C891 suddenly no internet access

[etsoft]

Hi,

suddenly my router is blocking internet access, the internal networks works fine but i do not have connection with the outside world, here is my config. What is wrong?

Current configuration : 3003 bytes
!
version 15.5
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
ethernet lmi ce
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!

!
ip dhcp excluded-address 192.168.0.30 192.168.0.99
ip dhcp excluded-address 192.168.0.195 192.168.0.255
!
ip dhcp pool DHCP-LAN
network 192.168.0.0 255.255.255.0
default-router 192.168.0.1
dns-server 212.115.192.100 212.115.192.193
!
!
!
ip cef
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
license udi pid C891F-K9 sn FCZ204412N8
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface BRI0
no ip address
encapsulation hdlc
shutdown
isdn termination multidrop
!
interface FastEthernet0
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0
no ip address
!
interface GigabitEthernet1
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet2
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet3
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet4
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet5
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet6
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet7
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet8
mtu 1532
ip address 82.176.135.74 255.255.240.0
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
no cdp enable
!
interface Vlan1
description "LAN"
ip address 192.168.0.1 255.255.255.0
ip nat inside
ip nat enable
ip virtual-reassembly in
no autostate
!
interface Async3
no ip address
encapsulation slip
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip nat translation max-entries 10000
ip nat inside source list LAN1 interface GigabitEthernet8 overload
ip nat inside source static tcp 192.168.0.31 20 82.176.135.74 20 extendable
ip nat inside source static tcp 192.168.0.31 21 82.176.135.74 21 extendable
ip nat inside source static tcp 192.168.0.210 80 82.176.135.74 80 extendable
ip nat inside source static tcp 192.168.0.198 3389 82.176.135.74 3389 extendable
ip nat inside source static 192.168.0.101 82.176.135.74 route-map MARK
ip route 0.0.0.0 0.0.0.0 82.176.143.254
!
ip access-list standard LAN1
permit 192.168.0.0 0.0.0.255
!
ip access-list extended VOIP
permit udp host 192.168.0.101 any range 5060 6079
!
!
route-map MARK permit 10
match ip address VOIP
!
!
control-plane
!
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
!
!
line con 0
logging synchronous
no modem enable
line aux 0
line 3
modem InOut
speed 115200
flowcontrol hardware
line vty 0 4
login
transport input ssh
!
scheduler allocate 20000 1000
!
end

Thanks in advance

Erwin

[Georg Pauwen]

Hello,

first of all, check if you can ping your default gateway is still the same. You have been given a subnet with 4000+ hosts, they might have cut that up into smaller subnets without informing you.

I have made some changes to your config (marked in bold), try those and check if connectivity is restored:

Current configuration : 3003 bytes
!
version 15.5
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
no aaa new-model
ethernet lmi ce
!

ip dhcp excluded-address 192.168.0.1
ip dhcp excluded-address 192.168.0.30 192.168.0.99
ip dhcp excluded-address 192.168.0.195 192.168.0.255
!
ip dhcp pool DHCP-LAN
network 192.168.0.0 255.255.255.0
default-router 192.168.0.1
dns-server 212.115.192.100 212.115.192.193
!
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
license udi pid C891F-K9 sn FCZ204412N8
!
interface BRI0
no ip address
encapsulation hdlc
shutdown
isdn termination multidrop
!
interface FastEthernet0
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0
no ip address
!
interface GigabitEthernet1
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet2
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet3
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet4
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet5
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet6
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet7
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet8
--> no mtu 1532
ip address 82.176.135.74 255.255.240.0
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
no cdp enable
!
interface Vlan1
description "LAN"
ip address 192.168.0.1 255.255.255.0
ip nat inside
--> no ip nat enable
ip virtual-reassembly in
no autostate
!
interface Async3
no ip address
encapsulation slip
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
--> no ip nat translation max-entries 10000
ip nat inside source list LAN1 interface GigabitEthernet8 overload
ip nat inside source static tcp 192.168.0.31 20 82.176.135.74 20 extendable
ip nat inside source static tcp 192.168.0.31 21 82.176.135.74 21 extendable
ip nat inside source static tcp 192.168.0.210 80 82.176.135.74 80 extendable
ip nat inside source static tcp 192.168.0.198 3389 82.176.135.74 3389 extendable
ip nat inside source static 192.168.0.101 82.176.135.74 route-map MARK
--> ip route 0.0.0.0 0.0.0.0 GigabitEthernet8
!
ip access-list standard LAN1
permit 192.168.0.0 0.0.0.255
!
ip access-list extended VOIP
permit udp host 192.168.0.101 any range 5060 6079
!
route-map MARK permit 10
match ip address VOIP
!
control-plane
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
line con 0
logging synchronous
no modem enable
line aux 0
line 3
modem InOut
speed 115200
flowcontrol hardware
line vty 0 4
login
transport input ssh
!
scheduler allocate 20000 1000
!
end

