881-sec-k9 config problem

[20110619Day]

Hi there,

1st time user of Cisco Router. 881-SEC-K9.

Can get the router to connect to the internet. Classic setup - Router behind ADSL Modem - LAN.

Configure 881 thru CiscoConfigurator, straight forward

- PPoE encapsulated

- dynamic IP address

- DNS enabled "enable DNS based hostname to address translation"

- dynamic DNS methods (default): ccp_ddns1   parameter DDNS (? correct)

When testing the connection. I get the following error msg: "configure the command "ip domain-lookup" in the config mode on the router"

No difference if "no ip domain-lookup" is selected, or "ip domain-lookup".

If I set DNS = to known IP address extern -> DNS lookup successful, but no IP address assigned dynamically.

==========================start of config file===================================

!

interface FastEthernet0

!

!

interface FastEthernet1

!

!

interface FastEthernet2

!

!

interface FastEthernet3

!

!

interface FastEthernet4

description $ES_WAN$

no ip address

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

pppoe-client dial-pool-number 1

!

!

interface Vlan1

description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$

ip address 192.168.21.1 255.255.255.0

ip nat inside

interface FastEthernet4

no ip address

no ip directed-broadcast (default)

ip nat outside

ppoe enable group global

ppoe-client dial-pool-number 1

no sh

ip virtual-reassembly

ip tcp adjust-mss 1412

!

!

interface Dialer0

ip address dhcp client-id FastEthernet4

ip mtu 1452

encapsulation ppp

dialer pool 1

dialer-group 1

ppp authentication chap pap callin

ppp chap hostname xxxxxxxx/000000000@xxxxxxxxx

ppp chap password 0 11111111

ppp pap sent-username xxxxxxx/00000000@xxxxxx password 0 11111111

no cdp enable

!

!

ip forward-protocol nd

ip http server

ip http authentication local

ip http secure-server

ip http timeout-policy idle 60 life 86400 requests 10000

!

!

ip nat inside source list 1 interface FastEthernet4 overload

!

access-list 1 remark INSIDE_IF=Vlan1

access-list 1 remark CCP_ACL Category=2

access-list 1 permit 10.10.10.0 0.0.0.7

dialer-list 1 protocol ip permit

no cdp run

==========================end of config file===================================

With an external DNS accepted, the error message changes to Interface IP address :Not assigned/received

Appreciate any feedback!

I'm lost.

Thanks,

Stefan

27-Sep

[mavespig]

Hi Stefan,

Can you try to change the dialer interface to use "ip address negotiated" instead of dhcp?

The IP address should be assigned in the IPCP phase of PPP, not via DHCP.

Regarding the "ip domain-lookup" command, this has effect only locally, on the router.

For example, if from the router CLI you type "ping google.com", IOS will try to resolve the name using the configured DNS server.

This will not have any effect on the end users connected via LAN.

Hope this helps

Marco

[20110619Day]

Hello agn Marco and whoever reads this,

I did as you said manually: No change in behaviour.

Still don't get connection.

The resulting cong file looks like this:

=====

ip source-route

!

!

ip dhcp excluded-address 192.168.21.100 192.168.21.254

!

ip dhcp pool ccp-pool1

   network 192.168.21.0 255.255.255.0

   default-router 192.168.21.1

!

!

ip cef

ip ddns update method ccp_ddns1

DDNS both

!

no ipv6 cef

!

!

multilink bundle-name authenticated

license udi pid CISCO881-SEC-K9 sn FCZ1514925F

!

!

username cp880admin privilege 15 secret 5 $1$ZAkn$1gqERgzCqu855sybC8E8J1

!

!

!

!

!

!

!

!

!

interface FastEthernet0

!

!

interface FastEthernet1

!

!

interface FastEthernet2

!

!

interface FastEthernet3

!

!

interface FastEthernet4

description $ES_WAN$$ETH-WAN$

no ip address

ip nat outside

ip virtual-reassembly

ip tcp adjust-mss 1412

duplex auto

speed auto

pppoe-client dial-pool-number 1

!

!

interface Vlan1

description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$

ip address 192.168.21.1 255.255.255.0

ip nat inside

ip virtual-reassembly

!

!

interface Dialer0

ip address negotiated

ip mtu 1452

encapsulation ppp

dialer pool 1

dialer-group 1

ppp authentication chap pap callin

ppp chap hostname xxxxxxxxxxxxx

ppp chap password 0 xxxxxxxxxxx

ppp pap sent-username xxxxxxxxxx

no cdp enable

!

