2911 will not connect to the internet

[NickLeone]

so i am i bit stumped, the router is pulling a dhcp lease from the cable modem, and the pc is getting an ip from the router, but np internet.
!
hostname NSW-GR1
!
boot-start-marker
boot-end-marker
!
logging count
logging buffered 8192 debugging
logging rate-limit 5
!
memory-size iomem 10
clock timezone EST -5
clock summer-time EDT recurring
no aaa new-model
ip subnet-zero
ip cef
!
!
ip domain name NSW
ip dhcp excluded-address 192.168.20.1 192.168.20.99
ip dhcp excluded-address 192.168.20.110 192.168.20.255
ip dhcp excluded-address 192.168.30.1 192.168.30.99
ip dhcp excluded-address 192.168.30.110 192.168.30.255
!
ip dhcp pool voice
import all
network 192.168.20.0 255.255.255.0
default-router 192.168.20.254
!
ip dhcp pool data
import all
network 192.168.30.0 255.255.255.0
default-router 192.168.30.254
!
ip reflexive-list timeout 60
!
!
!
!
!
!
username XXXX privilege 15 password 0 XXXX
!
!
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
!
!
!
interface Loopback999
ip address 1.1.1.1 255.255.255.255
!
interface GigabitEthernet0/0
ip address dhcp
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
speed auto
duplex auto
!
interface GigabitEthernet0/1
no ip address
speed auto
duplex auto
!
interface GigabitEthernet0/1.10
description MGMT
encapsulation dot1Q 10
ip address 192.168.10.254 255.255.255.0
ip nat inside
!
interface GigabitEthernet0/1.20
description Voice
encapsulation dot1Q 20
ip address 192.168.20.254 255.255.255.0
ip nat inside
!
interface GigabitEthernet0/1.30
description Data
encapsulation dot1Q 30
ip address 192.168.30.254 255.255.255.0
ip nat inside
!
ip nat inside source list 100 interface GigabitEthernet0/0 overload
ip nat inside source static udp 192.168.30.111 8767 interface GigabitEthernet0/0 8767
ip nat inside source static udp 192.168.30.111 34297 interface GigabitEthernet0/0 34297
ip nat inside source static udp 192.168.30.111 34298 interface GigabitEthernet0/0 34298
ip nat inside source static tcp 192.168.30.111 34347 interface GigabitEthernet0/0 34347
ip nat inside source static tcp 192.168.30.111 51234 interface GigabitEthernet0/0 51234
no ip http server
no ip http secure-server
ip classless
!
!
access-list 100 permit ip 192.168.20.0 0.0.0.255 any
access-list 100 permit ip 192.168.30.0 0.0.0.255 any
access-list 100 permit ip 192.168.10.0 0.0.0.255 any
!
!
!
!
!
!
line con 0
line aux 0
modem InOut
transport input all
transport output all
line vty 0 4
login local
transport input all
!
ntp clock-period 17180789
ntp server 129.6.15.28
!

[balaji.bandi]

Try below changes bold and test (let us know the outcome)  - I do not see any DHCP pool for 192.168.10.X?

ip dhcp pool voice
import all
network 192.168.20.0 255.255.255.0
default-router 192.168.20.254
dns-server 8.8.8.8
!
ip dhcp pool data
import all
network 192.168.30.0 255.255.255.0
default-router 192.168.30.254
dns-server 8.8.8.8

!

interface Loopback999                <-----not sure you need Loopback here
ip address 1.1.1.1 255.255.255.255
shutdown

!

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 dhcp
!

[NickLeone]

tried the above entries, still no internet to the pc.

I can ping internet sites (yahoo.com) from the router, but keep getting no dns server/dns server cannot be reached in the browser on the pc.

[Richard Burts]

The comment about messages that the dns server can not be reached are interesting. Does this suggest that if you attempt access using IP address rather than name that the pc might be able to access the Internet? 

I note that your dhcp pools do not specify any dns server. I would suggest that you add entry to each pool specifying a dns server.

I would also make a comment about your nat configuration. You are using an extended access list but specifying only source addresses (no protocols, no destinations). I have seen some issues when nat used extended access lists with any as the destination. I suggest that you rewrite your nat to use a standard acl rather than extended. 

[NickLeone]

i did add dns-server 8.8.8.8 to the dhcp pools as BB suggested.
are you saying to add/change to the ISP's dns?

NSW-R1#show dhcp server
DHCP server: ANY (255.255.255.255)
Leases: 6
Offers: 1 Requests: 6 Acks: 6 Naks: 0
Declines: 0 Releases: 0 Bad: 0
DNS0: 71.10.216.1, DNS1: 71.10.216.2  - to 1 of these?
Subnet: 255.255.248.0

[Richard Burts]

I think it is much less important which DNS server you specify and more important that you specify some valid DNS server. 8.8.8.8 is the very well known dns server but an ISP server would be just fine.

