nat doesn't work on cisco 871 - Page 2

ssemenenko · ‎01-01-2017

Hello, buddies.

I'm trying to configure cisco 871 for Internet access through pppoe.

Here is my config:

Current configuration : 1996 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
enable secret 5 $1$L/Qh$pAh6sCNUtAtG7tnANlFZy.
!
no aaa new-model
!
!
dot11 syslog
ip source-route
!
!
ip dhcp excluded-address 192.168.1.1
!
ip dhcp pool pooldhcp
import all
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
lease 0 2
!
!
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
vpdn enable
!
vpdn-group 1
request-dialin
protocol pppoe
!
!
!
!
!
!
archive
log config
hidekeys
!
!
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
no ip address
ip nat outside
ip nat enable
ip virtual-reassembly
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface Vlan1
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
interface Dialer0
ip address negotiated
ip mtu 1492
encapsulation ppp
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication pap callin
ppp chap refuse
ppp ms-chap refuse
ppp ms-chap-v2 refuse
ppp pap sent-username <CUTTED> password 0 <CUTTED>
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
ip route 192.168.1.0 255.255.255.0 Dialer0
no ip http server
no ip http secure-server
!
!
ip nat pool pool1 192.168.1.1 192.168.1.254 netmask 255.255.255.0 add-route
ip nat inside source list 1 interface Dialer0 overload
!
ip access-list extended TerminalAccess
permit tcp host 192.168.1.2 any eq telnet log
permit tcp host 192.168.1.2 any eq 22 log
deny tcp any any log
!
access-list 1 permit 192.168.1.0 0.0.0.255
dialer-list 1 protocol ip permit
no cdp run

!
!
!
!
!
control-plane
!
!
line con 0
no modem enable
line aux 0
line vty 0 4
access-class TerminalAccess in
login
transport input ssh
!
scheduler max-task-time 5000
end

The route connects OK and give IP addresses by dhcp server.

I can ping 8.8.8.8. But ping 8.8.8.8 source 192.168.1.1 doesn't work.

show ip nat st

Total active translations: 0 (0 static, 0 dynamic; 0 extended)
Peak translations: 0, occurred 02:10:20 ago
Outside interfaces:
FastEthernet4
Inside interfaces:
Vlan1
Hits: 0 Misses: 0
CEF Translated packets: 0, CEF Punted packets: 0
Expired translations: 0
Dynamic mappings:
-- Inside Source
[Id: 1] access-list 1 interface Dialer0 refcount 0
Appl doors: 0
Normal doors: 0
Queued Packets: 0

show ip nat tr - empty.

Could you advise me something?

Georg Pauwen · ‎01-02-2017

Hello,

I completely changed and (hopefully) simplified the configuration of your router. Try this config (make sure it is exactly the same) and see if this works:

Current configuration : 1881 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
enable secret 5 $1$L/Qh$pAh6sCNUtAtG7tnANlFZy.
!
no aaa new-model
!
!
dot11 syslog
ip source-route
!
!
ip dhcp excluded-address 192.168.1.1
!
ip dhcp pool pooldhcp
import all
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
!
ip cef
!
ip domain lookup source-interface FastEthernet4
!
ip address-pool pooldhcp
!
no ipv6 cef
!
multilink bundle-name authenticated
!
archive
log config
hidekeys
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description ISP
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface Vlan1
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1420
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 dhcp
no ip http server
no ip http secure-server
!
!
ip nat inside source list 1 interface FastEthernet4 overload
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
ip access-list extended TerminalAccess
permit tcp host 192.168.1.2 any eq telnet log
permit tcp host 192.168.1.2 any eq 22 log
deny tcp any any log
!
no cdp run
!
control-plane
!
!
line con 0
no modem enable
line aux 0
line vty 0 4
access-class TerminalAccess in
login
transport input ssh
!
scheduler max-task-time 5000
end

ssemenenko · ‎01-02-2017

1) I can't set

Router(config-if)#ip virtual-reassembly in
^
% Invalid input detected at '^' marker.

Router(config-if)#ip virtual-reassembly ?
drop-fragments Drop all the incoming fragments
max-fragments Specify max number of fragments per reassembly (datagram)
max-reassemblies Specify max number of concurrent reassemblies
timeout Specify timeout value of the datagram being reassembled

2) I can't delete ip nat inside source list NAT interface Dialer0 overload

Router(config)#no ip nat inside source list NAT interface Dialer0 overload
%Dynamic mapping not found

Georg Pauwen · ‎01-02-2017

Hello,

try and reload the router, and see if you can remove the NAT statement. The ip-virtual-reassembly command is not essential, you can leave it out.

ssemenenko · ‎01-02-2017

How it will connect to ISP without Dialer interface?

Georg Pauwen · ‎01-02-2017

Hello,

the dialer interface is just to initiate traffic. Is this a router for home use ?

ssemenenko · ‎01-02-2017

Yes. It's for home.

Georg Pauwen · ‎01-02-2017

Hello,

who is your ISP/Provider ? I want to check if there are specific requirements. The 871 really is quite simple to configure and should work with the adjustments we made. So we might be missing something else...

ssemenenko · ‎01-02-2017

I'm not sure it helps :)

it's Rostelecom in Russia.

