Access internet with Cisco 877

[Darío Martín]

I am starting down the path of doing a CCNA qualification, and have purchased a Cisco 877W-G-A-K9 to practice on (so I can actually use it "live"). I have set up Bridge Groups etc and have managed to access my NAS etc via Wireless. The inside network works just fine.

However I CANNOT access the internet; by that I mean the CD light flashes and then goes solid, indicating I have recognised and (I think ...) authenticated to my line.

However, I do NOT get a PPPoE session established, my PPP light stays ominously dark, and my computer cannot ping any outside network.

I have scoured the internet, Cisco manuals and various possible configurations on different pages and nothing seems to work. So I am hoping someone with experience can take a look at my running-config and tell me what the issue is.

I suspect it lies in the connection between my Dialer and the ATM port and is quite possibly to do with incorrectly configured DNS but I need help. The outside IP address and DNS is set as my ISP specifies a static IP address and primary / secondary DNS addresses (and I am not convinced I have set up the dns correctly anyway ... like I said - just starting out down the CCNA path)

Please could someone take a look at my running-config and offer some advice?

[Georg Pauwen]

Hello,

I have made a small adjustment to your configuration. You need to have an access list that specifies which traffic needs to be translated. I have marked the important lines in bold:

Current configuration : 4649 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Cisco877
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$C3.7$v3XdsfrtduGgh5Bk2bYpkrITV.
!
no aaa new-model
!
crypto pki trustpoint TP-self-signed-152119483
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-152119483
revocation-check none
rsakeypair TP-self-signed-152119483
!
!
crypto pki certificate chain TP-self-signed-152119483
certificate self-signed 01
30820251 308201BA A0030201 02020101 300D0609 2A864886 F70D0101 04050030
30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31353231 31393438 33301E17 0D303230 33303130 30323431
385A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F
532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3135 32313139
34383330 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
A3CD4BBC 82A01A88 5D40A1B5 6A75680A ABE77A66 3AD8F7CA CC4CB032 3611F8B0
19074D33 66752E15 215E47DA 13DB1CB3 2DDDEE07 52FF9109 657A8BEB 0BBD34CA
F080A990 026C8CA3 2CC2C6A1 6668C88E 4DE25C2B 22017FB5 A32718DC 7DE81FFD
BAEEEA5E CE334574 2A6676D4 FB206F7A 7BC292B3 E67A56F1 D736C80A FBF51E6F
02030100 01A37B30 79300F06 03551D13 0101FF04 05300301 01FF3026 0603551D
11041F30 1D821B43 6973636F 3837372E 6E657470 6F70756C 61726573 2E6C6F63
616C301F 0603551D 23041830 16801490 B0B8513E F48EE6D3 181AEC75 BFFBE711
5A191330 1D060355 1D0E0416 041490B0 B8513EF4 8EE6D318 1AEC75BF FBE7115A
1913300D 06092A86 4886F70D 01010405 00038181 009D7AAC 382DFE78 CD2800F8
92785082 70244016 8C714314 3A54D019 26D244B1 A4447FA6 31ECB622 919A8124
BC902E2D 60D93CF0 65552084 6A4D2B5E 5CE1CAFD 9F5DE3A9 9836A6BB AF4A77AC
0EE97396 34654776 A4452399 494BAB4A BEB59405 15D52F62 5DAFBDC6 771E4701
609E0367 3D2E888A 4206D12F AEED8014 68B32B7B 7D
quit
dot11 syslog
!
dot11 ssid Corazon
vlan 1
authentication open
authentication key-management wpa
guest-mode
wpa-psk ascii 7 1309ED53FA27C9577C7A
!
no ip source-route
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.0.1 192.168.0.15
!
ip dhcp pool dpool1
import all
network 192.168.0.0 255.255.255.0
default-router 192.168.0.1
update arp
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
ip domain name netpopulares.local
!
!
!
username admin secret 5 $1/shgpkjh%6jxlkjhx$kj7hjb&.8HPc1
!
!
archive
log config
hidekeys
!
!
!
bridge irb
!
!
interface ATM0
description ----- ADSL Connection ----
no ip address
ip virtual-reassembly
no atm ilmi-keepalive
pvc 8/35
tx-ring-limit 3
encapsulation aal5snap
pppoe-client dial-pool-number 1
!
dsl operating-mode auto
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Dot11Radio0
no ip address
!
encryption vlan 1 mode ciphers aes-ccm
!
encryption mode ciphers aes-ccm
!
broadcast-key vlan 1 change 45
!
!
ssid Corazon
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
no cdp enable
!
interface Dot11Radio0.1
encapsulation dot1Q 1 native
ip virtual-reassembly
no cdp enable
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Vlan1
no ip address
ip virtual-reassembly
bridge-group 1
!
interface Dialer0
description ---- ADSL ----
ip address 144.138.131.214 255.255.255.0
ip mtu 1492
ip nat outside
ip virtual-reassembly
encapsulation ppp
ip tcp adjust-mss 1420
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication chap
ppp chap hostname 571549@belong.com.au
ppp chap password 7 02BA357F5E9AD3B1B19
ppp ipcp dns 208.67.222.222
ppp ipcp route default
!
interface BVI1
ip address 192.168.0.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
!
no ip http server
no ip http secure-server
ip nat inside source list NAT interface Dialer0 overload
!
ip access-list extended NAT
permit ip 192.168.0.0 0.0.0.255 any
!
dialer-list 1 protocol ip permit
!
!
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
!
line con 0
password 7 104E809FC34E27B43
logging synchronous
login
no modem enable
line aux 0
line vty 0 4
password 7 5AE6978FFC2359A65A5E57
login local
transport input ssh
!
scheduler max-task-time 5000
end

