11-22-2013 03:52 AM - edited 03-04-2019 09:39 PM
There is my configuration. I have only access with subnetwork 192.168.10.254 in the internet. With others can not ping de gateways example: 192.168.20.254 , 192.168.30.254 and 192.168.40.254.
Help me please.
Building configuration...
Current configuration : 3057 bytes
!
! Last configuration change at 12:09:50 UTC Fri Nov 22 2013
!
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
!
memory-size iomem 25
dot11 syslog
ip source-route
!
!
!
!
!
!
!
ip cef
ip name-server 62.28.40.173
ip name-server 62.28.116.41
vlan ifdescr detail
!
multilink bundle-name authenticated
!
crypto pki token default removal timeout 0
!
!
!
!
license udi pid CISCO2801 sn FCZ1208949Y
!
redundancy
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
ip address 83.240.176.242 255.255.255.252
no ip redirects
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
duplex auto
speed auto
!
interface FastEthernet0/1.1
encapsulation dot1Q 1 native
ip address 192.168.10.254 255.255.255.0
ip access-group 110 in
ip nat inside
ip virtual-reassembly in
!
interface FastEthernet0/1.2
encapsulation dot1Q 2
ip address 192.168.20.254 255.255.255.0
ip access-group 120 in
ip nat inside
ip virtual-reassembly in
!
interface FastEthernet0/1.3
encapsulation dot1Q 3
ip address 192.168.30.254 255.255.255.0
ip access-group 130 in
ip nat inside
ip virtual-reassembly in
!
interface FastEthernet0/1.4
encapsulation dot1Q 4
ip address 192.168.40.254 255.255.255.0
ip access-group 140 in
ip nat inside
ip virtual-reassembly in
!
interface ATM0/3/0
no ip address
shutdown
no atm ilmi-keepalive
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip dns server
ip nat inside source list 180 interface FastEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 83.240.176.241
!
logging esm config
access-list 110 deny ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255
access-list 110 deny ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255
access-list 110 deny ip 192.168.10.0 0.0.0.255 192.168.40.0 0.0.0.255
access-list 110 permit ip any any
access-list 120 deny ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 120 deny ip 192.168.20.0 0.0.0.255 192.168.30.0 0.0.0.255
access-list 120 deny ip 192.168.20.0 0.0.0.255 192.168.40.0 0.0.0.255
access-list 120 permit ip any any
access-list 130 deny ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 130 deny ip 192.168.30.0 0.0.0.255 192.168.20.0 0.0.0.255
access-list 130 deny ip 192.168.30.0 0.0.0.255 192.168.40.0 0.0.0.255
access-list 130 permit ip any any
access-list 140 deny ip 192.168.40.0 0.0.0.255 192.168.20.0 0.0.0.255
access-list 140 deny ip 192.168.40.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 140 deny ip 192.168.40.0 0.0.0.255 192.168.30.0 0.0.0.255
access-list 140 permit ip any any
access-list 180 permit ip 192.168.10.0 0.0.0.255 any
access-list 180 permit ip 192.168.20.0 0.0.0.255 any
access-list 180 permit ip 192.168.30.0 0.0.0.255 any
access-list 180 permit ip 192.168.40.0 0.0.0.255 any
!
!
!
!
!
control-plane
!
!
!
line con 0
line aux 0
line vty 0 4
login
transport input all
!
scheduler allocate 20000 1000
end
Router#
11-22-2013 07:15 AM
Ricardo
Can you post config of the switch indicating which port is connected to the router. Can you also post the output of "sh vlan brief" from your switch.
Obviously each vlan should only be able to ping their own gateway on the router because of your acls.
Jon
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide