Access another network behind 2911 router

paulbrosef · ‎10-07-2015

Hi,

I was able to get everything up and running and now I'm at one more crossroads due to printers.

I have 2 networks behind a 2911, a network on 192.168.42 and there is a wireless network on 192.168.1. The weird thing is that 192.168.1 network can see 192.168.42 network but 192.168.42 network can not see 192.168.1 network. Why would that be? The wireless router is a cisco rv120w and the .42 network is facilitated by the 2911.

int g0/0 -> facing internet

nat outside

int g0/1 -> .42.1 to .42.0 network

nat inside .41.1 to 1.0 network

int g0/2 -> .1

nat inside

ip nat inside source static udp 192.168.42.199 3478 int g0/0 3478
ip nat inside source static udp 192.168.42.199 5060 int g0/0 5060
ip nat inside source list 1 int g0/0 overload
ip route 0.0.0.0 0.0.0.0 70.168.62.161

access-list 1 permit 192.168.41.0 0.0.0.255
access-list 1 permit 192.168.42.0 0.0.0.255

Thanks,

Richard Burts · ‎10-07-2015

There is not enough information here to figure out what is the problem. Can you post the configuration of all interfaces? Are the devices in the subnets learning their addresses via DHCP? If so can you post what is in the DHCP scopes (looking particularly for how the default router is set)?

HTH

Rick

HTH

Rick

paulbrosef · ‎10-07-2015

Sure thing!

Below is the 2911 router configuration.

Current configuration : 2235 bytes

!

! Last configuration change at 18:59:05 UTC Tue Oct 6 2015

! NVRAM config last updated at 22:52:20 UTC Tue Oct 6 2015

version 15.2

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname xx

!

boot-start-marker

boot-end-marker

!

enable secret 5 xx

!

no aaa new-model

memory-size iomem 25

!

no ipv6 cef

!

ip name-server 68.105.28.16

ip name-server 68.105.29.16

ip cef

multilink bundle-name authenticated

!

crypto pki token default removal timeout 0

!

license udi pid CISCO2911/K9 sn FTX1648AKVJ

license accept end user agreement

license boot module c2900 technology-package datak9

!

redundancy

!

interface Embedded-Service-Engine0/0

no ip address

shutdown

!

interface GigabitEthernet0/0

description WAN TO ETHERNET COX

ip address x.x.62.166 255.255.255.248

ip nat outside

ip virtual-reassembly in

duplex auto

speed auto

!

interface GigabitEthernet0/1

description LAN AVAYA IP OFFICE

ip address 192.168.42.1 255.255.255.0

ip nat inside

ip virtual-reassembly in

duplex auto

speed auto

!

interface GigabitEthernet0/2

description LAN WIRELESS NETWORK

ip address 192.168.41.1 255.255.255.0

ip nat inside

ip virtual-reassembly in

duplex auto

speed auto

!

ip default-gateway x.x.62.161

ip forward-protocol nd

!

no ip http server

no ip http secure-server

!

no ip nat service sip udp port 5060

ip nat inside source static udp 192.168.42.199 3478 interface GigabitEthernet0/0 3478

ip nat inside source static udp 192.168.42.199 5060 interface GigabitEthernet0/0 5060

ip nat inside source list 1 interface GigabitEthernet0/0 overload

ip route 0.0.0.0 0.0.0.0 x.x.62.161

!

access-list 1 permit 192.168.42.0 0.0.0.255

access-list 1 permit 192.168.41.0 0.0.0.255

!

control-plane

!

line con 0

password xx

login

line aux 0

password xx

login

line 2

no activation-character

no exec

transport preferred none

transport input all

transport output lat pad telnet rlogin lapb-ta mop udptn v120 ssh

stopbits 1

line vty 0 4

password xx

login

transport input all

!

scheduler allocate 20000 1000

end

The rv120w is setup as follows:

IPv4 WAN

IP 192.168.41.2 255.255.255.0

Default Gateway 192.168.41.1

Primary DNS 68.105.28.16

Secondary DNS 68.105.29.16

IPv4 LAN

LAN IP 192.168.1.1 255.255.255.0

DHCP

Starting 1.100

Ending 1.254

The .42 network is going through a switch that also hosts VoIP phones. Everything is working correctly but when I assign a static IP address to a computer on the floor say: 192.168.42.11, it connects to the internet and the phone works but I can't access a printer on the 192.168.1.0 network. What I'm putting into the computer:

IP Addr 192.168.42.* 255.255.255.0

DG 192.168.42.1

P DNS and S DNS same as on router

Jon Marshall · ‎10-07-2015

Add this to your 2911 router -

"ip route 192.168.1.0 255.255.255.0 192.168.41.2"

I am assuming your wireless router has a default route to 192.168.41.1 ?