!

router rip

network 192.168.21.0

no auto-summary

=====

The resulting error message reads:

"checking for DNS settings failed"

and Cisco's help screen recommends: "configure the command 'ip-domain lookup' in teh routers config menu - but I've been there before....

So I tried something else: I enabled the DNS server IP address and added the "outside" IP address of my ISP at my location... something like 91.2.xxx.xx

Upon testing the connection now, the protocol/error msg reads as follows:

"checking for DNS settings...... successful"

"checking inteterface IP address .... successful"

"checking exit interface ...... failed"

So apparently, with the ISP's IP adress the DNS is resolved.

But this method seems to be not right, anyway.

I'm still lost. Tried anything that makes sense to me.

Anyone here to help?

Thank you and best regards,

Stefan

29-Sep

[20110619Day]

Hello Marco,

I tried "IP address negotiated".

Problem: Compared to using "dynamic IP" in mode "negotiated" it is NOT possible to input UserName and Password. These 2 input fields simply disappear when chosing "negotiated".

Only in "dynamic" mode it is possible to input UserName and Password.

Makes sense? I don't know.

Best regards and thank you!

Stefan

27-Sep

[mavespig]

I don't understand your reply, sorry...

"dynamic IP" is not an available option for the dialer interface.

I suggest you connect directly to the router via console, instead of using web tools, and verify what it is happening.

PPPoE is completely independent from DNS, and the router itself does not need to know any DNS server.

Configure the dialer with ip add negotiated, then enable deb ppp nego.

Shut/no shut the dialer interface and collect the debug logs. You should be able to see there if the interface is coming up with an IP address, or not.

Once the dialer interface is up/up with an IP, you can start looking at DNS configuration.

Regards

[20110619Day]

Hi Marco,

pls excuse my igorance - I'm not familiar with the console commands.

I succeeded to connect to Router via console...

I see the "Cisco880Router#"

I input "interface Ethernet1"

no ipaddress

exit

what is "deb ppp nego"?

Pls type the command lines, so I understand.

Sorry abt this, pls hang in with me.

Thank you and rgs,

Stefan

[cadet alain]

Hi,

once you get this prompt hostname# then enter config t then int f0/4

once in interface config type shut then type do debug ppp negotiation and do debug ppp authentication and then no shut .

So you'll be bringing the interface down then enable debugging for PPP and then bring the interface back up and the debug output will tell you what is happening, just paste the output here.

Regards.

Alain.

[20110619Day]

Hi Alain and/or Marco,

pls don't "shoot" commands to me. I said I am NOT familiar with the terminal commands. It's difficult for me to understand what is "text" and what is "command" in your response.

Here is what I understood and have done:

Cisco880Router#config t

Enter configuration commands, one per line.  End with CNTL/Z.

Cisco880Router(config)#int f0/4

                                               ^                                                         

                                                                                                             not work, the "/" is not accepted>

% Invalid input detected at '^' marker.

Cisco880Router(config)#inter fastethernet4

Cisco880Router(config-if)#shut

Cisco880Router(config-if)#do debug ppp negotiation

PPP protocol negotiation debugging is on

Cisco880Router(config-if)#do debug ppp authentication

PPP authentication debugging is on

Cisco880Router(config-if)#no shut

Nothing happens.

Pls use the command structure and tell me exactly what and where I have to type in commands.

Thank you very much in advance.

Best rgs,

Stefan

[cadet alain]

Hi,

the command you enterd were ok. Now how are you connected to the router? via a console cable or via an ethernet cable and you telneted into the router?

do following:

config# logging console debug

config# logging monitor debug

config# exit

# terminal monitor

You  can now shut/no shut the interface and you should see debug outputs on your screen.

Paste the output and copy here.

Regards.

Alain.

[20110619Day]

Hello again,

I connect to the Router for convenience reasons by Ethernet with CCP, then join the COmmunity and do Discover, and then I switch to the Telnet  - Launch Telnet Window and continue in the Telenet window.

Here is the log:

-----------------------------------------------------------------------

Cisco880Router#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

Cisco880Router(config)#logging console debug

Cisco880Router(config)#logging monitor debug

Cisco880Router(config)#exit

Cisco880Router#terminal monitor

Cisco880Router#config t

Enter configuration commands, one per line.  End with CNTL/Z.

