Hello,
My old office uses Cisco 861 as a VPN router, with the WAN side setup to receive a dynamic IP assigned by Time Warner cable. Now we switched to a new office, with TowerStream which provide 4G SLA'ed 10Mbit service with static IP, and I get a Cat 5 ethernet down from it.
So all I did, was to go my "interface FastEthernet4", and typed
ip address 173.243.123.123 255.255.255.252.
Changed speed to "speed 100" and "full-duplex" (as instructed by the ISP).
I also did "ip default-gateway 173.243.123.124", which is the default gate way assigned by the ISP.
I also typed "ip name-server 64.17.123.123" to setup the new DNS, am I doing anything wrong? I can't even use the router to ping google, but if I connect the laptop directly to the outside line, then it works, so I know the outside line is good.
Am I not doing something right? Why can't I connect to the internet? I wasted several hours already trying everything in my book to trouble shoot a supposedly very simple configuration change. Do I need to change something related to NAT when changing to Static IP? My NAT was working just fine before when under DHCP.
Thanks for the help!
The below is my full config (some IPs changed to preserve anonymity):
=============================================
Building configuration...
Current configuration : 16628 bytes
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname PureGate
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
logging buffered 51200 informational
enable secret 5 adsfasdf
enable password 7 asdfasdfdasf
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication login ciscocp_vpn_xauth_ml_1 local
aaa authorization exec default local
aaa authorization network ciscocp_vpn_group_ml_1 local
!
!
aaa session-id common
clock timezone PCTime -8
clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
!
crypto pki trustpoint TP-self-signed-1245995727
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1245995727
revocation-check none
rsakeypair TP-self-signed-1245995727
!
crypto pki trustpoint test_trustpoint_config_created_for_sdm
subject-name e=sdmtest@sdmtest.com
revocation-check crl
!
!
crypto pki certificate chain TP-self-signed-1234213421342134
certificate self-signed 01
adsfasdfadfasdfasdfasf
quit
crypto pki certificate chain test_trustpoint_config_created_for_sdm
no ip source-route
!
ip dhcp pool ccp-pool1
import all
network 10.2.2.0 255.255.255.0
default-router 10.2.2.1
dns-server 10.2.2.1
domain-name local
!
!
ip dhcp update dns
ip cef
ip domain name local
ip host local ns ns.local
ip host trac.local 10.2.2.7
ip host ns.local 10.2.2.1
ip host-list members.dyndns.org
ip host-list mydomain.dyndns.org
ip name-server 64.17.123.123
ip name-server 64.17.123.124
ip name-server 4.2.2.1
ip ddns update method ccp_ddns
HTTP
add http://mydomain:passwd@members.dyndns.org/nic/update?system=dyndns&hostname=passwd@members.dyndns.org/nic/update?system=dyndns&hostname=<h>&myip=<a>
remove http://mydomain:passwd@members.dyndns.org/nic/update?system=dyndns&hostname=passwd@members.dyndns.org/nic/update?system=dyndns&hostname=<h>&myip=<a>
interval maximum 28 0 0 0
interval minimum 28 0 0 0
!
ip dhcp-client update dns server both
!
!
parameter-map type regex ccp-regex-nonascii
pattern [^\x00-\x80]
parameter-map type protocol-info msn-servers
server name messenger.hotmail.com
server name gateway.messenger.hotmail.com
server name webmessenger.msn.com
parameter-map type protocol-info aol-servers
server name login.oscar.aol.com
server name toc.oscar.aol.com
server name oam-d09a.blue.aol.com
parameter-map type protocol-info yahoo-servers
server name scs.msg.yahoo.com
server name scsa.msg.yahoo.com
server name scsb.msg.yahoo.com
server name scsc.msg.yahoo.com
server name scsd.msg.yahoo.com
server name cs16.msg.dcn.yahoo.com
server name cs19.msg.dcn.yahoo.com
server name cs42.msg.dcn.yahoo.com
server name cs53.msg.dcn.yahoo.com
server name cs54.msg.dcn.yahoo.com
server name ads1.vip.scd.yahoo.com
server name radio1.launch.vip.dal.yahoo.com
server name in1.msg.vip.re2.yahoo.com
server name data1.my.vip.sc5.yahoo.com
server name address1.pim.vip.mud.yahoo.com
server name edit.messenger.yahoo.com
server name messenger.yahoo.com
server name http.pager.yahoo.com
server name privacy.yahoo.com
server name csa.yahoo.com
server name csb.yahoo.com
server name csc.yahoo.com
!
