Cannot get outside access

hightide185 · ‎05-15-2013

I have my router setup with a gig 0/1 as my primary interface and I'm using cellular as a backup. However, I cannot get outside access

MWA-CTT#sh run
Building configuration...

Current configuration : 2596 bytes
!
! Last configuration change at 19:24:01 UTC Wed May 15 2013
! NVRAM config last updated at 19:24:03 UTC Wed May 15 2013
! NVRAM config last updated at 19:24:03 UTC Wed May 15 2013
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service internal
!
hostname MWA-CTT
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 $1$OPFk$X6REGd34.xo/ZU5nnIbQC1
enable password verizon
!
no aaa new-model
!
no ipv6 cef
!
!
!
!
!
!
!
ip dhcp excluded-address 10.1.1.1 10.1.1.20
!
ip dhcp pool DHCP_POOL
network 10.1.1.0 255.255.255.0
default-router 10.1.1.1
dns-server 8.8.8.8
!
!
ip name-server 8.8.8.8
ip cef
multilink bundle-name authenticated
!
chat-script ltescript "" "AT!CALL1" TIMEOUT 20 "OK"
crypto pki token default removal timeout 0
!
!
license udi pid CISCO1921/K9 sn FTX160685BJ
license boot module c1900 technology-package datak9
!
!
!
redundancy
!
!
controller Cellular 0/1
!
!
!
!
!
interface Loopback1
ip address 1.2.3.9 255.255.255.255
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
ip address 10.1.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
interface GigabitEthernet0/1
ip address 166.150.246.179 255.255.255.0
ip nat outside
ip virtual-reassembly in
no ip route-cache
duplex full
speed 100
no cdp enable
!
interface Cellular0/1/0
ip address negotiated
no ip unreachables
ip nat outside
ip virtual-reassembly in
encapsulation slip
load-interval 30
dialer in-band
dialer idle-timeout 0
dialer string ltescript
dialer watch-group 1
async mode interactive
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip nat inside source list 100 interface Cellular0/1/0 overload
ip nat inside source list 101 interface GigabitEthernet0/1 overload
ip route static adjust-time 1
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 166.150.246.180 100
ip route 0.0.0.0 0.0.0.0 Cellular0/1/0 166.159.128.30 110
!
access-list 100 permit ip any any
access-list 101 permit ip any any
dialer watch-list 1 ip 5.6.7.8 0.0.0.0
dialer watch-list 1 delay route-check initial 60
dialer watch-list 1 delay connect 1
!
!
!
control-plane
!
!
!
line con 0
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output lat pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line 0/1/0
script dialer ltescript
modem InOut
no exec
line 0/1/1 0/1/3
no exec
line vty 0 4
password verizon
login
transport input all
!
scheduler allocate 20000 1000
!
end

MWA-CTT#

Richard Burts · ‎05-15-2013

Sam

I believe that the biggest part of your problem is about address translation. The good news is that it is configured (and that was the first thing that I wanted to look for since failing to configure address translation is the number 1 problem for this kind of symptom). So good that it is configured . But not good for how it is configured. You are trying to translate traffic for two interfaces. But both of them use an access list that says permit any any. So how will IOS decide which one is the correct one to use. The most common approach to this issue is to configure address translation to use route maps. In the route map you can combine a match statement for an ACL with a match statement for an interface. Doing it this way prevents the ambiguity about which translation to use.

I would also suggest that your configuration for address translation avoid using permit ip any any. I would suggest that you instead use a standard ACL and permit your inside subnet. That will turn out much better.

HTH

Rick

HTH

Rick

hightide185 · ‎05-15-2013

Rick,

I made the following changes to go to route-maps, I'm stillmissign something.

ip nat inside source route-map NAT-Cell interface Cellular0/1/0 overload

ip nat inside source route-map NAT-Gi interface GigabitEthernet0/1 overload

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 166.150.246.0 100

ip route 0.0.0.0 0.0.0.0 Cellular0/1/0 166.159.128.0 110

!

access-list 100 permit ip 10.1.1.0 0.0.0.255 any

dialer watch-list 1 ip 5.6.7.8 0.0.0.0

dialer watch-list 1 delay route-check initial 60

dialer watch-list 1 delay connect 1

!

route-map NAT-Cell permit 10

match ip address 100

match interface Cellular0/1/0

!

route-map clear-df permit 10

set ip df 0

!

route-map NAT-Gi permit 10

match ip address 100

match interface GigabitEthernet0/1

Richard Burts · ‎05-15-2013

Sam

The address translation looks much better now. I still would like it better if you changed access-list 100 into access-list 10 and permitted 10.1.1.0 0.0.0.255

So why is it still not working? Lets start with a couple of things

- would you post the output of show ip interface brief

- and post the output of show ip route

- can you ping from the router to the ISP next hop address of 166.150.246.180

HTH

Rick

HTH

Rick

hightide185 · ‎05-16-2013

Rick - I do appreciate the help. I did change the Access-List to

ip nat inside source route-map NAT-Cell interface Cellular0/1/0 overload

ip nat inside source route-map NAT-Gi interface GigabitEthernet0/1 overload

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 25

ip route 0.0.0.0 0.0.0.0 Cellular0/1/0 100

!

