One more try with IOS, then we resort to intimidation and name calling

[t.laidacker4425]

I recently posted a problem on this forum that had to do with my new (used) 1811 and being unable to get the router to get its outside address from DHCP. I was assisted by a very helpful person named Peter, who was able to help me make great strides. I'm not sure if the truck crashed into me or me into it, but since working with Peter, my 1811 (config) is essentially a wreck, I think. My router is now addressed via DHCP from our cable modem, however, on Saturday when the DHCP first began working and my PCs were indicating i-net connectivity, i was unable to browse due to not getting dns name resolutions. I think Peter may have taken care of this when he gave me some ACL suggestions, but now... my PC's won't connect to the router. I've attached my config. Could someone (Pete, maybe?) give me a bit more help, please? Or maybe suggest some really good insults I could try throwing at this router? I've tried intimidation, threatened to donate it to the local grade school.... it didn't even flinch.

thanks in advance.

T

[Jon Marshall]

Terry

Cisco routers don't respond well to intimidation, they just laugh at you

Okay couple of things -

1) are the clients meant to be getting IPs from the router via DHCP because if they are your DHCP pool is missing the actual IPs ie. you have in your config -

ip dhcp pool sdm-pool

   dns-server 68.xxx.xxx.16 68.xxx.xxx.16 

   lease 0 1

you need to add the IP subnet details + any excluded addresses which would include vlan 1 interface IP of 192.168.0.1

2) once that is done (assuming it needs doing on the router), then your NAT config is incomplete - add

access-list 1 permit 192.168.0.0 0.0.0.255

Jon

[Jon Marshall]

Terry

It also looks like you are missing a default-route for the internet traffic. It sounds like the config changes weren't saved and perhaps the router was rebooted ?

It may be worth revisiting the thread with Peter to make sure you have everything you should have.

Jon

[Peter Paluch · Accepted solution]

Hello Terry and Jon,

Jon, you are correct - the configuration is missing the network statement in the DHCP pool specification, and also for some reason, all ACLs are gone. I just wanted to rework some of them - Terry probably managed to remove all of them. The ACL 1 needs to be configured just as you suggested, and there was ACL 101 configured on the Fa0 in the in direction. That ACL is specified in my previous thread but I am putting it at the bottom of this post once again.

Regarding the default route: as Terry is using DHCP on its external interface, the DHCP will assign the default gateway as well as IP address to Terry's router. There should be no static default route specified.

Terry: I have responded to you the last evening but probably you missed it Please take into account the fact of time shift between our timezones - together with my other work engagements, it may take up to 24+ hours till I respond. In any case, let us continue the discussion in this thread now.

Now, here follows the updated configuration that should be pasted, i.e. added as-is, into your router as displayed here (in the global configuration mode):

ip dhcp excluded-address 192.168.0.1 192.168.0.10
ip dhcp pool sdm-pool
 network 192.168.0.0 255.255.255.0
 default-router 192.168.0.1
!
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 101 remark auto generated by SDM firewall configuration
access-list 101 remark SDM_ACL Category=1
access-list 101 permit udp host 68.105.29.16 eq domain any
access-list 101 permit udp host 68.105.28.16 eq domain any
access-list 101 permit icmp any any echo-reply
access-list 101 permit icmp any any time-exceeded
access-list 101 permit icmp any any unreachable
access-list 101 permit icmp any any packet-too-big
access-list 101 permit udp any eq bootps any eq bootpc
access-list 101 deny   ip 10.0.0.0 0.255.255.255 any
access-list 101 deny   ip 172.16.0.0 0.15.255.255 any
access-list 101 deny   ip 192.168.0.0 0.0.255.255 any
access-list 101 deny   ip 127.0.0.0 0.255.255.255 any
access-list 101 deny   ip host 255.255.255.255 any
access-list 101 deny   ip any any log
!
interface FastEthernet0
 ip access-group 101 in
!
end 

After pasting all these lines directly into your router after entering the global config mode using the configure terminal command, save the configuration using the write command entered in the command line.

Please make tests of the connectivity with these changes and let us know. I am also interested in knowing if the connectivity remains functional after powering the router off and back on.

Best regards,

Peter

[Giuseppe Larosa]

Hello Terry,

Peter is one of our best contributors and all of us are providing help for free.

Something has gone wrong.

Hopefully Peter himself is providing the missing lines

Generally speaking we are CLI geeks that thrive on the CLI shell.

Many times we try to help people that has configured their routers with SDM GUI.

SDM tool is helpful but as any SW it might have issues and this has happened in the past in some cases

so the lines to be added should be added manually on the CLI as a general purpose advice, doing it via SDM might lead to different results.

also sometimes it takes time for us to digest a configuration built by SDM as it introduces many features and not all the configuration is exposed for user safety.

Best Regards

Giuseppe

[Peter Paluch]

Giuseppe,

Thank you very much. I couldn't say it better.

I appreciate your kind words immensely - thank you!