!
username admin privilege 15 secret 5 asdfasdfasdfas
username user2 privilege 15 secret 5 adsfasdfasdfas
!
crypto logging ezvpn
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp client configuration address-pool local SDM_POOL_1
!
crypto isakmp client configuration group Company
key sdfgsdfgdsgsd
dns 4.2.2.1 4.2.2.2
pool SDM_POOL_1
acl 102
include-local-lan
max-users 100
netmask 255.255.255.0
banner ^CWelcome to company VPN! Split tunneling is enabled. ^C
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto ipsec profile CiscoCP_Profile1
set security-association idle-time 3600
set transform-set ESP-3DES-SHA
set isakmp-profile ciscocp-ike-profile-1
!
!
crypto ctcp port 10000
archive
log config
hidekeys
!
!
ip tcp synwait-time 10
!
class-map type inspect match-any SDM_HTTPS
match access-group name SDM_HTTPS
class-map type inspect match-any SDM_SSH
match access-group name SDM_SSH
class-map type inspect match-any SDM_SHELL
match access-group name SDM_SHELL
class-map type inspect match-any sdm-cls-access
match class-map SDM_HTTPS
match class-map SDM_SSH
match class-map SDM_SHELL
class-map type inspect imap match-any ccp-app-imap
match invalid-command
class-map type inspect match-any SDM_AH
match access-group name SDM_AH
class-map type inspect match-any CCP-Voice-permit
match protocol h323
match protocol skinny
match protocol sip
class-map type inspect match-any ccp-cls-insp-traffic
match protocol cuseeme
match protocol dns
match protocol ftp
match protocol h323
match protocol https
match protocol icmp
match protocol imap
match protocol pop3
class-map type inspect match-all ccp-insp-traffic
match class-map ccp-cls-insp-traffic
class-map type inspect match-any SDM_IP
match access-group name SDM_IP
class-map type inspect match-any SDM_ESP
match access-group name SDM_ESP
class-map type inspect match-any SDM_EASY_VPN_SERVER_TRAFFIC
match protocol isakmp
match protocol ipsec-msft
match class-map SDM_AH
match class-map SDM_ESP
class-map type inspect match-all SDM_EASY_VPN_SERVER_PT
match class-map SDM_EASY_VPN_SERVER_TRAFFIC
class-map type inspect ymsgr match-any ccp-app-yahoo-otherservices
match service any
class-map type inspect msnmsgr match-any ccp-app-msn-otherservices
match service any
class-map type inspect match-any ccp-cls-icmp-access
match protocol icmp
match protocol tcp
match protocol udp
class-map type inspect match-any ccp-cls-protocol-im
match protocol ymsgr yahoo-servers
match protocol msnmsgr msn-servers
match protocol aol aol-servers
class-map type inspect aol match-any ccp-app-aol-otherservices
match service any
class-map type inspect match-all ccp-protocol-pop3
match protocol pop3
class-map type inspect pop3 match-any ccp-app-pop3
match invalid-command
class-map type inspect match-all sdm-access
match class-map sdm-cls-access
match access-group 101
class-map type inspect msnmsgr match-any ccp-app-msn
match service text-chat
class-map type inspect ymsgr match-any ccp-app-yahoo
match service text-chat
class-map type inspect match-all ccp-protocol-im
match class-map ccp-cls-protocol-im
class-map type inspect match-all ccp-invalid-src
match access-group 100
class-map type inspect match-all ccp-icmp-access
match class-map ccp-cls-icmp-access
class-map type inspect http match-any ccp-app-httpmethods
match request method bcopy
match request method bdelete
match request method bmove
match request method bpropfind
match request method bproppatch
match request method connect
match request method copy
match request method delete
match request method edit
match request method getattribute
match request method getattributenames
match request method getproperties
match request method index
match request method lock
match request method mkcol
match request method mkdir
match request method move
match request method notify
match request method options
match request method poll
match request method propfind
match request method proppatch
match request method put
match request method revadd
match request method revlabel
match request method revlog
match request method revnum
match request method save
match request method search
match request method setattribute
match request method startrev
match request method stoprev
match request method subscribe
match request method trace
match request method unedit
match request method unlock
match request method unsubscribe
class-map type inspect http match-any ccp-http-blockparam
match request port-misuse im
match request port-misuse p2p
match req-resp protocol-violation
class-map type inspect match-all ccp-protocol-imap
match protocol imap
class-map type inspect aol match-any ccp-app-aol
match service text-chat
class-map type inspect match-all ccp-protocol-http
match protocol http
class-map type inspect http match-any ccp-http-allowparam
match request port-misuse tunneling
!