[Darío Martín]

Many thanks for the response ... unfortunately ... I still get no connection!  So after adding in the lines you advised, I did a shutdown followed by a no shutdown on both Dialer 0 and ATM 0, then after seeing both interfaces come up, I enabled debug ppp authentication to see what was going on.  I got the following results :

Cisco877#
*Mar 1 00:32:19.311: %DIALER-6-BIND: Interface Vi1 bound to profile Di0
*Mar 1 00:32:19.311: Vi1 PPP: Using dialer call direction
*Mar 1 00:32:19.311: Vi1 PPP: Treating connection as a callout
*Mar 1 00:32:19.311: Vi1 PPP: Session handle[AC000017] Session id[0]
*Mar 1 00:32:19.311: Vi1 PPP: Authorization required
Cisco877#
*Mar 1 00:32:19.315: %LINK-3-UPDOWN: Interface Virtual-Access1, changed state to up
Cisco877#
*Mar 1 00:32:23.687: %DIALER-6-UNBIND: Interface Vi1 unbound from profile Di0
Cisco877#
*Mar 1 00:32:23.691: %LINK-3-UPDOWN: Interface Virtual-Access1, changed state to down

Looking at the debug I am simply not authenticating I would say.  I issued a "no ppp chap password" command from within Interface Dialer 0 and then re-added it with encryption "0" to see if it was the encrypted password causing issues.  Still no joy, when debug command issued, the same output as above....

So I guess I am not authenticating, which would explain why I am not getting the PPP light and establishing a PPP session

Help ...?

[Georg Pauwen · Accepted solution]

Hello,

I checked your config against a few other working configs. Try and remove the line:

ppp authentication chap

from your dialer interface.

Also, in general, no static IP addresses are assigned, instead the line:

ip address negotiated

is configured under your Dialer. Check if you are supposed to configure a static IP address.

