C1111-8PLTELA Router - Help with config

[FWKoch19525]

Hi Guys,

Is there anyone that can help me configure a C1111-8PLTELA Router?

I need to set up DUAL WAN with PPPOE that uses VLAN10 for the PPPOE connections on both WAN ports, plus load balancing between them (not failover).

In the GUI it does not offer the option to add VLAN 10 tag. I have tried creating the PPPOE on a sub-interface of .10 on each WAN port (0/0/0 and 0/0/1), I also tried adding "encapsulation dot1Q 10" to the config via CLI (using the ethernet directly or subinterface), but it is not working.

Also need to confirm the access rules is correctly setup for the internet access to the internal LAN.

-----Start of Config-----

RT-QF-01#show config
Using 5324 out of 33554432 bytes
!
! Last configuration change at 17:51:36 UTC Sat Mar 6 2021
!
version 16.10
service timestamps debug datetime msec
service timestamps log datetime msec
service call-home
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname RT-QF-01
!
boot-start-marker
boot-end-marker
!
!
no logging console
enable secret 9 xxxxx
enable password xxxxx
!
no aaa new-model
call-home
! If contact email address in call-home is configured as sch-smart-licensing@cisco.com
! the email address configured in Cisco Smart License Portal will be used as contact email address to send SCH notifications.
contact-email-addr sch-smart-licensing@cisco.com
sender from xxx@xxx.com
sender reply-to xxx@xxx.com
profile "CiscoTAC-1"
active
destination transport-method http
no destination transport-method email
!
ip name-server 8.8.4.4 8.8.8.8
ip dhcp use subscriber-id client-id
ip dhcp subscriber-id interface-name
ip dhcp excluded-address 10.10.10.0
ip dhcp excluded-address 10.10.10.255 255.255.255.255
ip dhcp excluded-address 10.10.10.0 10.10.10.9
ip dhcp excluded-address 10.10.10.251 10.10.10.255
!
ip dhcp pool InternalLAN
network 10.10.10.0 255.255.255.0
default-router 10.10.10.1
dns-server 10.10.10.1
lease 7
!
!
!
login on-success log
!
!
!
!
!
!
!
subscriber templating
multilink bundle-name authenticated
!
!
!
crypto pki trustpoint SLA-TrustPoint
enrollment pkcs12
revocation-check crl
!
crypto pki trustpoint TP-self-signed-3698994228
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3698994228
revocation-check none
rsakeypair TP-self-signed-3698994228
!
!
crypto pki certificate chain SLA-TrustPoint
certificate ca 01 nvram:CiscoLicensi#1CA.cer
crypto pki certificate chain TP-self-signed-3698994228
certificate self-signed 01 nvram:IOS-Self-Sig#2.cer
!
license udi pid C1111-8PLTELA sn FGL2438LAYT
!
diagnostic bootup level minimal
!
spanning-tree extend system-id
!
!
username xxx privilege 15 password 0 xxxxx
username xxx privilege 15 secret 9 xxxxx
!
redundancy
mode none
!
controller Cellular 0/2/0
lte modem link-recovery rssi onset-threshold -110