Best regards,

Peter

[t.laidacker4425]

All of you guys are fantastic, if the truth be told. It is rare in today's world to find (what is, in my opinion) top-notch professional advice and a neighborly desire to help in the same place. I can completely understand how someone could become a "CLI geek," I'm a techie at heart and hoo-boy! does this router scream technical. In fact, my frustration, to a large degree stems from being seemingly outsmarted by a computing platform, which has never happened before. I've always been able to read some documentation, browse the reference material and voila! impressed murmers from the audience... I tip my hat to you gentlemen and truly respect how much time and effort must have gone into becoming "CLurus" [yep, I dared... cheesy i know]

ok back to business...

it's quite strange that the acl 101 list didn't show up in the file i attached, because it is in my running/startup configs. I think it might be because i patched together two console logs instead of using SDM to save a copy.

anyhow, i'm going to check my running-config against the changes you guys have for me and sync up, then i'll repost my running-config if i still experience any problems.

again, thanx guys... you'll have to let me know where to send the christmas cards.

[Peter Paluch]

Terry,

Forget about SDM Please work with the console (at least until we get this solved)

You can get the entire running-config output simply by either telnetting or consoling to your router and using the log function in PuTTY or HyperTerminal. Then, issue the two following commands:

terminal length 0

show running-config

and voila - there you have it, the entire configuration (the first line turns off paging for the current session).

Best regards,

Peter

[t.laidacker4425]

Oh, I'm with you 100% Peter, as far as the SDM goes. All of my screwed up ACL entries were initially generated through SDM's "wizards" and via information gleened from its help interface. I would like to note though, I swear that I made very valiant attempts through CLI/IOS before resorting to the Silly Darn Machine interface, and after trying it out... I shan't be back.

Oh!! almost forgot, kudos and cigars guys! The 1811 is up and running correctly in all respects... well, except that it keeps growling and nipping at the Netgear box, I might have to seperate them for the Netgear's sake.

Everybody here at Artistic Iron Works vastly appreciates your expertise, friendliness and help.

I don't care what the D-Link guys say about ya, in my book, you guys are A-1

I'm going to pose a similar question as to my final in the other discussion I had started. I have literally read 34 different cisco publishings concerning the 1811 and the CLI. I have a much higher than average technical aptitude and usually find I'm able to read documentation and reference materials and comprehend their content as it translates into the real world. But, without your generous help... I'm not confident that I could have ever stumbled onto even a partially working config. So my question is... Is Cisco holding out on me? [ just kidding ] for future changes to the network, routine maintenance, or whatever, what documentation/references would you recommend the most (if you can remember, its probably been a minute since you guys have had to read any of that stuff) the IOS stuff, the CLI stuff, the IP routing references, ... I'm just trying to think ahead, I enjoyed working with you guys, but I'd also like the day to come when I could pay this forum back by answering someone call for help.

Thanks guys, I've gotta go the 1811 is picking on the FVG again...   

[Peter Paluch]

Hello Terry,

Has somebody told you already that you are one of the most pleasant persons to give assistance to? I really mean it!

Regarding the recommended learning materials, one of the best courses of action would be to enroll into a Cisco Networking Academy if there is any nearby. The world of Cisco IOS (which is really what you are looking into) is actually a small universe and it simply takes time to get grasp of, and the Networking Academy does a good job of building a solid foundation in small steps.

Perhaps one of the major things to be aware of is that Cisco usually does not create a cookbook style of documentation - "you write these lines here and those lines there, and voila, you may now pull the rabbit out of your hat". Instead, you are expected to become well-versed first and foremost in the actual protocols, technologies, architectures, principles - simply the networking knowledge itself, apart from implementation specifics (Cisco, Juniper, HP, Huawei, ...). Then, when you start reading Cisco manuals, you see things in a completely different light because you start understanding how Cisco implements this or that part of the particular protocol or functionality.

Right now, I can understand that even browsing over the Cisco documentation was proving difficult and incomprehensible, because it already requires having a networking foundation. Maybe that is exactly what confused you when you browsed over the documentation - the implicit requirement to already know the protocols and stuff. You should really consider the Cisco documentation as assuming that you already have the knowledge of the protocols, and you are then looking at how Cisco in particular implements them and how you can control their operation.

A good source of materials is the IOS documentation, I suggest starting here:

http://www.cisco.com/en/US/products/ps6441/tsd_products_support_series_home.html

The most important parts of this documentation are:

• Configuration Guides - as suggested, they represent how-to's about configuring the diverse protocols, functions, etc. supported by the IOS. Probably the best place to start. Note that there are tens of these guides, sorted by various functionalities and protocols.
• Command References - contain detailed descriptions of IOS commands including the individual keywords, their meanings, variants, IOS versions in which the commands were first introduced or modified, etc.
• Master Index - as there are thousands of commands and sometimes it is difficult to find out into which Command Reference a particular command belongs, the master index is an alphabetical index of all commands with links to the appropriate command references

There are also various other whitepapers, datasheets, support materials etc. - it is about browsing around the Cisco website for a couple of weeks and making bookmarks... and reading, reading, reading...

And also about coming here again on CSC, as this forum exists exactly for people like you striving to find answers... and after a while, starting to provide answers yourself.

You are more than welcome.

Best regards,

Peter

[t.laidacker4425]

Well Peter, once again I'm back to thank you for good advice. As I am sort of working as a freelance network consultant, (amazing how that's even possible, given what I've recently learned I DON'T know) and will be on call permanently with this particular company (thanks to you guys) I am going to look into the Cisco Net Acadamy. Maybe when I graduate I'll wirte a "Cisco for Dummies" book and get rich.

thanks guys

Terry Laidacker