 permit tcp any any eq www
!
!
route-map track-primary-if permit 1
match ip address 197
set interface GigabitEthernet0/0/0
!
!
!
control-plane
!
!
line con 0
transport input none
stopbits 1
line aux 0
stopbits 1
line vty 0 4
password xxxxxxxxx
login
length 0

!
end

[josecervini]

Thank you very much for trying to help me, so that there were no problems with the configurations, I deleted everything and started from 0, I followed your advice but until now I have not been able to ping 8.8.8.8, I can ping the WAN, I leave my conf- run and interfaces

#show ip interface brief

Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0/0 68.191.34.244 YES DHCP down down
GigabitEthernet0/0/1 192.168.1.1 YES NVRAM up up
GigabitEthernet0/0/2 unassigned YES NVRAM administratively down down
GigabitEthernet0 unassigned YES NVRAM administratively down down

#show ip route

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

S* 0.0.0.0/0 is directly connected, GigabitEthernet0/0/0
68.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 68.191.34.0/23 is directly connected, GigabitEthernet0/0/0
L 68.191.34.244/32 is directly connected, GigabitEthernet0/0/0
71.0.0.0/32 is subnetted, 1 subnets
S 71.11.22.1 [254/0] via 68.191.34.1, GigabitEthernet0/0/0
192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.1.0/24 is directly connected, GigabitEthernet0/0/1
L 192.168.1.1/32 is directly connected, GigabitEthernet0/0/1

Building configuration...

Current configuration : 1993 bytes
!
! Last configuration change at 17:13:25 UTC Thu Jun 27 2024
!
version 16.6
service timestamps debug datetime msec
service timestamps log datetime msec
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
enable secret 5 xxxxxxxxxxx
enable password xxxxxxxxxxx
!
no aaa new-model

!
subscriber templating
!
!
multilink bundle-name authenticated

!
license udi pid ISR4351/K9 sn xxxxxxxxx
diagnostic bootup level minimal
spanning-tree extend system-id
!
!
!
username xxxxxxx privilege 15 secret 9 xxxxxxxxxxxxx
!
redundancy
mode none

!
interface GigabitEthernet0/0/0
ip address dhcp hostname R1
ip nat outside
negotiation auto
spanning-tree portfast disable
ip virtual-reassembly
!
interface GigabitEthernet0/0/1
ip address 192.168.1.1 255.255.255.0
ip nat inside
negotiation auto
ip virtual-reassembly
!
interface GigabitEthernet0/0/2
no ip address
shutdown
negotiation auto
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
no ip address
shutdown
negotiation auto
!
ip nat inside source list 20 interface GigabitEthernet0/0/0 overload
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip tftp source-interface GigabitEthernet0
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0
!
ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr
ip ssh client algorithm encryption aes128-ctr aes192-ctr aes256-ctr
!
access-list 20 permit 192.168.1.0 0.0.0.255
!
!
route-map track-primary-if permit 1
match ip address 197
set interface GigabitEthernet0/0/0
!

control-plane
!
!
line con 0
transport input none
stopbits 1
line aux 0
stopbits 1
line vty 0 4
password xxxxxxxxxx
login

!
end

[balaji.bandi]

Why does the interface show down down 

GigabitEthernet0/0/0 68.191.34.244 YES DHCP down down

You can use route command as below see if that make any difference.

ip route 0.0.0.0 0.0.0.0 GigabitEthernet 0/0/0 dhcp

 You did not post outcome of below :

ping 8.8.8.8

ping  68.191.34.1

Still issue, can you post when you connect other router working below output.

show run

show ip interface brief

show ip route

ping 8.8.8.8

[josecervini]

Thanks for your help, I already managed to ping from my WAN interface but now I have no ping or connection from my lan gig0/0/1, what command am I missing?

Building configuration...