lte modem link-recovery monitor-timer 20
lte modem link-recovery wait-timer 10
lte modem link-recovery debounce-count 6
!
!
vlan internal allocation policy ascending
!
track 1 ip sla 1 reachability
!
!
!
!
!
!
interface GigabitEthernet0/0/0
description WAN1
no ip address
ip nat outside
negotiation auto
!
interface GigabitEthernet0/0/0.10
encapsulation dot1Q 10
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface GigabitEthernet0/0/1
description WAN2+VPN
no ip address
ip nat outside
negotiation auto
!
interface GigabitEthernet0/0/1.10
encapsulation dot1Q 10
pppoe enable group global
pppoe-client dial-pool-number 2
!
interface GigabitEthernet0/1/0
!
interface GigabitEthernet0/1/1
!
interface GigabitEthernet0/1/2
!
interface GigabitEthernet0/1/3
!
interface GigabitEthernet0/1/4
!
interface GigabitEthernet0/1/5
!
interface GigabitEthernet0/1/6
!
interface GigabitEthernet0/1/7
!
interface Cellular0/2/0
no ip address
shutdown
!
interface Cellular0/2/1
no ip address
shutdown
!
interface Vlan1
ip dhcp relay source-interface Vlan1
ip address 10.10.10.1 255.255.255.0
ip nat inside
!
interface Dialer1
ip address negotiated
ip mtu 1452
ip nat outside
encapsulation ppp
ip tcp adjust-mss 1412
dialer pool 1
dialer idle-timeout 0
dialer persistent
dialer-group 1
no cdp enable
ppp mtu adaptive
ppp authentication pap callin
ppp pap sent-username xxx@xxx.xxx password 0 xxxxx
ppp ipcp dns request
!
interface Dialer2
ip address negotiated
ip mtu 1452
ip nat outside
encapsulation ppp
ip tcp adjust-mss 1412
dialer pool 2
dialer idle-timeout 0
dialer-group 2
no cdp enable
ppp mtu adaptive
ppp authentication pap callin
ppp pap sent-username xxx@xxx.xxx password 0 xxxxx
ppp ipcp dns request
!
iox
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 600 life 600 requests 25
ip dns server
ip nat pool Internet 10.10.10.0 10.10.10.254 prefix-length 24
ip nat inside source route-map track-primary-if interface GigabitEthernet0/0/0 overload
ip nat inside source route-map track-secondary-if interface Dialer3 overload
ip nat inside source list 11 interface GigabitEthernet0/0/0 overload
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0 track 1
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0 dhcp
!
!
ip sla 1
icmp-echo 8.8.8.8 source-interface GigabitEthernet0/0/0
ip sla schedule 1 life forever start-time now
access-list 11 permit 10.10.10.0 0.0.0.255
access-list 11 remark Define Internal Network
access-list 197 permit ip any any
dialer-list 1 protocol ip permit
dialer-list 2 protocol ip permit
dialer-list 3 protocol ip permit
!
!
route-map track-primary-if permit 1
match ip address 197
set interface GigabitEthernet0/0/0
!
route-map track-secondary-if permit 1
match ip address 197
!
!
!
control-plane
!
!
line con 0
transport input none
stopbits 1
line vty 0 4
password xxxxx
login
length 0
!
!
!
!
!
!
end