[Darío Martín]

IT WORKED!! You sir are a genius!!  I now authenticate, get a solid PPP light and can ping outside IP addresses.  It was removing the "ppp authentication chap" line that did it. (My ISP confirmed I have a static address and require that to be specified)

Now here's the thing (Oh you knew this was coming didn't you...?) ... whilst I can now ping outside addresses (from both the router and a command session on the computer), I am unable to resolve them in a web browser - on my laptop that is.... I mean that if I enter "google.com" or any other web address in the web browser it fails and tells me to check connection settings and that the Server could not find DNS address

From my Mobile Phone (iPhone 6), however, ALSO connecting wirelessly and with DHCP enabled .... I have full access... email, messaging, Web browsing - everything

So... I have an issue resolving DNS.  (Incidentally, when I disconnected from my existing router, it showed that the subnet mask for my outside static IP address was a /32.  IOS wouldn't allow me to enter this mask in the dialer ...)

I am ALSO getting the following two errors repeating (whilst logged in to console) and I am afraid I do not know where to start.  The MAC addresses are from my laptop and my mobile phone - the two devices attached to the router

*Mar 1 01:00:39.539: *** Not encrypted dot1x packet from 0022.fab8.d4c0 has been discarded
*Mar 1 01:00:39.759: *** Not encrypted dot1x packet from fa82.bf3c.f7de has been discarded

I now feel like with your great help I am making great progress and am shortly to be using this Cisco to actually browse.....  latest running-config attached

[Georg Pauwen]

Hello,

good to hear that you are making progress. To resolve the DNS issue, add the line below (in bold) to your DHCP pool configuration. The IP addresses belong to the two public Google DNS servers.

ip dhcp pool dpool1
import all
network 192.168.0.0 255.255.255.0
default-router 192.168.0.1

dns-server 8.8.8.8 8.8.4.4
lease infinite
update arp

I willhave a look at the log messages...

[Georg Pauwen]

Hello,

the log messages could be caused by outdated (wireless) network interface card drivers. Try and update the NIC drivers on your laptop and your mobile phone and check if the error messages disappear...

[Darío Martín]

With regards NIC, computer is bang up to date with latest drivers and iPhone is running iOS 10.1.1 - the very very very latest firmware from Apple

[Georg Pauwen]

Hello,

I am checking your configuration against a working config from another provider in Australia. The only difference I can discover is the global command 'world-mode dot11d country AU both':

speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
world-mode dot11d country AU both

Can you add that to your config ? I am not sure what bearing that has on the log messages, but give it a try...

[Darío Martín]

Halloo again.  OK, I added in the world-mode command; this initially caused my computer to not want to connect; but after reloading the router, all was well.  I still receive the error messages, but now only after both devices initially log on, then after that - nothing.

As regards the resolving of DNS - this is really getting quite troublesome.  I removed the import all line from DHCP pool, reconnected the wireless device ... no difference.

I then searched and found numerous people had posted similar issues but sadly the resolutions posted I have already instituted! i.e. adding name servers, adding a list of dns servers to my DHCP pool etc etc.

I then found a post that suggested that if you had DNS resolver issues, it was to do with your MTUs .... I did a show ip int and noted the following from it:

Dialer 0 MTU - 1492
NVI 0 MTU - 1514
BVI 1 MTU - 1500 ( with ip tcp adjust-mss 1452 set)

I tried changing adjust-mss in BVI 1 to the maximum 1460 and MTU in Dialer 0 to 1500.  No, same problem.

Here is output from my Windows Command Line:

C:\Windows\System32>nslookup google.com
Server: resolver1.opendns.com
Address: 208.67.222.222

Non-authoritative answer:
Name: google.com
Addresses: 2404:6800:4006:807::200e
172.217.25.174

So while a ping tells me it cannot find the named host, an nslookup has no such problems and resolves the name happily.