Cisco880Router(config)#inter fastethernet4

Cisco880Router(config-if)#do debug ppp negotiation

PPP protocol negotiation debugging is on

Cisco880Router(config-if)#do debug ppp authentication

PPP authentication debugging is on

Cisco880Router(config-if)#shut

Cisco880Router(config-if)#

*Sep 30 12:40:04.475: %LINK-5-CHANGED: Interface FastEthernet4, changed state to

administratively down

*Sep 30 12:40:56.027: Vi1 PPP: Missed 5 keepalives, taking LCP down

*Sep 30 12:40:56.027: Vi1 PPP DISC: Missed too many keepalives

*Sep 30 12:40:56.027: Vi1 IPCP: Event[DOWN] State[Open to Starting]

*Sep 30 12:40:56.027: Vi1 IPCP: Event[CLOSE] State[Starting to Initial]

*Sep 30 12:40:56.027: Vi1 LCP: O TERMREQ [Open] id 2 len 4

*Sep 30 12:40:56.027: Vi1 LCP: Event[CLOSE] State[Open to Closing]

*Sep 30 12:40:56.027: Vi1 PPP: Phase is TERMINATING

*Sep 30 12:40:56.027: Vi1 LCP: Event[DOWN] State[Closing to Initial]

*Sep 30 12:40:56.027: Vi1 PPP: Phase is DOWN

*Sep 30 12:40:56.027: Di0 IPCP: Remove route to 87.186.225.25

*Sep 30 12:40:56.031: %DIALER-6-UNBIND: Interface Vi1 unbound from profile Di0

*Sep 30 12:40:56.031: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Ac

cess1, changed state to down

*Sep 30 12:40:56.035: %LINK-3-UPDOWN: Interface Virtual-Access1, changed state t

o down

Cisco880Router(config-if)#no shut

Cisco880Router(config-if)#

*Sep 30 12:44:45.947: %LINK-3-UPDOWN: Interface FastEthernet4, changed state to

up

*Sep 30 12:44:46.947: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthern

et4, changed state to up

*Sep 30 12:45:00.435: %DIALER-6-BIND: Interface Vi1 bound to profile Di0

*Sep 30 12:45:00.439: %LINK-3-UPDOWN: Interface Virtual-Access1, changed state t

o up

*Sep 30 12:45:00.439: Vi1 PPP: Sending cstate UP notification

*Sep 30 12:45:00.439: Vi1 PPP: Processing CstateUp message

*Sep 30 12:45:00.447: PPP: Alloc Context [84F3C504]

*Sep 30 12:45:00.447: ppp6 PPP: Phase is ESTABLISHING

*Sep 30 12:45:00.447: Vi1 PPP: Using dialer call direction

*Sep 30 12:45:00.447: Vi1 PPP: Treating connection as a callout

*Sep 30 12:45:00.447: Vi1 PPP: Session handle[F7000006] Session id[6]

*Sep 30 12:45:00.447: Vi1 LCP: Event[OPEN] State[Initial to Starting]

*Sep 30 12:45:00.447: Vi1 PPP: No remote authentication for call-out

*Sep 30 12:45:00.447: Vi1 LCP: O CONFREQ [Starting] id 1 len 10

*Sep 30 12:45:00.447: Vi1 LCP:    MagicNumber 0x012CA682 (0x0506012CA682)

*Sep 30 12:45:00.447: Vi1 LCP: Event[UP] State[Starting to REQsent]

*Sep 30 12:45:00.491: Vi1 LCP: I CONFREQ [REQsent] id 1 len 18

*Sep 30 12:45:00.495: Vi1 LCP:    MRU 1492 (0x010405D4)

*Sep 30 12:45:00.495: Vi1 LCP:    AuthProto PAP (0x0304C023)

*Sep 30 12:45:00.495: Vi1 LCP:    MagicNumber 0x1C4D84CC (0x05061C4D84CC)

*Sep 30 12:45:00.495: Vi1 LCP: O CONFNAK [REQsent] id 1 len 8

*Sep 30 12:45:00.495: Vi1 LCP:    MRU 1500 (0x010405DC)

*Sep 30 12:45:00.495: Vi1 LCP: Event[Receive ConfReq-] State[REQsent to REQsent]

*Sep 30 12:45:00.495: Vi1 LCP: I CONFACK [REQsent] id 1 len 10

*Sep 30 12:45:00.495: Vi1 LCP:    MagicNumber 0x012CA682 (0x0506012CA682)

*Sep 30 12:45:00.495: Vi1 LCP: Event[Receive ConfAck] State[REQsent to ACKrcvd]

*Sep 30 12:45:00.539: Vi1 LCP: I CONFREQ [ACKrcvd] id 2 len 18

*Sep 30 12:45:00.539: Vi1 LCP:    MRU 1500 (0x010405DC)

*Sep 30 12:45:00.539: Vi1 LCP:    AuthProto PAP (0x0304C023)

*Sep 30 12:45:00.539: Vi1 LCP:    MagicNumber 0x1C4D84CC (0x05061C4D84CC)

