Re: nternet Australian VDSL NBN via Bridge Mode, not connecting

hd@ena.com.au · ‎07-13-2018

Hi

We are running a Cisco Router 2800 router with and trying to connect to the ISP (TPG) through another direct bridge modem. The Cisco 2800 Router will not Authenticate. When I connect my Laptop directly to the bridge modem, I can setup a PPPoE client and I can connect to the ISP. Can you please check my configuration and advise if I am missing something.

!
interface ATM0/3/0
shutdown
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
no atm ilmi-keepalive
dsl bitswap both
pvc 8/35
pppoe-client dial-pool-number 1
!
interface Dialer0
ip address negotiated
ip mtu 1492
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer idle-timeout 2000000
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname goldtiger
ppp chap password 7 082658421A4B554742
ppp pap sent-username goldtiger password 7 1302031E185E547A7B
no cdp enable
crypto map ESP-3DES-SHA
!
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
--More-- !
!
ip dns server
no ip nat service sip udp port 5060
ip nat inside source list 102 interface Dialer1 overload
ip nat inside source static tcp 192.100.101.1 3389 interface Dialer0 3389
ip nat inside source static udp 192.100.101.1 3391 interface Dialer0 3391
ip nat inside source static tcp 192.100.101.1 5900 interface Dialer0 5900
ip nat inside source static tcp 192.100.101.1 1723 interface Dialer0 1723
ip nat inside source static tcp 192.100.101.1 47 interface Dialer0 47
ip nat inside source static tcp 192.100.101.78 37777 interface Dialer0 37777
ip nat inside source static udp 192.100.101.78 37778 interface Dialer0 37778
ip nat inside source static tcp 192.100.101.78 800 interface Dialer0 800
ip nat inside source static tcp 192.100.101.78 443 interface Dialer0 443
ip nat inside source static tcp 192.100.101.78 554 interface Dialer0 554
ip nat inside source static udp 192.100.101.78 800 interface Dialer0 800
ip nat inside source static udp 192.100.101.78 443 interface Dialer0 443
ip nat inside source static udp 192.100.101.78 554 interface Dialer0 554
ip nat inside source route-map RMAP_1 interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 Dialer0
!
no logging trap
access-list 1 remark **IP NAT RANGES - PLACEHOLDER ONLY
access-list 1 permit 192.100.101.0 0.0.0.255
access-list 2 permit 103.196.148.0
access-list 2 permit 27.33.175.212
access-list 2 permit 59.167.215.15
access-list 2 permit 45.118.67.162
access-list 2 permit 192.100.101.1
access-list 2 permit 103.196.148.254
access-list 2 permit 103.196.148.250
access-list 2 permit 103.196.148.234
access-list 2 permit 103.196.148.233
access-list 2 permit 54.153.153.221
access-list 22 remark **SNMP & TFTP Access
access-list 22 permit 54.153.153.221
access-list 22 permit 103.196.148.0 0.0.3.255
access-list 22 deny any log
access-list 100 remark **IP NAT IN-OUT
access-list 100 remark **NAT EXEMPTION - IPSEC TUNNELS
access-list 100 deny ip host 192.100.101.1 172.16.0.80 0.0.0.7
access-list 100 remark **NAT EXEMPTION - RFC1918 SPACE
access-list 100 deny ip 192.100.101.0 0.0.0.255 10.0.0.0 0.255.255.255
access-list 100 deny ip 192.100.101.0 0.0.0.255 172.16.0.0 0.15.255.255
access-list 100 deny ip 192.100.101.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 100 remark **NAT IN - OUT
--More-- access-list 100 permit ip 192.100.101.0 0.0.0.255 any
access-list 150 remark **IPSEC VPN LIST**
access-list 150 permit ip host 192.100.101.1 172.16.0.80 0.0.0.7
dialer-list 1 protocol ip permit
no cdp run
!
!
!
route-map RMAP_1 permit 1
match ip address 100
!
snmp-server community InovaitSolutionsJAIXH0$t3d RO 22
!
!
!
!
control-plane
!
!
!
line con 0
line aux 0
line vty 0 4