Current configuration : 2558 bytes
!
! Last configuration change at 05:13:27 EST Fri Jul 5 2024
! NVRAM config last updated at 05:00:47 EST Fri Jul 5 2024
!
version 16.6
service timestamps debug datetime msec
service timestamps log datetime msec
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
enable secret 5 xxxxxxxxxxxxxxxxx
enable password xxxxxxxxxxxxxxxx
!
no aaa new-model
clock timezone EST -23 0
!

ip name-server 192.168.1.1
ip dhcp excluded-address 192.168.1.1 192.168.1.20
!
ip dhcp pool pool1
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1

!
subscriber templating
!

multilink bundle-name authenticated
passthru-domain-list jose
match www.cisco.com
match www.google.com
match 8.8.8.8
match 192.1681.1

!
license udi pid ISR4351/K9 sn xxxxxxxxxxx
diagnostic bootup level minimal
spanning-tree extend system-id
!

username xxxxxxxxxxxxxxxxxx privilege 15 secret 9 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
redundancy
mode none

!
interface GigabitEthernet0/0/0
ip address dhcp hostname R1
ip nat outside
negotiation auto
spanning-tree portfast disable
ip virtual-reassembly
!
interface GigabitEthernet0/0/1
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip access-group 20 out
negotiation auto
spanning-tree portfast disable
ip virtual-reassembly
!
interface GigabitEthernet0/0/2
no ip address
shutdown
negotiation auto
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
no ip address
shutdown
negotiation auto
!
ip nat inside source list 1 interface GigabitEthernet0/0/0 overload
ip nat inside source list 20 interface GigabitEthernet0/0/0 overload
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip tftp source-interface GigabitEthernet0
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0 dhcp
!
ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr
ip ssh client algorithm encryption aes128-ctr aes192-ctr aes256-ctr
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 20 permit 192.168.1.0 0.0.0.255
!
!
route-map track-primary-if permit 1
match ip address 197
set interface GigabitEthernet0/0/0

!
control-plane
!
!
line con 0
transport input none
stopbits 1
line aux 0
stopbits 1
line vty 0 4
password xxxxxxxxxxxxxx
login

!
end

[balaji.bandi]

As i have been mentioned all the post, until you fix the basic problem and adding more complex config not going to help you for troubleshooting, so remove the bold mentioned config.

ip routing   (add if this is not show in your config)

interface GigabitEthernet0/0/1
ip address 192.168.1.1 255.255.255.0
ip nat inside
no ip access-group 20 out
negotiation auto
spanning-tree portfast disable
ip virtual-reassembly

ip nat inside source list 1 interface GigabitEthernet0/0/0 overload
no ip nat inside source list 20 interface GigabitEthernet0/0/0 overload
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip tftp source-interface GigabitEthernet0
no ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0 dhcp
!
ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr
ip ssh client algorithm encryption aes128-ctr aes192-ctr aes256-ctr
!
access-list 1 permit 192.168.1.0 0.0.0.255
no access-list 20 permit 192.168.1.0 0.0.0.255
!
!
no route-map track-primary-if permit 1
match ip address 197
set interface GigabitEthernet0/0/0

but now I have no ping or connection from my lan gig0/0/1, what command am I missing?

what is the PC IP address, post ipconfig /all from PC.

ping 8.8.8.8

ping  68.191.34.1

ping 192.168.1.1

From router post below again :

show run

show ip route 

show ip nat translations

Still issue, can you post when you connect other router working below output.

show run

show ip interface brief

show ip route

ping 8.8.8.8

[josecervini]

I already have ping out of my lan but I'm still without internet, I did everything you asked of me and here are the photos and data:

From PC

From new router:

Building configuration...