The last two outputs may mean something - I truly don't know for I lack the knowledge or experience to interpret them, but I did a show ip cef from the Router:

Cisco877#show ip cef
Prefix             Next Hop      Interface
0.0.0.0/0          attached      Dialer0
0.0.0.0/32         receive
144.138.131.0/24   attached      Dialer0
144.138.131.0/32   receive
144.138.131.214/32 receive
144.138.131.255/32 receive
155.143.128.142/32 attached      Dialer0
192.168.0.0/24     attached      BVI1
192.168.0.0/32     receive
192.168.0.1/32     receive
192.168.0.2/32     192.168.0.2   BVI1
192.168.0.3/32     192.168.0.3   BVI1
192.168.0.16/32    192.168.0.16  BVI1
192.168.0.17/32    192.168.0.17  BVI1
192.168.0.20/32    192.168.0.20  BVI1
192.168.0.255/32   receive
224.0.0.0/4        drop
224.0.0.0/24       receive
255.255.255.255/32 receive

And then a show ip dns statistics :

Cisco877#show ip dns statistics
DNS requests received = 25 ( 24 + 1 )
DNS requests dropped = 0 ( 0 + 0 )
DNS responses replied = 0 ( 0 + 0 )

Forwarder queue statistics:
Current size = 0
Maximum size = 6
Drops = 0

Director queue statistics:
Current size = 0
Maximum size = 0
Drops = 0

So .... does any of this mean anything......?

[Georg Pauwen · Accepted solution]

Hello,

MTU and MSS settings might indeed cause problems. Try this:

interface Dialer0
description ---- ADSL ----
ip address 144.138.131.214 255.255.255.0
no ip redirects
no ip unreachables
ip mtu 1460
ip nat outside
ip virtual-reassembly
encapsulation ppp

ip tcp adjust-mss 1420
dialer pool 1
dialer-group 1
no cdp enable
ppp chap hostname 571549@belong.com.au
ppp chap password 7 ********************************

interface BVI1
ip address 192.168.0.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1420

[Darío Martín]

Well .... I'm responding via the aforementioned Cisco 877 ... so yes - I am on the net!! 

Prior to receiving your response, I connected another computer to the internet to test it out and it logged on just fine; so I turned my thoughts back to this here computer.  I changed one setting on my Chrome settings and all of a sudden it accessed the internet.  Dropbox is connected, Google Drive is connected ... life is good.

A speedtest shows a very "patchy" connection though and quite a high latency, but I guess I can delve now into "cleaning up" the connection.  At least I am connected.

I have followed your advice though and set MTU to 1460 and adjust-mss to 1420 on both Dialer0 and BVI1 (I did a shut / no shut of both interfaces immediately after making the change)

I also added "ip nat enable" to both my inside and outside nat interfaces ... don't know if that helped!!

I am now getting the "not encypted dot1x packet discarded" message from all devices logged on to the router at a fairly regular rate - all devices have up-to-date wireless drivers so who knows?

I am on the net now though - thank you - I may continue my Cisco studies ....

[Darío Martín]

Hmm.  OK, tried that - no go, same problem.  I then tried :

dns-server 192.168.0.1 - still no luck followed by:

dns-server 208.67.222.222 208.67.220.220 which are the two DNS servers specified by my ISP.

Same issue - I can ping ip addresses from my computer but cannot resolve hostnames; again, same as before, iPhone 6 can browse the web, receive email etc etc.

The errors I get in my web browser when I try and browse are:

This site can’t be reached

hostica.com’s server DNS address could not be found. (or whoever it is I have tried to reach)

I can ping hostnames from the router itself i.e. :

Cisco877#ping outlook.msexchangehosted.com
Translating "outlook.msexchangehosted.com"...domain server (208.67.222.222) [OK]

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 62.75.254.190, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 336/336/340 ms

Which suggests to me that DNS as far as the router is working but for whatever reason that DNS is not being passed down to the connected laptops / computers - but IS somehow being utilised by the mobile phones!!

(I did try removing the "name-server" strings from my config and after that could no longer ping hostnames, so that tells me that the DNS servers specified are valid)

[Georg Pauwen]

Hello,

take the 'import all' and 'line out of your DHCP pool:

ip dhcp pool dpool1
--> import all
network 192.168.0.0 255.255.255.0
default-router 192.168.0.1

dns-server 8.8.8.8 8.8.4.4
lease infinite
update arp

Does that make a difference ?