access-list 10 permit 10.1.1.0 0.0.0.255

dialer watch-list 1 ip 5.6.7.8 0.0.0.0

dialer watch-list 1 delay route-check initial 60

dialer watch-list 1 delay connect 1

!

route-map NAT-Cell permit 10

match ip address 100

match interface Cellular0/1/0

!

route-map clear-df permit 10

set ip df 0

!

route-map NAT-Gi permit 10

match ip address 100

match interface GigabitEthernet0/1

SH IP INT BR

MWA-CTT#sh ip int br

Interface IP-Address OK? Method Status Protocol

Embedded-Service-Engine0/0 unassigned YES NVRAM administratively down down

GigabitEthernet0/0 10.1.1.1 YES NVRAM up up

GigabitEthernet0/1 166.150.246.179 YES NVRAM up up

Cellular0/1/0 166.159.128.29 YES IPCP up up

Cellular0/1/1 unassigned YES unset down down

Cellular0/1/2 unassigned YES unset down down

Cellular0/1/3 unassigned YES unset down down

Loopback1 1.2.3.9 YES NVRAM up up

NVI0 10.1.1.1 YES unset up up

MWA-CTT#sh ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       + - replicated route, % - next hop override

Gateway of last resort is 166.150.246.180 to network 0.0.0.0

S*    0.0.0.0/0 [50/0] via 166.150.246.180, GigabitEthernet0/1
      1.0.0.0/32 is subnetted, 1 subnets
C        1.2.3.9 is directly connected, Loopback1
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.1.1.0/24 is directly connected, GigabitEthernet0/0
L        10.1.1.1/32 is directly connected, GigabitEthernet0/0
      166.150.0.0/16 is variably subnetted, 2 subnets, 2 masks
C        166.150.246.0/24 is directly connected, GigabitEthernet0/1
L        166.150.246.179/32 is directly connected, GigabitEthernet0/1
      166.159.0.0/32 is subnetted, 1 subnets
C        166.159.128.29 is directly connected, Cellular0/1/0

MWA-CTT#sh ip int br
Interface                  IP-Address      OK? Method Status                Protocol
Embedded-Service-Engine0/0 unassigned      YES NVRAM administratively down down
GigabitEthernet0/0         10.1.1.1        YES NVRAM up                    up
GigabitEthernet0/1         166.150.246.179 YES NVRAM up                    up
Cellular0/1/0              166.159.128.29 YES IPCP   up                    up
Cellular0/1/1              unassigned      YES unset down                  down
Cellular0/1/2              unassigned      YES unset down                  down
Cellular0/1/3              unassigned      YES unset down                  down
Loopback1                  1.2.3.9         YES NVRAM up                    up
NVI0                       10.1.1.1        YES unset up                    up

SH IP ROUTE

MWA-CTT#sh ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       + - replicated route, % - next hop override

Gateway of last resort is 166.150.246.180 to network 0.0.0.0

S*    0.0.0.0/0 [50/0] via 166.150.246.180, GigabitEthernet0/1
      1.0.0.0/32 is subnetted, 1 subnets
C        1.2.3.9 is directly connected, Loopback1
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.1.1.0/24 is directly connected, GigabitEthernet0/0
L        10.1.1.1/32 is directly connected, GigabitEthernet0/0
      166.150.0.0/16 is variably subnetted, 2 subnets, 2 masks
C        166.150.246.0/24 is directly connected, GigabitEthernet0/1
L        166.150.246.179/32 is directly connected, GigabitEthernet0/1
      166.159.0.0/32 is subnetted, 1 subnets
C        166.159.128.29 is directly connected, Cellular0/1/0

Richard Burts · ‎05-16-2013

Sam

Thanks for the update. I have a couple of comments

- thank you for changing the access list from 100 to 10. Ultimately I think it will be helpful.

- but - the route maps are still referencing access list 100. Please change them to match access list 10.

- I notice that previous versions of the static default routes were specifying both next hop and interface and now they specify only the interface. That works ok for the Cellular but is a bit problematic for the Gig Ethernet interface. Please change at least that one to use the next hop address or both next hop address and interface.

- I also notice that both static routes are configured as floating static routes and I wonder why the one you want to prefer has an administrative distance specified?

- did you try the ping to the provider next hop address?

HTH

Rick

HTH

Rick

swgregg · ‎05-29-2013

Rick,

I wanted to at least get back to you. I was traveling the last few weeks; however, I did get everythign working, it ended up being a NATing issue, we got that sroted out and we are up and running.

thanks again for your help.

Richard Burts · ‎05-29-2013

Sam

Thanks for posting back and telling us that you have sorted it out and that it is working.

Since my first post we have been looking at various things about address translation. So it is good to know that we were on the right track in our discussion.

HTH

Rick

HTH

Rick