Georg Pauwen · ‎07-14-2018

Hello,

there are a few things missing or misconfigured, I marked those in bold. Post the full configuration including all the crypto parts if the belwo doesn't work:

interface ATM0/3/0
--> no shutdown
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
no atm ilmi-keepalive
dsl bitswap both
pvc 8/35
pppoe-client dial-pool-number 1
!
interface Dialer0
ip address negotiated
ip mtu 1492
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer idle-timeout 2000000
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname goldtiger
ppp chap password 7 082658421A4B554742
ppp pap sent-username goldtiger password 7 1302031E185E547A7B
no cdp enable
crypto map ESP-3DES-SHA
!
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip dns server
no ip nat service sip udp port 5060
ip nat inside source list 100 interface Dialer0 overload
ip nat inside source static tcp 192.100.101.1 3389 interface Dialer0 3389
ip nat inside source static udp 192.100.101.1 3391 interface Dialer0 3391
ip nat inside source static tcp 192.100.101.1 5900 interface Dialer0 5900
ip nat inside source static tcp 192.100.101.1 1723 interface Dialer0 1723
ip nat inside source static tcp 192.100.101.1 47 interface Dialer0 47
ip nat inside source static tcp 192.100.101.78 37777 interface Dialer0 37777
ip nat inside source static udp 192.100.101.78 37778 interface Dialer0 37778
ip nat inside source static tcp 192.100.101.78 800 interface Dialer0 800
ip nat inside source static tcp 192.100.101.78 443 interface Dialer0 443
ip nat inside source static tcp 192.100.101.78 554 interface Dialer0 554
ip nat inside source static udp 192.100.101.78 800 interface Dialer0 800
ip nat inside source static udp 192.100.101.78 443 interface Dialer0 443
ip nat inside source static udp 192.100.101.78 554 interface Dialer0 554
ip nat inside source route-map RMAP_1 interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 Dialer0
!
no logging trap
access-list 1 remark **IP NAT RANGES - PLACEHOLDER ONLY
access-list 1 permit 192.100.101.0 0.0.0.255
access-list 2 permit 103.196.148.0
access-list 2 permit 27.33.175.212
access-list 2 permit 59.167.215.15
access-list 2 permit 45.118.67.162
access-list 2 permit 192.100.101.1
access-list 2 permit 103.196.148.254
access-list 2 permit 103.196.148.250
access-list 2 permit 103.196.148.234
access-list 2 permit 103.196.148.233
access-list 2 permit 54.153.153.221
access-list 22 remark **SNMP & TFTP Access
access-list 22 permit 54.153.153.221
access-list 22 permit 103.196.148.0 0.0.3.255
access-list 22 deny any log
access-list 100 remark **IP NAT IN-OUT
access-list 100 remark **NAT EXEMPTION - IPSEC TUNNELS
access-list 100 deny ip host 192.100.101.1 172.16.0.80 0.0.0.7
access-list 100 remark **NAT EXEMPTION - RFC1918 SPACE
access-list 100 deny ip 192.100.101.0 0.0.0.255 10.0.0.0 0.255.255.255
access-list 100 deny ip 192.100.101.0 0.0.0.255 172.16.0.0 0.15.255.255
access-list 100 deny ip 192.100.101.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 100 remark **NAT IN - OUT
access-list 100 permit ip 192.100.101.0 0.0.0.255 any
access-list 150 remark **IPSEC VPN LIST**
access-list 150 permit ip host 192.100.101.1 172.16.0.80 0.0.0.7
dialer-list 1 protocol ip permit
no cdp run
!
route-map RMAP_1 permit 1
match ip address 100
match interface Dialer0
!
snmp-server community InovaitSolutionsJAIXH0$t3d RO 22
!
control-plane
!
line con 0
line aux 0
line vty 0 4

hd@ena.com.au · ‎07-14-2018

Thank you for the reply Georg, for some reason I didn't post the whole configuration, I am not using the ATM Interface as I have a modem device in front of the Cisco router which has a VDSL Interface which is set in bridge mode. Do I still need to activate the ATM even I am not using it. Thanks in advance.

hd@ena.com.au · ‎07-14-2018

Sorry I did't post the full configuration, it is now listed below. I am not using the ATM interface, instead using fe0/0. Thanks in advance.

Building configuration...

Current configuration : 5456 bytes
!
! Last configuration change at 07:47:40 UTC Tue Apr 17 2018
version 15.1
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service internal
service sequence-numbers
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$b2HM$Ll1RKdFvrNhdXLALL7E/S1
enable password 7 096A4B1B0B04051B5A5C
!
aaa new-model
!
aaa session-id common
!
dot11 syslog
ip source-route
!
ip cef
!
!
ip inspect WAAS flush-timeout 10
ip domain name goldtiger.cpe.jaixcloud.net
ip name-server 8.8.8.8
!
multilink bundle-name authenticated
!
crypto pki token default removal timeout 0
!
license udi pid CISCO2811 sn FHK0941F1EJ
username ena secret 5 $1$NH9s$XEOy4N.IsJfI2zG4OEqKK0
username jaix secret 5 $1$InTE$AsblW7EW/6g1/9DFp4MKH/
!
redundancy
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key 378SAZDhjikbw3er address 119.148.67.130
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto map ESP-3DES-SHA 1 ipsec-isakmp
description VPN Tunnel to JaixCloud_APIServices
set peer 119.148.67.130
set security-association lifetime seconds 28800
set transform-set ESP-3DES-SHA
set pfs group1
match address 150

interface FastEthernet0/0
description Connect to Internet Circuit
ip address dhcp
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
no cdp enable
no mop enabled
!
interface FastEthernet0/1
description **UPLINK TO XXXX LAN
ip address 192.100.101.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
duplex auto
speed auto
hold-queue 255 out
!
interface ATM0/3/0
shutdown
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
no atm ilmi-keepalive
dsl bitswap both
pvc 8/35
pppoe-client dial-pool-number 1
!
interface Dialer0
ip address negotiated
ip mtu 1492
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer idle-timeout 2000000
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname XXXXXXXX
ppp chap password 7 082658421A4B554742
ppp pap sent-username XXXXXX password 7 1302031E185E547A7B
no cdp enable
crypto map ESP-3DES-SHA
!
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip dns server
no ip nat service sip udp port 5060
ip nat inside source list 102 interface Dialer1 overload
ip nat inside source static tcp 192.100.101.1 3389 interface Dialer0 3389
ip nat inside source static udp 192.100.101.1 3391 interface Dialer0 3391
ip nat inside source static tcp 192.100.101.1 5900 interface Dialer0 5900
ip nat inside source static tcp 192.100.101.1 1723 interface Dialer0 1723
ip nat inside source static tcp 192.100.101.1 47 interface Dialer0 47
ip nat inside source static tcp 192.100.101.78 37777 interface Dialer0 37777
ip nat inside source static udp 192.100.101.78 37778 interface Dialer0 37778
ip nat inside source static tcp 192.100.101.78 800 interface Dialer0 800
ip nat inside source static tcp 192.100.101.78 443 interface Dialer0 443
ip nat inside source static tcp 192.100.101.78 554 interface Dialer0 554
ip nat inside source static udp 192.100.101.78 800 interface Dialer0 800
ip nat inside source static udp 192.100.101.78 443 interface Dialer0 443
ip nat inside source static udp 192.100.101.78 554 interface Dialer0 554
ip nat inside source route-map RMAP_1 interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 Dialer0
!
no logging trap
access-list 1 remark **IP NAT RANGES - PLACEHOLDER ONLY
access-list 1 permit 192.100.101.0 0.0.0.255
access-list 2 permit 103.196.148.0
access-list 2 permit 27.33.175.212
access-list 2 permit 59.167.215.15
access-list 2 permit 45.118.67.162
access-list 2 permit 192.100.101.1
access-list 2 permit 103.196.148.254
access-list 2 permit 103.196.148.250
access-list 2 permit 103.196.148.234
access-list 2 permit 103.196.148.233
access-list 2 permit 54.153.153.221
access-list 22 remark **SNMP & TFTP Access
access-list 22 permit 54.153.153.221
access-list 22 permit 103.196.148.0 0.0.3.255
access-list 22 deny any log
access-list 100 remark **IP NAT IN-OUT
access-list 100 remark **NAT EXEMPTION - IPSEC TUNNELS
access-list 100 deny ip host 192.100.101.1 172.16.0.80 0.0.0.7
access-list 100 remark **NAT EXEMPTION - RFC1918 SPACE
access-list 100 deny ip 192.100.101.0 0.0.0.255 10.0.0.0 0.255.255.255
access-list 100 deny ip 192.100.101.0 0.0.0.255 172.16.0.0 0.15.255.255
access-list 100 deny ip 192.100.101.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 100 remark **NAT IN - OUT
access-list 100 permit ip 192.100.101.0 0.0.0.255 any
access-list 150 remark **IPSEC VPN LIST**
access-list 150 permit ip host 192.100.101.1 172.16.0.80 0.0.0.7
dialer-list 1 protocol ip permit
no cdp run
!
route-map RMAP_1 permit 1
match ip address 100
snmp-server community InovaitSolutionsJAIXH0$t3d RO 22
!
control-plan

Georg Pauwen · ‎07-14-2018

Howdy,

in that case you don't need the ATM interface. I have made some minor changes (marked in bold) which should get you connected. Make sure the access list and dialer interface numbers are exactly as in the config below:

Building configuration...