-----End of Config-----

Any help would be appreciated.

[Georg Pauwen]

Hello,

provided you are getting IP addresses on your dialer interfaces, try the config below (important parts marked in bold:

RT-QF-01#show config
Using 5324 out of 33554432 bytes
!
! Last configuration change at 17:51:36 UTC Sat Mar 6 2021
!
version 16.10
service timestamps debug datetime msec
service timestamps log datetime msec
service call-home
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname RT-QF-01
!
boot-start-marker
boot-end-marker
!
no logging console
enable secret 9 xxxxx
enable password xxxxx
!
no aaa new-model
call-home
! If contact email address in call-home is configured as sch-smart-licensing@cisco.com
! the email address configured in Cisco Smart License Portal will be used as contact email address to send SCH notifications.
contact-email-addr sch-smart-licensing@cisco.com
sender from xxx@xxx.com
sender reply-to xxx@xxx.com
profile "CiscoTAC-1"
active
destination transport-method http
no destination transport-method email
!
ip name-server 8.8.4.4 8.8.8.8
ip dhcp use subscriber-id client-id
ip dhcp subscriber-id interface-name
ip dhcp excluded-address 10.10.10.0
ip dhcp excluded-address 10.10.10.255 255.255.255.255
ip dhcp excluded-address 10.10.10.0 10.10.10.9
ip dhcp excluded-address 10.10.10.251 10.10.10.255
!
ip dhcp pool InternalLAN
network 10.10.10.0 255.255.255.0
default-router 10.10.10.1
--> dns-server 8.8.8.8 8.8.4.4
lease 7
!
login on-success log
!
subscriber templating
multilink bundle-name authenticated
!
crypto pki trustpoint SLA-TrustPoint
enrollment pkcs12
revocation-check crl
!
crypto pki trustpoint TP-self-signed-3698994228
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3698994228
revocation-check none
rsakeypair TP-self-signed-3698994228
!
crypto pki certificate chain SLA-TrustPoint
certificate ca 01 nvram:CiscoLicensi#1CA.cer
crypto pki certificate chain TP-self-signed-3698994228
certificate self-signed 01 nvram:IOS-Self-Sig#2.cer
!
license udi pid C1111-8PLTELA sn FGL2438LAYT
!
diagnostic bootup level minimal
!
spanning-tree extend system-id
!
username xxx privilege 15 password 0 xxxxx
username xxx privilege 15 secret 9 xxxxx
!
redundancy
mode none
!
controller Cellular 0/2/0
lte modem link-recovery rssi onset-threshold -110
lte modem link-recovery monitor-timer 20
lte modem link-recovery wait-timer 10
lte modem link-recovery debounce-count 6
!
vlan internal allocation policy ascending
!
interface GigabitEthernet0/0/0
description WAN1
no ip address
ip nat outside
negotiation auto
!
interface GigabitEthernet0/0/0.10
encapsulation dot1Q 10
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface GigabitEthernet0/0/1
description WAN2+VPN
no ip address
ip nat outside
negotiation auto
!
interface GigabitEthernet0/0/1.10
encapsulation dot1Q 10
pppoe enable group global
pppoe-client dial-pool-number 2
!
interface GigabitEthernet0/1/0
!
interface GigabitEthernet0/1/1
!
interface GigabitEthernet0/1/2
!
interface GigabitEthernet0/1/3
!
interface GigabitEthernet0/1/4
!
interface GigabitEthernet0/1/5
!
interface GigabitEthernet0/1/6
!
interface GigabitEthernet0/1/7
!
interface Cellular0/2/0
no ip address
shutdown
!
interface Cellular0/2/1
no ip address
shutdown
!
interface Vlan1
ip dhcp relay source-interface Vlan1
ip address 10.10.10.1 255.255.255.0
ip nat inside
!
interface Dialer1
ip address negotiated
ip mtu 1452
ip nat outside
encapsulation ppp
ip tcp adjust-mss 1412
dialer pool 1
dialer idle-timeout 0
dialer persistent
dialer-group 1
no cdp enable
ppp mtu adaptive
ppp authentication pap callin
ppp pap sent-username xxx@xxx.xxx password 0 xxxxx
ppp ipcp dns request
!
interface Dialer2
ip address negotiated
ip mtu 1452
ip nat outside
encapsulation ppp
ip tcp adjust-mss 1412
dialer pool 2
dialer idle-timeout 0
dialer-group 2
no cdp enable
ppp mtu adaptive
ppp authentication pap callin
ppp pap sent-username xxx@xxx.xxx password 0 xxxxx
ppp ipcp dns request
!
iox
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 600 life 600 requests 25
ip dns server
!
--> ip nat inside source list 1 interface Dialer 1 overload
--> ip nat inside source list 1 interface Dialer 2 overload
--> ip route 0.0.0.0 0.0.0.0 Dialer 1
--> ip route 0.0.0.0 0.0.0.0 Dialer 2
!
--> dialer-list 1 protocol ip permit
--> dialer-list 2 protocol ip permit
!
--> access-list 1 permit 10.10.10.0 0.0.0.255
!
control-plane
!
line con 0
transport input none
stopbits 1
line vty 0 4
password xxxxx
login
length 0
!
end

[FWKoch19525]

Hi Georg,

Thank you for your input, I will add those lines and then see if it works. At this stage, the PPPOE is not connecting at all.