!
!
!
interface Null0
no ip unreachables
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description $ES_WAN$$FW_OUTSIDE$$ETH-WAN$
ip dhcp client update dns server none
ip ddns update hostname members.dyndns.org
ip ddns update ccp_ddns1
ip address 173.243.123.123 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip flow egress
ip nat outside
ip nat enable
ip virtual-reassembly
speed 100
full-duplex
!
interface Virtual-Template1 type tunnel
ip unnumbered Vlan1
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip flow egress
ip nat inside
ip virtual-reassembly
tunnel mode ipsec ipv4
tunnel protection ipsec profile CiscoCP_Profile1
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
ip address 10.2.2.1 255.255.255.0
no ip redirects
no ip unreachables
ip flow ingress
ip flow egress
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
!
ip local pool SDM_POOL_1 10.2.2.100 10.2.2.254
ip default-gateway 173.243.123.124
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip flow-top-talkers
top 100
sort-by bytes
cache-timeout 1000
!
ip dns server
ip nat inside source list 1 interface FastEthernet4 overload
ip nat inside source static tcp 10.0.0.12 80 interface FastEthernet4 999
!
ip access-list extended DYNDNS
permit tcp host 204.13.248.112 eq 443 any established log
ip access-list extended SDM_AH
remark CCP_ACL Category=1
permit ahp any any
ip access-list extended SDM_ESP
remark CCP_ACL Category=1
permit esp any any
ip access-list extended SDM_HTTPS
remark CCP_ACL Category=1
permit tcp any any eq 443
ip access-list extended SDM_IP
remark CCP_ACL Category=1
permit ip any any
ip access-list extended SDM_SHELL
remark CCP_ACL Category=1
permit tcp any any eq cmd
ip access-list extended SDM_SSH
remark CCP_ACL Category=1
permit tcp any any eq 22
ip access-list extended VNC
permit tcp any any eq 999
ip access-list extended kwVNC
remark CCP_ACL Category=1
remark kwVNC
permit tcp any host 10.0.0.19 eq 999
!
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 10.0.0.0 0.0.0.255
access-list 1 permit 10.2.2.0 0.0.0.255
access-list 2 permit 10.0.0.20
access-list 2 remark CCP_ACL Category=1
access-list 2 permit 10.0.0.21
access-list 3 remark CCP_ACL Category=1
access-list 3 permit 10.0.0.11
access-list 3 permit 10.0.0.15
access-list 4 remark CCP_ACL Category=1
access-list 4 permit 10.0.0.14
access-list 4 permit 10.0.0.16
access-list 10 remark CCP_ACL Category=16
access-list 10 permit 10.0.0.19
access-list 100 remark CCP_ACL Category=128
access-list 100 permit ip host 255.255.255.255 any
access-list 100 permit ip 127.0.0.0 0.255.255.255 any
access-list 101 remark CCP_ACL Category=128
access-list 101 permit ip any any
access-list 102 remark CCP_ACL Category=4
access-list 102 permit ip 10.2.2.0 0.0.0.255 any
no cdp run
!
control-plane
!
banner exec ^C