*Sep 30 12:45:00.539: Vi1 LCP: O CONFACK [ACKrcvd] id 2 len 18

*Sep 30 12:45:00.539: Vi1 LCP:    MRU 1500 (0x010405DC)

*Sep 30 12:45:00.539: Vi1 LCP:    AuthProto PAP (0x0304C023)

*Sep 30 12:45:00.539: Vi1 LCP:    MagicNumber 0x1C4D84CC (0x05061C4D84CC)

*Sep 30 12:45:00.539: Vi1 LCP: Event[Receive ConfReq+] State[ACKrcvd to Open]

*Sep 30 12:45:00.575: Vi1 PPP: No authorization without authentication

*Sep 30 12:45:00.575: Vi1 PPP: Phase is AUTHENTICATING, by the peer

*Sep 30 12:45:00.575: Vi1 PAP: Using hostname from interface PAP

*Sep 30 12:45:00.575: Vi1 PAP: Using password from interface PAP

*Sep 30 12:45:00.575: Vi1 PAP: O AUTH-REQ id 1 len 55 from "t-online-com/8081009

55910@t-online-com.de"

*Sep 30 12:45:00.575: Vi1 LCP: State is Open

*Sep 30 12:45:00.631: Vi1 PAP: I AUTH-ACK id 1 len 5

*Sep 30 12:45:00.631: Vi1 PPP: Phase is FORWARDING, Attempting Forward

*Sep 30 12:45:00.631: Vi1 PPP: Queue IPCP code[1] id[1]

*Sep 30 12:45:00.631: Vi1 PPP: Phase is ESTABLISHING, Finish LCP

*Sep 30 12:45:00.631: Vi1 PPP: Phase is UP

*Sep 30 12:45:00.631: Vi1 IPCP: Protocol configured, start CP. state[Initial]

*Sep 30 12:45:00.631: Vi1 IPCP: Event[OPEN] State[Initial to Starting]

*Sep 30 12:45:00.631: Vi1 IPCP: O CONFREQ [Starting] id 1 len 10

*Sep 30 12:45:00.631: Vi1 IPCP:    Address 0.0.0.0 (0x030600000000)

*Sep 30 12:45:00.631: Vi1 IPCP: Event[UP] State[Starting to REQsent]

*Sep 30 12:45:00.635: Vi1 PPP: Process pending ncp packets

*Sep 30 12:45:00.635: Vi1 IPCP: Redirect packet to Vi1

*Sep 30 12:45:00.635: Vi1 IPCP: I CONFREQ [REQsent] id 1 len 10

*Sep 30 12:45:00.635: Vi1 IPCP:    Address 87.186.225.25 (0x030657BAE119)

*Sep 30 12:45:00.635: Vi1 IPCP: O CONFACK [REQsent] id 1 len 10

*Sep 30 12:45:00.635: Vi1 IPCP:    Address 87.186.225.25 (0x030657BAE119)

*Sep 30 12:45:00.635: Vi1 IPCP: Event[Receive ConfReq+] State[REQsent to ACKsent

]

*Sep 30 12:45:00.635: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Ac

cess1, changed state to up

*Sep 30 12:45:00.679: Vi1 IPCP: I CONFNAK [ACKsent] id 1 len 10

*Sep 30 12:45:00.679: Vi1 IPCP:    Address 91.4.225.129 (0x03065B04E181)

*Sep 30 12:45:00.679: Vi1 IPCP: O CONFREQ [ACKsent] id 2 len 10

*Sep 30 12:45:00.679: Vi1 IPCP:    Address 91.4.225.129 (0x03065B04E181)

*Sep 30 12:45:00.679: Vi1 IPCP: Event[Receive ConfNak/Rej] State[ACKsent to ACKs

ent]

*Sep 30 12:45:00.723: Vi1 IPCP: I CONFACK [ACKsent] id 2 len 10

*Sep 30 12:45:00.723: Vi1 IPCP:    Address 91.4.225.129 (0x03065B04E181)

*Sep 30 12:45:00.723: Vi1 IPCP: Event[Receive ConfAck] State[ACKsent to Open]

*Sep 30 12:45:00.731: Vi1 IPCP: State is Open

*Sep 30 12:45:00.731: Di0 IPCP: Install negotiated IP interface address 91.4.225

.129

*Sep 30 12:45:00.731: Di0 IPCP: Install route to 87.186.225.25

Cisco880Router(config-if)#

-----------------------------------------------------------------------

I hope this helps you to understand what's going on.

Best regards,

Stefan

30-Sep-2011

[cadet alain]

Hi,

So you received an IP address from your provider via PPP.