Current configuration : 2280 bytes
!
! Last configuration change at 18:14:06 EST Sat Jul 6 2024
!
version 16.6
service timestamps debug datetime msec
service timestamps log datetime msec
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
enable secret 5 xxxxxxxxxxxxxxxxx
enable password xxxxxxxxxxxxxxxxxxxxxxxx
!
no aaa new-model
clock timezone EST -23 0

!
ip nbar http-services
!
ip name-server 192.168.1.1
ip dhcp excluded-address 192.168.1.1 192.168.1.20
!
ip dhcp pool pool1
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1

!
subscriber templating
!
!
multilink bundle-name authenticated
passthru-domain-list jose
match www.cisco.com
match www.google.com
match 8.8.8.8
match 192.1681.1

!
license udi pid ISR4351/K9 sn xxxxxxxxxxx
diagnostic bootup level minimal
spanning-tree extend system-id

!
username xxxxxxxxxx privilege 15 secret 9 xxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
redundancy
mode none

!
interface GigabitEthernet0/0/0
ip address dhcp hostname R1
ip nat outside
negotiation auto
spanning-tree portfast disable
ip virtual-reassembly
!
interface GigabitEthernet0/0/1
ip address 192.168.1.1 255.255.255.0
ip nat inside
negotiation auto
spanning-tree portfast disable
ip virtual-reassembly
!
interface GigabitEthernet0/0/2
no ip address
shutdown
negotiation auto
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
no ip address
shutdown
negotiation auto
!
ip nat inside source list 1 interface GigabitEthernet0/0/0 overload
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip tftp source-interface GigabitEthernet0
ip route 0.0.0.0 0.0.0.0 dhcp
!
ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr
ip ssh client algorithm encryption aes128-ctr aes192-ctr aes256-ctr
!
access-list 1 permit 192.168.1.0 0.0.0.255

!
control-plane
!
!
line con 0
transport input none
stopbits 1
line aux 0
stopbits 1
line vty 0 4
password xxxxxxxxxxxxxxxxx
login

!
end

S* 0.0.0.0/0 [1/0] via 68.191.34.1
68.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 68.191.34.0/23 is directly connected, GigabitEthernet0/0/0
L 68.191.34.109/32 is directly connected, GigabitEthernet0/0/0
71.0.0.0/32 is subnetted, 1 subnets
S 71.11.22.1 [254/0] via 68.191.34.1, GigabitEthernet0/0/0
192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.1.0/24 is directly connected, GigabitEthernet0/0/1
L 192.168.1.1/32 is directly connected, GigabitEthernet0/0/1

R1#show ip nat translations
Pro Inside global Inside local Outside local Outside global
udp 68.191.34.109:5157 192.168.1.25:63482 5.78.62.36:123 5.78.62.36:123
tcp 68.191.34.109:5113 192.168.1.30:41353 52.55.166.39:8282 52.55.166.39:8282
tcp 68.191.34.109:5112 192.168.1.23:33496 35.212.84.151:443 35.212.84.151:443
tcp 68.191.34.109:5134 192.168.1.56:41638 34.213.173.149:6601 34.213.173.149:6601
udp 68.191.34.109:5173 192.168.1.175:50409 142.251.111.136:443 142.251.111.136:443
udp 68.191.34.109:5159 192.168.1.175:49311 8.8.4.4:53 8.8.4.4:53
tcp 68.191.34.109:5143 192.168.1.175:26878 142.251.16.94:80 142.251.16.94:80
tcp 68.191.34.109:5065 192.168.1.23:48619 3.233.22.131:443 3.233.22.131:443
tcp 68.191.34.109:5124 192.168.1.30:52443 52.55.166.39:8282 52.55.166.39:8282

From old router:

interface GigabitEthernet0/0
description "Spectrum-internet"
ip dhcp client update dns server none
ip ddns update ccp_ddns2
ip address dhcp client-id GigabitEthernet0/0
ip nat enable
ip virtual-reassembly in
duplex full
speed 1000
!
interface GigabitEthernet0/1
description "Blackbox-switch|192.168.1.1"
ip address 192.168.1.1 255.255.255.0
ip nat enable
ip virtual-reassembly in
media-type sfp auto-failover