Current configuration : 5456 bytes
!
! Last configuration change at 07:47:40 UTC Tue Apr 17 2018
version 15.1
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service internal
service sequence-numbers
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$b2HM$Ll1RKdFvrNhdXLALL7E/S1
enable password 7 096A4B1B0B04051B5A5C
!
aaa new-model
!
aaa session-id common
!
dot11 syslog
ip source-route
!
ip cef
!
ip inspect WAAS flush-timeout 10
ip domain name goldtiger.cpe.jaixcloud.net
ip name-server 8.8.8.8
!
multilink bundle-name authenticated
!
crypto pki token default removal timeout 0
!
license udi pid CISCO2811 sn FHK0941F1EJ
username ena secret 5 $1$NH9s$XEOy4N.IsJfI2zG4OEqKK0
username jaix secret 5 $1$InTE$AsblW7EW/6g1/9DFp4MKH/
!
redundancy
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key 378SAZDhjikbw3er address 119.148.67.130
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto map ESP-3DES-SHA 1 ipsec-isakmp
description VPN Tunnel to JaixCloud_APIServices
set peer 119.148.67.130
set security-association lifetime seconds 28800
set transform-set ESP-3DES-SHA
set pfs group1
match address 150

!

interface FastEthernet0/0
description Connect to Internet Circuit

no ip address
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
no cdp enable
no mop enabled
!
interface FastEthernet0/1
description **UPLINK TO XXXX LAN
ip address 192.100.101.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
duplex auto
speed auto
hold-queue 255 out
!
interface ATM0/3/0
shutdown
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
no atm ilmi-keepalive
dsl bitswap both
pvc 8/35
pppoe-client dial-pool-number 1
!
interface Dialer0
ip address dhcp
ip mtu 1492
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer idle-timeout 2000000
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname XXXXXXXX
ppp chap password 7 082658421A4B554742
ppp pap sent-username XXXXXX password 7 1302031E185E547A7B
no cdp enable
crypto map ESP-3DES-SHA
!
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip dns server
no ip nat service sip udp port 5060
ip nat inside source list 100 interface Dialer0 overload
ip nat inside source static tcp 192.100.101.1 3389 interface Dialer0 3389
ip nat inside source static udp 192.100.101.1 3391 interface Dialer0 3391
ip nat inside source static tcp 192.100.101.1 5900 interface Dialer0 5900
ip nat inside source static tcp 192.100.101.1 1723 interface Dialer0 1723
ip nat inside source static tcp 192.100.101.1 47 interface Dialer0 47
ip nat inside source static tcp 192.100.101.78 37777 interface Dialer0 37777
ip nat inside source static udp 192.100.101.78 37778 interface Dialer0 37778
ip nat inside source static tcp 192.100.101.78 800 interface Dialer0 800
ip nat inside source static tcp 192.100.101.78 443 interface Dialer0 443
ip nat inside source static tcp 192.100.101.78 554 interface Dialer0 554
ip nat inside source static udp 192.100.101.78 800 interface Dialer0 800
ip nat inside source static udp 192.100.101.78 443 interface Dialer0 443
ip nat inside source static udp 192.100.101.78 554 interface Dialer0 554
ip nat inside source route-map RMAP_1 interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 Dialer0 dhcp
!
no logging trap
access-list 1 remark **IP NAT RANGES - PLACEHOLDER ONLY
access-list 1 permit 192.100.101.0 0.0.0.255
access-list 2 permit 103.196.148.0
access-list 2 permit 27.33.175.212
access-list 2 permit 59.167.215.15
access-list 2 permit 45.118.67.162
access-list 2 permit 192.100.101.1
access-list 2 permit 103.196.148.254
access-list 2 permit 103.196.148.250
access-list 2 permit 103.196.148.234
access-list 2 permit 103.196.148.233
access-list 2 permit 54.153.153.221
access-list 22 remark **SNMP & TFTP Access
access-list 22 permit 54.153.153.221
access-list 22 permit 103.196.148.0 0.0.3.255
access-list 22 deny any log
access-list 100 remark **IP NAT IN-OUT
access-list 100 remark **NAT EXEMPTION - IPSEC TUNNELS
access-list 100 deny ip host 192.100.101.1 172.16.0.80 0.0.0.7
access-list 100 remark **NAT EXEMPTION - RFC1918 SPACE
access-list 100 deny ip 192.100.101.0 0.0.0.255 10.0.0.0 0.255.255.255
access-list 100 deny ip 192.100.101.0 0.0.0.255 172.16.0.0 0.15.255.255
access-list 100 deny ip 192.100.101.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 100 remark **NAT IN - OUT
access-list 100 permit ip 192.100.101.0 0.0.0.255 any
access-list 150 remark **IPSEC VPN LIST**
access-list 150 permit ip host 192.100.101.1 172.16.0.80 0.0.0.7
dialer-list 1 protocol ip permit
no cdp run
!
route-map RMAP_1 permit 1
match ip address 100

match interface Dialer0

!
snmp-server community InovaitSolutionsJAIXH0$t3d RO 22
!
control-plan

nternet Australian VDSL NBN via Bridge Mode, not connecting

Router to Internet Australian VDSL NBN via Bridge Mode, not connecting