If you have made the change and the dhcp pools do now include specification of a dns server did the behavior change? Can a pc now access Internet resources using names? If so then it sounds like problem solved. If not then can a pc access Internet resources using IP addresses? If not then we need more investigation about how pc is working and more information about the router.

[balaji.bandi]

Ok Hope this device connected to Switch (post the switch configuration also to look)

a suggestion is simple changes 1 at a time will give better results than change the major configuration change.

From the end device PC - Can you post below output

ipconfig /all

nslookup cisco.com

tracert 8.8.8.8

tracert cisco.com

[Georg Pauwen]

Hello,

drop the 'import all' from the DHCP pool. The config should look like below (important parts marked in bold):

hostname NSW-GR1
!
boot-start-marker
boot-end-marker
!
logging count
logging buffered 8192 debugging
logging rate-limit 5
!
memory-size iomem 10
clock timezone EST -5
clock summer-time EDT recurring
no aaa new-model
ip subnet-zero
ip cef
!
ip domain name NSW
ip dhcp excluded-address 192.168.20.1 192.168.20.99
ip dhcp excluded-address 192.168.20.110 192.168.20.255
ip dhcp excluded-address 192.168.30.1 192.168.30.99
ip dhcp excluded-address 192.168.30.110 192.168.30.255
!
ip dhcp pool voice
network 192.168.20.0 255.255.255.0
default-router 192.168.20.254
dns-server 8.8.8.8 8.8.4.4
!
ip dhcp pool data
network 192.168.30.0 255.255.255.0
default-router 192.168.30.254
dns-server 8.8.8.8 8.8.4.4
!
ip reflexive-list timeout 60
!
username XXXX privilege 15 password 0 XXXX
!
ip ssh time-out 60
ip ssh authentication-retries 2
!
interface Loopback999
ip address 1.1.1.1 255.255.255.255
!
interface GigabitEthernet0/0
ip address dhcp
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
speed auto
duplex auto
!
interface GigabitEthernet0/1
no ip address
speed auto
duplex auto
!
interface GigabitEthernet0/1.10
description MGMT
encapsulation dot1Q 10
ip address 192.168.10.254 255.255.255.0
ip nat inside
!
interface GigabitEthernet0/1.20
description Voice
encapsulation dot1Q 20
ip address 192.168.20.254 255.255.255.0
ip nat inside
!
interface GigabitEthernet0/1.30
description Data
encapsulation dot1Q 30
ip address 192.168.30.254 255.255.255.0
ip nat inside
!
ip nat inside source list 1 interface GigabitEthernet0/0 overload
ip nat inside source static udp 192.168.30.111 8767 interface GigabitEthernet0/0 8767
ip nat inside source static udp 192.168.30.111 34297 interface GigabitEthernet0/0 34297
ip nat inside source static udp 192.168.30.111 34298 interface GigabitEthernet0/0 34298
ip nat inside source static tcp 192.168.30.111 34347 interface GigabitEthernet0/0 34347
ip nat inside source static tcp 192.168.30.111 51234 interface GigabitEthernet0/0 51234
no ip http server
no ip http secure-server
ip classless

!
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 dhcp
!
access-list 1 permit 192.168.10.0 0.0.0.255
access-list 1 permit 192.168.20.0 0.0.0.255
access-list 1 permit 192.168.30.0 0.0.0.255
!
line con 0
line aux 0
modem InOut
transport input all
transport output all
line vty 0 4
login local
transport input all
!
ntp clock-period 17180789
ntp server 129.6.15.28

[NickLeone]

Changed the config as George stated above, still no internet on the pc, I did try with ip address, and also could not connect.
|this is the config now;