Now i'm using this configuration:

Current configuration : 1762 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
enable secret 5 $1$L/Qh$pAh6sCNUtAtG7tnANlFZy.
!
no aaa new-model
!
!
dot11 syslog
ip source-route
!
!
ip dhcp excluded-address 192.168.1.1
!
ip dhcp pool pooldhcp
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
!
!
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
vpdn enable
!
vpdn-group 1
request-dialin
protocol pppoe
!
!
!
!
!
!
archive
log config
hidekeys
!
!
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description ISP
no ip address
ip virtual-reassembly
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface Vlan1
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
interface Dialer0
ip address negotiated
ip mtu 1492
ip nat outside
no ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication pap callin
ppp chap refuse
ppp ms-chap-v2 refuse
ppp pap sent-username <CUTTED> password 0 <CUTTED>
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
no ip http server
no ip http secure-server
!
!
ip nat inside source list 1 interface Dialer0 overload
ip nat inside source list 101 interface Dialer0 overload
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 101 permit ip any any
no cdp run

!
!
!
!
!
control-plane
!
!
line con 0
no modem enable
line aux 0
line vty 0 4
access-class TerminalAccess in
login
transport input ssh
!
scheduler max-task-time 5000
end

I set debug ip nat. When I do ping 8.8.8.8 source 192.168.1.1 from route, it shows

*Nov 23 18:51:51.699: NAT: s=192.168.1.1->178.45.185.124, d=8.8.8.8 [56]
*Nov 23 18:51:51.719: NAT*: s=8.8.8.8, d=178.45.185.124->192.168.1.1 [15784]

but when I ping 8.8.8.8 from client, here's nothing!

I think there's something wrong with vlan1-dhcp.

May be there is some useful debug command?

Georg Pauwen · ‎01-02-2017

Hello.

how are your clients physically connected to the 871 ? Do you have a hub/switch connected to one of the FastEthernet ports ?

ssemenenko · ‎01-02-2017

I have no switch.Just cable. 871 has fa0-fa3:

4-Port 10/100 Mbps Managed Switch

• Allows multiple devices to be connected in a small office, with the ability to designate a port as network DMZ

• Optional external PoE adapter for powering IP phones, to avoid individual power supplies or power injectors

• VLANs allow for secure segmentation of network resources

Georg Pauwen · ‎01-02-2017

Hello,

make sure the config looks exactly as the one below, then write to memory and reload the router:

Current configuration : 1762 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
enable secret 5 $1$L/Qh$pAh6sCNUtAtG7tnANlFZy.
!
no aaa new-model
!
!
dot11 syslog
ip source-route
!
!
ip dhcp excluded-address 192.168.1.1
!
ip dhcp pool pooldhcp
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1

dns-server 8.8.8.8 8.8.8.4
!
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
vpdn enable
!
vpdn-group 1
request-dialin
protocol pppoe
!
archive
log config
hidekeys
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description ISP
no ip address
ip virtual-reassembly
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface Vlan1
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
interface Dialer0
ip address negotiated
ip mtu 1492
ip nat outside
no ip virtual-reassembly
encapsulation ppp

ip tcp adjust-mss 1360
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication pap callin
ppp chap refuse
ppp ms-chap-v2 refuse
ppp pap sent-username <CUTTED> password 0 <CUTTED>

ppp ipcp dns request
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
no ip http server
no ip http secure-server
!
ip nat inside source list 1 interface Dialer0 overload
!
access-list 1 permit 192.168.1.0 0.0.0.255
no cdp run

!
dialer-list 1 protocol ip permit
!
control-plane
!
line con 0
no modem enable
line aux 0
line vty 0 4
access-class TerminalAccess in
login
transport input ssh
!
scheduler max-task-time 5000
end

Georg Pauwen · ‎01-02-2017

Hello,

what information did you get from Rostelecom ? Did they give you a static IP address ?

ssemenenko · ‎01-02-2017

Only username, password and protocol PPPOE. Every time IP address is different.

I use this connection on my laptop, it works.

Georg Pauwen · ‎01-02-2017

This is why earlier I wanted you to try the configuration below. If connecting your laptop directly and that works, you do not need a dialer interface or pap settings.

Configure the below and see if your clients can connect:

Current configuration : 1881 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
enable secret 5 $1$L/Qh$pAh6sCNUtAtG7tnANlFZy.
!
no aaa new-model
!
!
dot11 syslog
ip source-route
!
!
ip dhcp excluded-address 192.168.1.1
!
ip dhcp pool pooldhcp
import all
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
!
ip cef
!
ip domain lookup source-interface FastEthernet4
!
ip address-pool pooldhcp
!
no ipv6 cef
!
multilink bundle-name authenticated
!
archive
log config
hidekeys
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description ISP
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface Vlan1
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1420
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 dhcp
no ip http server
no ip http secure-server
!
ip nat inside source list 1 interface FastEthernet4 overload
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
ip access-list extended TerminalAccess
permit tcp host 192.168.1.2 any eq telnet log
permit tcp host 192.168.1.2 any eq 22 log
deny tcp any any log
!
no cdp run
!
control-plane
!
line con 0
no modem enable
line aux 0
line vty 0 4
access-class TerminalAccess in
login
transport input ssh
!
scheduler max-task-time 5000
end

ssemenenko · ‎01-02-2017

I mean I provide the same information on my laptop. It's PPPOE connection in Win7 with username and password. It will not work without authentification. Otherwise my neighbors could use my cable for free access.