Jon

paulbrosef · ‎10-07-2015

Yes. The default gateway for WAN on the wireless is 192.168.41.1

I have added the ip route but it has not changed anything. Added note. I can not ping 192.168.1.1 from the 2911. I can ping 192.168.42.16 from my laptop on 192.168.1.233 but I can not ping 192.168.1.233 from the computer 192.168.42.16

Output from the Routing Table on cisco wireless

Kernel IP routing table

Destination Gateway Genmask Metric Ref Use Interface Type Flags

127.0.0.1 127.0.0.1 255.255.255.255 1 0 0 lo Static UP,Gateway,Host

192.168.1.0 0.0.0.0 255.255.255.0 0 0 0 bdg1 Dynamic UP

192.168.1.0 192.168.1.1 255.255.255.0 1 0 0 bdg1 Dynamic UP,Gateway

192.168.41.0 0.0.0.0 255.255.255.0 0 0 0 eth1 Static UP

0.0.0.0 192.168.41.1 0.0.0.0 0 0 0 eth1 Dynamic UP,Gateway

Jon Marshall · ‎10-07-2015

Can you just make sure you do not have a firewall on your laptop that is blocking ping.

If it is a firewall issue and you can then ping can you remove the route I told you to add and see if it works.

It shouldn't.

Jon

paulbrosef · ‎10-07-2015

Long time reply, got real busy.

Pinging "192.168.41.2" results in "Connection refused by remote host" so I need to allow traffic into the wireless router. That's what seems to be the issue.

Masoud Pourshabanian · ‎10-07-2015

Hello,

Wireless routers usually have access list which blocks traffic from outside to inside. Have you checked that? Since you have a route toward 192.168.0.1 in 2911, you need to disable Nat inside your access point. I am supposing that computers behind that access point have gateway of 192.168.1.1

paulbrosef · ‎10-08-2015

That is what I'm fearing. Basically I need to at least forward printer ports and http into there but I've done the following below. And yes their default gateway is 192.168.1.1

Access Rules:

Always Allow

Any

Enabled

Inbound (WAN (Internet) > LAN (Local Network))

Any

However I still am unable to ping into the 192.168.1.1 network. :-/ *sigh*

Masoud Pourshabanian · ‎10-08-2015

1- just make sure you still have this route in 2911

"ip route 192.168.1.0 255.255.255.0 192.168.41.2"

2- make sure you have disabled NAT in you access point.

3-check your laptop firewalls and your destination firewall

4-I am suspicious to IP conflict. Your access point has the IP of192.168.1.1

Do you have any other devices with this default IP?

turn off your access point and ping 192.168.1.1 and also check for conflicting the IP of your destination which you are pinging .

Use another range of IP instead of 192.168.1.0 if problem still exists.

Masoud,

paulbrosef · ‎10-08-2015

1- ip route still exists, pinging 192.168.41.2 from the 2911 router yields 0% success rate.

2- are you saying to put the wireless router to "Router" rather than "Gateway" on the routing mode? That's only thing I see on this particular wireless router with disabling NAT. I don't think there's a bridge mode, I've checked.

3- laptop firewalls are fine. I can ping my mac from another computer on the same internal network. I can also ping a printer from my mac when connected wirelessly on the 192.168.1 network, I can also ping the router and .42 network on my computer while in the 192.168.1 network, I just can't ping 192.168.1 network at all from .42 network.

4- No, I'm 99.9% positive this is not an IP conflict issue.

Masoud Pourshabanian · ‎10-08-2015

After changing to route mode, make sure that access point IP addresses and default route are set (did not change).

Masoud Pourshabanian · ‎10-08-2015

Yes, I mean router mode. Since you have route (192.168.1.0 ) to your access point, NAT is not necessary.

Masoud

paulbrosef · ‎10-08-2015

Oh for F*CKS sake. I turned EVERYTHING off on Attack Prevention part of the cisco wireless including response to ping.

Jesus, I can ping everything now from anywhere, I just needed to enable that. GOD. I'm sorry, waste of everybody's time. :-(

Masoud Pourshabanian · ‎10-08-2015

Happy, it finally worked.