!
hostname NSW-GR1
!
boot-start-marker
boot-end-marker
!
!
logging count
logging rate-limit 5
enable secret 5 $1$DG8t$5tvUvadY9KaRklmLjtjbj0
enable password xxxx
!
no aaa new-model
memory-size iomem 10
clock timezone EST -5 0
clock summer-time EDT recurring
!
no ipv6 cef
ip source-route
no ip routing
no ip cef
!
!
!
ip dhcp excluded-address 192.168.20.1 192.168.20.99
ip dhcp excluded-address 192.168.20.110 192.168.20.255
ip dhcp excluded-address 192.168.30.1 192.168.30.99
ip dhcp excluded-address 192.168.30.110 192.168.30.255
!
ip dhcp pool voice
import all
network 192.168.20.0 255.255.255.0
default-router 192.168.20.254
dns-server 8.8.8.8 8.8.4.4
!
ip dhcp pool data
import all
network 192.168.30.0 255.255.255.0
default-router 192.168.30.254
dns-server 8.8.8.8 8.8.4.4
!
ip dhcp pool MGMT
network 192.168.10.0 255.255.255.0
default-router 192.168.20.254
dns-server 8.8.8.8 8.8.4.4
!
!
ip domain name NSW
ip reflexive-list timeout 60
multilink bundle-name authenticated
!
!
!
!
!
crypto pki token default removal timeout 0
!
!
voice-card 0
!
!
!
!
!
!
!
license udi pid CISCO2911/K9 sn FTX1745A03X
hw-module pvdm 0/0
!
!
!
username xxxx privilege 15 password 0 xxxx
!
redundancy
!
!
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
!
!
interface Loopback999
ip address 1.1.1.1 255.255.255.255
shutdown
!
interface Embedded-Service-Engine0/0
no ip address
no ip route-cache
shutdown
!
interface GigabitEthernet0/0
ip address dhcp
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly in
no ip route-cache
duplex auto
speed auto
!
interface GigabitEthernet0/1
no ip address
no ip route-cache
duplex auto
speed auto
!
interface GigabitEthernet0/1.10
description MGMT
encapsulation dot1Q 10
ip address 192.168.10.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
no ip route-cache
!
interface GigabitEthernet0/1.20
description Voice
encapsulation dot1Q 20
ip address 192.168.20.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
no ip route-cache
!
interface GigabitEthernet0/1.30
description Data
encapsulation dot1Q 30
ip address 192.168.30.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
no ip route-cache
!
interface GigabitEthernet0/2
no ip address
no ip route-cache
duplex half
speed auto
no mop enabled
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip nat inside source list 1 interface GigabitEthernet0/0 overload
ip nat inside source list 100 interface GigabitEthernet0/0 overload
ip nat inside source static udp 192.168.30.111 8767 interface GigabitEthernet0/0 8767
ip nat inside source static udp 192.168.30.111 34297 interface GigabitEthernet0/0 34297
ip nat inside source static udp 192.168.30.111 34298 interface GigabitEthernet0/0 34298
ip nat inside source static tcp 192.168.30.111 34347 interface GigabitEthernet0/0 34347
ip nat inside source static tcp 192.168.30.111 51234 interface GigabitEthernet0/0 51234
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 68.186.240.1
ip route 0.0.0.0 0.0.0.0 68.186.240.1 254
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 dhcp
!
access-list 1 permit 192.168.10.0 0.0.0.255
access-list 1 permit 192.168.20.0 0.0.0.255
access-list 1 permit 192.168.30.0 0.0.0.255
access-list 100 permit ip 192.168.20.0 0.0.0.255 any
access-list 100 permit ip 192.168.30.0 0.0.0.255 any
access-list 100 permit ip 192.168.10.0 0.0.0.255 any
!
!
snmp-server community no RO
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
!
gatekeeper
shutdown
!
!
!
line con 0
line aux 0
modem InOut
transport input all
transport output all
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
password xxxx
login local
transport input all
!
scheduler allocate 20000 1000
ntp server 129.6.15.28
end

[TJ-20933766]

Does the computer show that it now has DNS servers configured from the DHCP pool? If not then you need to request a new DHCP lease. You can do this in a variety of ways but the simplest for most people is just to reboot the computer.

[Richard Burts]

Thanks for posting a new copy of the config. I was amazed to find this in the config

no ip routing

Turn on ip routing and let us know if the behavior changes.

[Richard Burts]

As I look at the fresh copy of the config I notice:

ip nat inside source list 1 interface GigabitEthernet0/0 overload
ip nat inside source list 100 interface GigabitEthernet0/0 overload

glad to see the new nat statement. You need to remove the nat statement that references acl 100

This was not in the original config. Not sure why it is now in the config and suggest taking it out

no ip cef

In creating this dhcp scope you have the wrong default router

ip dhcp pool MGMT
network 192.168.10.0 255.255.255.0
default-router 192.168.20.254

I question no ip route-cache on the interfaces. I dont know that it is a problem but it would impact performance of the router. And unless there is a particular reason to have it there I would suggest removing it.

I am surprised to see 3 static default routes in the config

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 68.186.240.1
ip route 0.0.0.0 0.0.0.0 68.186.240.1 254
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 dhcp

The second (floating static) is puzzling. If the first static default fails then how would the second (floating) static work since it uses exactly the same next hop? The third static default specifying dhcp is the best one and I suggest removing the first two.

I need to ask for clarification about how the pc is connected to the router. The discussion seems to indicate that the pc is connected directly to the router. But the router interface is configured as vlan subinterfaces. The pc will be sending untagged Ethernet frames which the router will interpret as the native vlan. But there is no native vlan in the router config.

[NickLeone]

I am up and running!!

Thank you all for the fast replies, I erased the config, reapplied it (with all the above changes) and it now works.

My own rookie mistake, I had bits from the config that were wrong, that i had not deleted.

So again I really appreciate the help.

[Richard Burts]

Thanks for the update. Glad to know that now you do have it working.

[balaji.bandi]

Thank you for the feedback glad all well, that is how we learn from mistakes.