[johnlloyd_13]

hi,

just to cover the basics, can you ping the ISP next hop .74?

have you contacted your ISP to report this issue?

can you try to hard code the DNS to 8.8.8.8 on one of the PC in the 192.168.0.0/24?

 i'll personally choose a next hop IP vs an exit interface just to avoid recursive route.

---

--> ip route 0.0.0.0 0.0.0.0 GigabitEthernet8

---

[etsoft]

Hi,

thank you. I've changed the settings you mentioned but no luck so far. I've confirmed the ip-settings with my provider. Any other suggestions?

This is the config :

! Last configuration change at 11:18:52 UTC Sat Jun 16 2018
!
version 15.5
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
ethernet lmi ce
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!

!
ip dhcp excluded-address 192.168.0.30 192.168.0.99
ip dhcp excluded-address 192.168.0.195 192.168.0.255
ip dhcp excluded-address 192.168.0.1
!
ip dhcp pool DHCP-LAN
network 192.168.0.0 255.255.255.0
default-router 192.168.0.1
dns-server 212.115.192.100 212.115.192.193
!
!
!
ip cef
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
license udi pid C891F-K9 sn FCZ204412N8
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface BRI0
no ip address
encapsulation hdlc
shutdown
isdn termination multidrop
!
interface FastEthernet0
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0
no ip address
!
interface GigabitEthernet1
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet2
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet3
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet4
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet5
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet6
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet7
no ip address
no cdp enable
spanning-tree portfast
!
interface GigabitEthernet8
ip address 82.176.135.74 255.255.240.0
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
no cdp enable
!
interface Vlan1
description "LAN"
ip address 192.168.0.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
no autostate
!
interface Async3
no ip address
encapsulation slip
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip nat inside source list LAN1 interface GigabitEthernet8 overload
ip nat inside source static tcp 192.168.0.31 20 82.176.135.74 20 extendable
ip nat inside source static tcp 192.168.0.31 21 82.176.135.74 21 extendable
ip nat inside source static tcp 192.168.0.210 80 82.176.135.74 80 extendable
ip nat inside source static tcp 192.168.0.198 3389 82.176.135.74 3389 extendable
ip nat inside source static 192.168.0.101 82.176.135.74 route-map MARK
ip route 0.0.0.0 0.0.0.0 82.176.143.254
ip route 0.0.0.0 0.0.0.0 GigabitEthernet8
!
ip access-list standard LAN1
permit 192.168.0.0 0.0.0.255
!
ip access-list extended VOIP
permit udp host 192.168.0.101 any range 5060 6079
!
!
route-map MARK permit 10
match ip address VOIP
!
!
control-plane
!
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
!
!
line con 0
logging synchronous
no modem enable
line aux 0
line 3
modem InOut
speed 115200
flowcontrol hardware
line vty 0 4
login
transport input ssh
!
scheduler allocate 20000 1000
!
end

[Georg Pauwen]

