I'm having strange random connection failures. Are there ineffieciency in my config?

[Chris Simon]

I've been having strange, random connection failures and I'm trying to eliminate possible causes.

What happens is while I'm browsing on the net over wifi, a link will at random not connect to the site, but instead fault to the ISP error page. It happens with highly reliable sites like google, or ebay, or whatever. If I direct connect to the cable modem, the problem site is immediately available.

I'm sitting <6 feet from a 871W router (with antenna). There's one router in my building and others are at my neighbors. 

Below is the conf file. Just to imagine how rediculious this problem is, here's a screen shot from a web page. This shows a web page I visited, and after clicking on a link (an embedded youtube video), the error showed up within the page itself.

Why would only some URLs fail to connect? Is there inefficiencies in my config?

    Building configuration...
    
    Current configuration : 4750 bytes
    !
    version 12.4
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    !
    hostname TooterTurtle
    !
    boot-start-marker
    boot-end-marker
    !
    logging buffered 51200 warnings
    no logging console
    !
    aaa new-model
    !
    !
    aaa authentication login default local
    aaa authorization exec default local
    !
    !
    aaa session-id common
    clock timezone NewYork -5
    clock summer-time NewYork date Apr 6 2003 2:00 Oct 26 2003 2:00
    !
    !
    dot11 syslog
    !
    dot11 ssid TooterTurtle
       vlan 2
       authentication open
       authentication key-management wpa
       guest-mode
       wpa-psk ascii 0 [my wifi password]
    !
    no ip source-route
    no ip gratuitous-arps
    ip cef
    no ip dhcp use vrf connected
    ip dhcp excluded-address 192.168.10.1 192.168.10.10
    ip dhcp excluded-address 10.0.0.1 10.0.0.10
    !
    ip dhcp pool vlan1
       import all
       network 192.168.10.0 255.255.255.0
       dns-server 192.168.10.1
       default-router 192.168.10.1
       domain-name Ethernet
    !
    ip dhcp pool vlan2
       import all
       network 10.0.0.0 255.255.255.0
       domain-name WiFi
       dns-server 10.0.0.1
       default-router 10.0.0.1
    !
    ip dhcp pool MrWizard
       host 192.168.10.100 255.255.255.0
       hardware-address 0011.0917.66fa
       client-name MrWizard
    !
    ip dhcp pool MasterShake
       host 192.168.10.101 255.255.255.0
       hardware-address 0022.681c.fbcc
       client-name mastershake
    !
    !
    ip auth-proxy max-nodata-conns 3
    ip admission max-nodata-conns 3
    no ip bootp server
    ip domain name mydomain.com
    ip ddns update method ccp_ddns1
     HTTP
      add [zone edit account and url]
      remove [zone edit account and url]
    !
    !
    !
    !
    username admin privilege 15 secret 5 [encrypted secret]
    !
    !
    archive
     log config
      hidekeys
    !
    !
    no ip ftp passive
    ip ssh version 1
    !
    bridge irb
    !
    !
    interface FastEthernet0
     description AdminInterface
    !
    interface FastEthernet1
     description MrWizard
    !
    interface FastEthernet2
     description Belkin
    !
    interface FastEthernet3
    !
    interface FastEthernet4
     description ComcastCableModem
     ip address dhcp
     ip verify unicast source reachable-via rx allow-default 100
     no ip redirects
     no ip unreachables
     no ip proxy-arp
     ip nat outside
     ip virtual-reassembly
     speed auto
     full-duplex
    !
    interface Dot11Radio0
     no ip address
     no ip redirects
     no ip unreachables
     no ip proxy-arp
     !
     encryption vlan 1 mode ciphers tkip
     !
     encryption vlan 2 mode ciphers tkip
     !
     ssid TooterTurtle
     !
     speed basic-1.0 basic-2.0 basic-5.5 basic-6.0 basic-9.0 basic-11.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0
     station-role root
    !
    interface Dot11Radio0.1
     description TootersWiFi
     encapsulation dot1Q 2
     no cdp enable
     bridge-group 2
     bridge-group 2 subscriber-loop-control
     bridge-group 2 spanning-disabled
     bridge-group 2 block-unknown-source
     no bridge-group 2 source-learning
     no bridge-group 2 unicast-flooding
    !
    interface Vlan1
     description EthernetOnly
     no ip address
     no ip redirects
     no ip unreachables
     no ip proxy-arp
     ip nat inside
     ip virtual-reassembly
     bridge-group 1
    !
    interface Vlan2
     description WiFiOnly
     no ip address
     bridge-group 2
    !
    interface BVI1
     description EthernetOnly
     ip address 192.168.10.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly
    !
    interface BVI2
     description WiFiOnly
     ip address 10.0.0.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly
    !
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 FastEthernet4
    !
    ip http server
    ip http authentication local
    no ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip dns server
    ip nat inside source list 101 interface FastEthernet4 overload
    ip nat inside source list 102 interface FastEthernet4 overload
    ip nat inside source static tcp 192.168.10.100 80 interface FastEthernet4 80
    !
    ip access-list extended vlan1
     deny   ip 10.0.0.0 0.0.0.255 any
     permit ip any any
    !
    access-list 100 permit udp any any eq bootpc
    access-list 101 permit ip 192.168.10.0 0.0.0.255 any
    access-list 102 permit ip 10.0.0.0 0.0.0.255 any
    no cdp run
    !
    !
    !
    control-plane
    !
    bridge 1 protocol ieee
    bridge 1 route ip
    bridge 2 protocol ieee
    bridge 2 route ip
    !
    line con 0
     no modem enable
    line aux 0
    line vty 0 4
     transport input telnet ssh
     transport output telnet ssh
    !
    scheduler max-task-time 5000
    end