ip nat source list 4 interface GigabitEthernet0/0 overload
ip nat source static tcp 172.16.17.150 80 interface GigabitEthernet0/0 80
ip default-network 192.168.1.1
ip ssh time-out 50
ip ssh authentication-retries 4
ip ssh version 2
ip ssh pubkey-chain

ip access-list extended SDM_BOOTPC
remark CCP_ACL Category=0
permit udp any any eq bootpc
ip access-list extended SDM_GRE
remark CCP_ACL Category=1
permit gre any any
!
ipv6 ioam timestamp
!
!
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 172.16.16.0 0.0.15.255
access-list 1 permit 192.168.0.0 0.0.1.255
access-list 2 remark CCP_ACL Category=1
access-list 2 permit 172.16.17.150
access-list 3 remark CCP_ACL Category=1
access-list 3 permit 172.16.17.150
access-list 4 remark CCP_ACL Category=2
access-list 4 permit 172.16.16.0 0.0.15.255
access-list 4 permit 192.168.1.0 0.0.0.255
access-list 5 remark CCP_ACL Category=1
access-list 5 permit 172.16.17.150
access-list 50 permit 94.102.56.181
access-list 50 permit 185.158.249.22
access-list 100 remark CCP_ACL Category=1
access-list 100 permit ip any any
access-list 101 remark CCP_ACL Category=1
access-list 101 permit ip any any
access-list 105 remark CCP_ACL Category=1
access-list 105 permit tcp any host 172.16.17.150 eq www
access-list 115 remark CCP_ACL Category=16
access-list 115 permit tcp 0.0.0.1 255.255.255.0 0.0.1.1 255.255.240.0 eq www
access-list 120 remark CCP_ACL Category=1
access-list 120 permit ip host 127.0.0.1 host 172.16.17.150
access-list 125 remark CCP_ACL Category=1
access-list 125 permit ip host 192.168.1.1 0.0.1.150 255.255.240.0
access-list 130 remark CCP_ACL Category=2
access-list 130 permit tcp any host 172.16.17.150 eq www
access-list 135 remark CCP_ACL Category=64
access-list 135 permit tcp 0.0.0.1 255.255.255.0 eq www 0.0.1.150 255.255.240.0 eq www
!
control-plane
!

R1#show ip interface brief
Interface IP-Address OK? Method Status Protocol
Embedded-Service-Engine0/0 unassigned YES NVRAM administratively down down
GigabitEthernet0/0 24.177.246.18 YES DHCP up up
GigabitEthernet0/1 192.168.1.1 YES NVRAM up up
GigabitEthernet0/2 172.16.17.1 YES NVRAM up up
GigabitEthernet0/0/0 unassigned YES unset down down
GigabitEthernet0/0/1 unassigned YES unset administratively down down
GigabitEthernet0/0/2 unassigned YES unset administratively down down
GigabitEthernet0/0/3 unassigned YES unset administratively down down
NVI0 24.177.246.18 YES unset up up
Vlan1 unassigned YES unset administratively down down
Vlan2 192.168.12.1 YES NVRAM down down

S* 0.0.0.0/0 [254/0] via 24.177.244.1
24.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 24.177.244.0/22 is directly connected, GigabitEthernet0/0
L 24.177.246.18/32 is directly connected, GigabitEthernet0/0
71.0.0.0/32 is subnetted, 1 subnets
S 71.11.22.1 [254/0] via 24.177.244.1, GigabitEthernet0/0
172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C 172.16.16.0/20 is directly connected, GigabitEthernet0/2
L 172.16.17.1/32 is directly connected, GigabitEthernet0/2
192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.1.0/24 is directly connected, GigabitEthernet0/1
L 192.168.1.1/32 is directly connected, GigabitEthernet0/1

R1#ping 8.8.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/20/24 ms

[balaji.bandi]

On the Client Pc change the DNS to google DNS and test it.

if you like router to provide DNS add below line :

ip dhcp pool pool1
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1 

dns-server 8.8.8.8

On the PC check nslookup command check you able to resolve cisco.com or google.com and test browsing.