Now can you do : # show ip route and # show run | inc name

Post output.

Regards.

Alain.

[20110619Day]

Here we go:

-----------------------------------------------------------------------

Cisco880Router#show ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, + - replicated route

Gateway of last resort is not set

      87.0.0.0/32 is subnetted, 1 subnets

C        87.186.225.25 is directly connected, Dialer0

      91.0.0.0/32 is subnetted, 1 subnets

C        91.4.220.23 is directly connected, Dialer0

      192.168.21.0/24 is variably subnetted, 2 subnets, 2 masks

C        192.168.21.0/24 is directly connected, Vlan1

L        192.168.21.1/32 is directly connected, Vlan1

Cisco880Router#show ip run | inc name

                        ^

% Invalid input detected at '^' marker.

Cisco880Router#show run | inc name

hostname Cisco880Router

subject-name cn=IOS-Self-Signed-Certificate-164076407

multilink bundle-name authenticated

username cp880admin privilege 15 secret 5 $1$ZAkn$1gqERgzCqu855sybC8E8J1

ppp chap hostname t-online-com/808100955910@t-online-com.de

ppp pap sent-username t-online-com/808100955910@t-online-com.de password 0 1234567

and it provides the default username "cisco" for  one-time use. If you have

already used the username "cisco" to login to the router and your IOS image

supports the "one-time" user option, then this username has already expired.

You will not be able to login to the router with this username after you exit

It is strongly suggested that you create a new username with a privilege level

username privilege 15 secret 0

Replace and with the username and password you

Cisco880Router#

Cisco880Router#show ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route, + - replicated route

Gateway of last resort is not set

      87.0.0.0/32 is subnetted, 1 subnets

C        87.186.225.25 is directly connected, Dialer0

      91.0.0.0/32 is subnetted, 1 subnets

C        91.4.220.23 is directly connected, Dialer0

      192.168.21.0/24 is variably subnetted, 2 subnets, 2 masks

C        192.168.21.0/24 is directly connected, Vlan1

L        192.168.21.1/32 is directly connected, Vlan1

Cisco880Router#show run | inc name

hostname Cisco880Router

subject-name cn=IOS-Self-Signed-Certificate-164076407

multilink bundle-name authenticated

username cp880admin privilege 15 secret 5 $1$ZAkn$1gqERgzCqu855sybC8E8J1

ppp chap hostname t-online-com/808100955910@t-online-com.de

ppp pap sent-username t-online-com/808100955910@t-online-com.de password 0 1234567

and it provides the default username "cisco" for  one-time use. If you have

already used the username "cisco" to login to the router and your IOS image

supports the "one-time" user option, then this username has already expired.

You will not be able to login to the router with this username after you exit

It is strongly suggested that you create a new username with a privilege level

username privilege 15 secret 0

Replace and with the username and password you

Cisco880Router#

-------------------------------------------------------------------------------------------

What do read from this?

Best regards,

Stefan

[cadet alain]

Hi,

Can you ping 87.186.225.25 from the router?

You've got no dns from the provider and it seems the above address is your gateway.

try to ping 8.8.8.8 and if it fails then do this: config# ip route 0.0.0.0 0.0.0.0 dialer0 then try again.

To ping: # ping 87.186.225.25

Regards.

Alain.

[20110619Day]

Hi Alain,

I have no diea what I'm doing here.

See the trace:

-----------------------------------------------------------------------

Cisco880Router#ping 87.186.225.25

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 87.186.225.25, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

Cisco880Router#ping 8.8.8.8

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

Cisco880Router#config

Configuring from terminal, memory, or network [terminal]? t

Enter configuration commands, one per line.  End with CNTL/Z.

Cisco880Router(config)#ip route 0.0.0.0 0.0.0.0 dialer0

Cisco880Router(config)#exit

Cisco880Router#ping 87.186.225.25

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 87.186.225.25, timeout is 2 seconds:

U.U.U

Success rate is 0 percent (0/5)

Cisco880Router#ping 8.8.8.8

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 52/54/56 ms

Cisco880Router#ping 87.186.225.25

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 87.186.225.25, timeout is 2 seconds:

U.U.U

Success rate is 0 percent (0/5)

Cisco880Router#ping 8.8.8.8

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 52/53/56 ms

Cisco880Router#

-----------------------------------------------------------------------

So it works only with 8.8.8.8. (what is this?) and only after I implement the additional command.

Best regards,

Stefan

[20110619Day]

I get it now!

I can ping Google's public DNS server @ 8.8.8.8 but not my providers IP.

That's strange - eh???

Good luck!

Best regards from sunny Bavaria,

Stefan