[michael o'nan]

Typically you only want one overload statement on the router. Another thing I would remove ip route 0.0.0.0 0.0.0.0 FastEthernet4. I know it sounds silly but when you set that interface to DHCP it creates a default route itself (not visible in config). I have experienced many strange issues similar to this one where routing will work and then stop working and other strange issues. 

[Chris Simon]

I removed the ip router 0 0 to no great effect, which I consider to be a win.

I'm guessing that since overload is what--I understand--translates the one outside to the many inside IPs, that the suggestion to have only one overload configured means I should combine the two ip ranges into one.

I deleted 10.0.0.0 network. Changed the bridge references to 1 and vlan references to 1. Now wifi and ethernet should all be using the same internal network? That's the idea, right? Any more fat?

[EDITED]
dot11 syslog
!
dot11 ssid TooterTurtle
   vlan 1
   authentication open
   authentication key-management wpa
   guest-mode
   wpa-psk ascii 0 [my passphrase]
!
no ip source-route
no ip gratuitous-arps
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.10.1 192.168.10.10
!
ip dhcp pool vlan1
   import all
   network 192.168.10.0 255.255.255.0
   dns-server 192.168.10.1
   default-router 192.168.10.1
   domain-name Ethernet
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
no ip bootp server
ip domain name [my url]
ip ddns update method ccp_ddns1
 HTTP
  add http:...[zoneedit]
  remove http:[zoneedit]
!
!
no ip ftp passive
ip ssh version 1
!
bridge irb
!
!
interface FastEthernet0
 description AdminInterface
!
interface FastEthernet1
 description MrWizard
!
interface FastEthernet2
 description Belkin
!
interface FastEthernet3
!
interface FastEthernet4
 description ComcastCableModem
 ip address dhcp
 ip verify unicast source reachable-via rx allow-default 100
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
 speed auto
 full-duplex
!
interface Dot11Radio0
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 !
 encryption vlan 1 mode ciphers tkip
 !
 !
 ssid TooterTurtle
 !
 speed basic-1.0 basic-2.0 basic-5.5 basic-6.0 basic-9.0 basic-11.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0
 station-role root
!
interface Dot11Radio0.1
 description TootersWiFi
 encapsulation dot1Q 2
 no cdp enable
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Vlan1
 description EthernetOnly
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
 bridge-group 1
!
!
interface BVI1
 description EthernetOnly
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
!
ip forward-protocol nd
!
ip http server
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip dns server
ip nat inside source list 101 interface FastEthernet4 overload
ip nat inside source static tcp 192.168.10.100 80 interface FastEthernet4 80
!
ip access-list extended vlan1
 permit ip any any
!
access-list 100 permit udp any any eq bootpc
access-list 101 permit ip 192.168.10.0 0.0.0.255 any
no cdp run
!
!
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
!

[paul driver]

Hello

As you have RPF enabled I would NOT remove the default route  as I am on the understanding RPF  running I loose mode uses the default route -

Can you try-

1) remove the acl 100 from  RPF

2) change the default route to

ip route 0.0.0.0 0.0.0.0 Dhcp

Lastly is this router connecting to a fw and if so does that fw have the correct licence  for multiple user connections?

rs

paul

[michael o'nan]

Since FA4 is set to DHCP the ip route 0.0.0.0 0.0.0.0 dhcp is not needed. It will get the default route from ISP on DHCP request.