Hello,

I have seen the 800 routers sometimes work with a route map. Try and configure the below:

ip nat inside source route-map ISP_NAT interface GigabitEthernet8 overload
ip nat inside source static tcp 192.168.0.31 20 82.176.135.74 20 extendable
ip nat inside source static tcp 192.168.0.31 21 82.176.135.74 21 extendable
ip nat inside source static tcp 192.168.0.210 80 82.176.135.74 80 extendable
ip nat inside source static tcp 192.168.0.198 3389 82.176.135.74 3389 extendable
ip nat inside source static 192.168.0.101 82.176.135.74 route-map MARK
ip route 0.0.0.0 0.0.0.0 82.176.143.254
ip route 0.0.0.0 0.0.0.0 GigabitEthernet8
!
access-list 101 permit ip 192.168.0.0 0.0.0.255 any
!
route-map ISP_NAT permit 10
match ip address 101
match interface GigabitEthernet8

[mohammed01701]

Hi!

If it works before and you did not changed anything and it stops working: what i can tell you is your config is good enought, i think the best is to go back you original configuration and do the flowing test:

  - See If the interface GigabitEthernet8 is up and Ok, No errors and so on. Post the output?

  - Can you ping 82.176.143.254 source from  82.176.135.74. Post the output?

If that works fine do another test:

  - Can you ping out to world 8.8.8.8 source from 82.176.135.74? Post the output?

If that also works, the problem has to be the switch/router. 

/Mohammed

[etsoft]

Hi, hereby the output :

GigabitEthernet8 is up, line protocol is up
Hardware is PQ3_TSEC, address is 843d.c6ee.6f8e (bia 843d.c6ee.6f8e)
Internet address is 82.176.135.74/20
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full Duplex, 1Gbps, media type is RJ45
output flow-control is XON, input flow-control is XON
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:09, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/13/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 25000 bits/sec, 36 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
71993 packets input, 4371844 bytes, 0 no buffer
Received 71901 broadcasts (0 IP multicasts)
0 runts, 0 giants, 1 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
815 packets output, 48900 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
1 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out

>ping 82.176.143.254
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 82.176.143.254, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

[mohammed01701]

Hi! 

MAYBE your ISP is not allowing to use ICMP that address, can you test ping 8.8.8.8 source 82.176.135.74 post the output?

/Mohammed

[etsoft]

Hi, Both no succes. 

Regrds

Erwin

[mohammed01701]

Hi!

It is definitivt ISP problem, please Contact you ISP and tell the test you did..

Have you restarted the router efter this problem? If not restart and see it helps....

/Mohammed

[Georg Pauwen]

Hello,

on a side note, I can ping your default gateway from the outside, so that at least is reachable.

For the sake of testing, try and see if your interface can pull an IP address with DHCP, then check the mask you get...

interface GigabitEthernet8
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
no cdp enable

ip route 0.0.0.0 0.0.0.0 GigabitEthernet8 dhcp

[paul driver]

Hello

---

@etsoft wrote:

Hi,

suddenly my router is blocking internet access, the internal networks works fine but i do not have connection with the outside world, here is my config. What is wrong?

---

So you are saying it was working and it isn't now?  - if so have you made any changes or aware of any changes?

First thought you could have exceeded your licencing

res

Paul

[etsoft]

Yes, it has been working for two months and suddenly no connection anymore. What is the licencing model? 

I only use two interfaces at this moment. What are the limitations?

[paul driver]

Hello

if you haven’t changed anything and it was working fine I would strongly suggest NOT to change anything and check with your Service provider about any issues

Changing things  at this time will only cloud the root cause 

Sometimes just a good clean reboot/power cycle  of the circuit and rtr can kick things back into life?

res

paul

[etsoft]

I've called my ISP and they are saying nothing has changed. A similar instalation is still working. I have a cable connection, the other one is an optical fiber connection.

I working with an old router at this time, soho type. Nothing special and this is working.