I will let you know how it goes.

Thanks

[FWKoch19525]

Hi George,

I have added those lines, but it made no difference. Still the PPPOE is not connecting and therefore no internet access:

-----Start of Config-----

RT-QF-01#show config
Using 5513 out of 33554432 bytes
!
! Last configuration change at 17:00:09 UTC Thu Mar 11 2021
!
version 16.10
service timestamps debug datetime msec
service timestamps log datetime msec
service call-home
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname RT-QF-01
!
boot-start-marker
boot-end-marker
!
!
no logging console
enable secret 9 xxxxx
enable password xxxxx
!
no aaa new-model
call-home
! If contact email address in call-home is configured as sch-smart-licensing@cisco.com
! the email address configured in Cisco Smart License Portal will be used as contact email address to send SCH notifications.
contact-email-addr sch-smart-licensing@cisco.com
sender from xxxxx@xxxxx.xxx
sender reply-to xxxxx@xxxxx.xxx
profile "CiscoTAC-1"
active
destination transport-method http
no destination transport-method email
!
ip name-server 8.8.4.4 8.8.8.8
ip dhcp use subscriber-id client-id
ip dhcp subscriber-id interface-name
ip dhcp excluded-address 10.10.10.0
ip dhcp excluded-address 10.10.10.255 255.255.255.255
ip dhcp excluded-address 10.10.10.0 10.10.10.9
ip dhcp excluded-address 10.10.10.251 10.10.10.255
!
ip dhcp pool InternalLAN
network 10.10.10.0 255.255.255.0
default-router 10.10.10.1
dns-server 8.8.8.8 8.8.4.4
lease 7
!
!
!
login on-success log
!
!
!
!
!
!
!
subscriber templating
multilink bundle-name authenticated
!
!
!
crypto pki trustpoint SLA-TrustPoint
enrollment pkcs12
revocation-check crl
!
crypto pki trustpoint TP-self-signed-3698994228
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3698994228
revocation-check none
rsakeypair TP-self-signed-3698994228
!
!
crypto pki certificate chain SLA-TrustPoint
certificate ca 01 nvram:CiscoLicensi#1CA.cer
crypto pki certificate chain TP-self-signed-3698994228
certificate self-signed 01 nvram:IOS-Self-Sig#2.cer
!
license udi pid C1111-8PLTELA sn FGL2438LAYT
!
diagnostic bootup level minimal
!
spanning-tree extend system-id
!
!
username xxxxx privilege 15 password 0 xxxxx
username xxxxx privilege 15 secret 9 xxxxx
!
redundancy
mode none
!
controller Cellular 0/2/0
lte modem link-recovery rssi onset-threshold -110
lte modem link-recovery monitor-timer 20
lte modem link-recovery wait-timer 10
lte modem link-recovery debounce-count 6
!
!
vlan internal allocation policy ascending
!
track 1 ip sla 1 reachability
!
!
!
!
!
!
interface GigabitEthernet0/0/0
description WAN1
no ip address
ip nat outside
negotiation auto
!
interface GigabitEthernet0/0/0.10
encapsulation dot1Q 10
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface GigabitEthernet0/0/1
description WAN2+VPN
no ip address
ip nat outside
negotiation auto
!
interface GigabitEthernet0/0/1.10
encapsulation dot1Q 10
pppoe enable group global
pppoe-client dial-pool-number 2
!
interface GigabitEthernet0/1/0
!
interface GigabitEthernet0/1/1
!
interface GigabitEthernet0/1/2
!
interface GigabitEthernet0/1/3
!
interface GigabitEthernet0/1/4
!
interface GigabitEthernet0/1/5
!
interface GigabitEthernet0/1/6
!
interface GigabitEthernet0/1/7
!
interface Cellular0/2/0
no ip address
shutdown
!
interface Cellular0/2/1
no ip address
shutdown
!
interface Vlan1
ip dhcp relay source-interface Vlan1
ip address 10.10.10.1 255.255.255.0
ip nat inside
!
interface Dialer1
ip address negotiated
ip mtu 1452
ip nat outside
encapsulation ppp
ip tcp adjust-mss 1412
dialer pool 1
dialer idle-timeout 0
dialer persistent
dialer-group 1
no cdp enable
ppp mtu adaptive
ppp authentication pap callin
ppp pap sent-username xxxxx password 0 xxxxx
ppp ipcp dns request
!
interface Dialer2
ip address negotiated
ip mtu 1452
ip nat outside
encapsulation ppp
ip tcp adjust-mss 1412
dialer pool 2
dialer idle-timeout 0
dialer-group 2
no cdp enable
ppp mtu adaptive
ppp authentication pap callin
ppp pap sent-username xxxxx password 0 xxxxx
ppp ipcp dns request
!
interface Dialer3
!
iox
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 600 life 600 requests 25
ip dns server
ip nat pool Internet 10.10.10.0 10.10.10.254 prefix-length 24
ip nat inside source list 1 interface Dialer1 overload
ip nat inside source list 11 interface GigabitEthernet0/0/0 overload
ip nat inside source route-map track-primary-if interface GigabitEthernet0/0/0 overload
ip nat inside source route-map track-secondary-if interface Dialer3 overload
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0 track 1
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0
ip route 0.0.0.0 0.0.0.0 Dialer1
ip route 0.0.0.0 0.0.0.0 Dialer2
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0 dhcp
!
!
ip sla 1
icmp-echo 8.8.8.8 source-interface GigabitEthernet0/0/0
ip sla schedule 1 life forever start-time now
access-list 1 permit 10.10.10.0 0.0.0.255
access-list 11 permit 10.10.10.0 0.0.0.255
access-list 11 remark Define Internal Network
access-list 197 permit ip any any
dialer-list 1 protocol ip permit
dialer-list 2 protocol ip permit
dialer-list 3 protocol ip permit
!
!
route-map track-primary-if permit 1
match ip address 197
set interface GigabitEthernet0/0/0
!
route-map track-secondary-if permit 1
match ip address 197
!
!
!
control-plane
!
!
line con 0
transport input none
stopbits 1
line vty 0 4
password 12cisco89!
login
length 0
!
!
!
!
!
!
end

-----End of Config-----

Attached also is some screenshots from the GUI interface where you can see no IP coming through for the PPPOE (0/0/0 and 0/0/1). You can see also the client pc is getting the correct DHCP settings and then the ACL lists on the router which at this stage list 1 and list 11 are the same.

Any other ideas to get my PPPOE working?

Regards

FW Koch

[Georg Pauwen]

Hello,

you have posted the original configuration...is that the one you are using ? Did you try the one I posted earlier ?

Also, who is, or are, the ISP(s) ?

[FWKoch19525]

Hi there,

The router is brand new, so the "original config" is factory defaults. This config is the one I have started to set up in my attempt to set it up from scratch and make it work. Therefore it is the current running/startup config I am using.

The ISP is 2degrees, they require you to specify VLAN10 on the PPPOE for the fibre connection. Without it, it won't connect.

TIA

[Georg Pauwen]

Hello,

what I meant to say is: did you ever use the configuration that I sent ?

Either way, do you have a working physical link at all ? Are the LEDs on the GigabitEthernet interfaces lit green ?

[FWKoch19525]

Indeed, as mentioned I added all the bits you marked in Bold and it did not make a difference.

Yes, our fibre line is working as I am using another router (non CISCO) on it without any problems. The green lights do come on yes.

I set the unit on DHCP for the WAN ports at one stage and connected it via our LAN at one stage just to make sure it is working, and it was. But I need it to work with PPPOE and VLAN ID 10, not DHCP.