10-04-2015 05:40 PM - edited 03-05-2019 02:27 AM
I was at one point able to with it with a DHCP. I was jumping up and down for joy. Now I'm back in the trenches, on a battle field hurtling grenades.
I need to set up a static IP address on a computer. Lets go with 192.168.41.29 netmask 255.255.255.0, gateway 192.168.41.1
I need to connect it into g0/2
I need g0/0 overloaded with 192.168.41.x so that I can ping the internet. The current configuration is below... please help.
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname xx
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 xx
!
no aaa new-model
memory-size iomem 25
!
no ipv6 cef
!
!
!
!
!
ip name-server 68.105.28.16
ip name-server 68.105.29.16
ip cef
multilink bundle-name authenticated
!
!
crypto pki token default removal timeout 0
!
!
license udi pid CISCO2911/K9 sn FTX1648AKVJ
license accept end user agreement
license boot module c2900 technology-package datak9
!
!
!
redundancy
!
!
!
!
!
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
description WAN TO INTERNET
ip address x.x.62.166 255.255.255.248
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface GigabitEthernet0/1
description LAN TO INTRANET
ip address 192.168.42.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
interface GigabitEthernet0/2
description WIRELESS TO FIBER
ip address 192.168.41.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
!
ip default-gateway x.x.62.161
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
no ip nat service sip udp port 5060
ip nat inside source list 1 interface GigabitEthernet0/0 overload
ip nat inside source list 23 interface GigabitEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 x.x.62.161
!
access-list 1 permit 192.168.41.0 0.0.0.255
access-list 23 permit 192.168.42.0 0.0.0.255
!
!
!
!
!
!
control-plane
!
!
!
line con 0
password xx
login
line aux 0
password xx
login
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output lat pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
password pass123
login
transport input all
!
scheduler allocate 20000 1000
end
Solved! Go to Solution.
10-06-2015 10:12 AM
10-05-2015 02:18 AM
hey don't think you need 2 overload statements there try this instead
ip nat inside source list 1 interface GigabitEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 x.x.62.161
!
access-list 1 permit 192.168.41.0 0.0.0.255
access-list 1 permit 192.168.42.0 0.0.0.255
access-list 1 deny any
10-05-2015 10:26 AM
Here there! Thanks for replying!
I went ahead and pulled this beast back behind the wireless so it is no longer exposed to the outside. I have attached the config so you can review it. Good to know I can concatenate ip's to an individual access list. I can ping 192.168.42.5 on the computer, I can ping 192.168.41.1 on the computer. I can ping google.com from the Cisco router usb console but am unable to ping google.com from the computer. Just running a laptop connected to g0/2 with 192.168.41.29 as ip, mask 255.255.255.0, gateway 192.168.41.1
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname tri
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 xx
!
no aaa new-model
memory-size iomem 25
!
no ipv6 cef
!
!
!
!
!
ip name-server 68.105.28.16
ip name-server 68.105.29.16
ip cef
multilink bundle-name authenticated
!
!
crypto pki token default removal timeout 0
!
!
license udi pid CISCO2911/K9 sn FTX1648AKVJ
license accept end user agreement
license boot module c2900 technology-package datak9
!
!
!
redundancy
!
!
!
!
!
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
description TEMP CONN TO WIRELESS
ip address 192.168.42.5 255.255.255.0
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface GigabitEthernet0/1
description LAN TO INTRANET
no ip address
ip nat inside
ip virtual-reassembly in
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0/2
description WIRELESS TO FIBER
ip address 192.168.41.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
!
ip default-gateway 192.168.42.1
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
no ip nat service sip udp port 5060
ip nat inside source list 23 interface GigabitEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 192.168.42.1
!
access-list 23 deny any
access-list 23 permit 192.168.41.0 0.0.0.255
!
!
!
!
!
!
control-plane
!
!
!
line con 0
password xxx
login
line aux 0
password xxx
login
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output lat pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
password xxx
login
transport input all
!
scheduler allocate 20000 1000
end
10-05-2015 04:55 PM
A couple of things
in your config
access-list 23 deny any < will stop all packets
access-list 23 permit 192.168.41.0 0.0.0.255 <never get a hit because of line above
so get rid of "access-list 23 deny any"
also has the 192.168.42.1 device got a route back to the 192.168.41.0/24 network.
" ip route 192.168.41.0 25.255.255.0 192.168.42.5"
HTH
Richard.
10-05-2015 07:34 PM
If I put in ip route I get this error message:
%Invalid next hop address (it's this router)
I still can ping the router and g0/0, g0/2, just not 192.168.42.1 (default Gateway, the wireless router that the cisco 2911 is plugged into from g0/0) from the computer. Still can ping 192.168.42.1 and google.com from the router.
10-06-2015 02:05 AM
Ye the acl is on the wrong order they always start from top down from least most specific rule to least usually , going by your original config this is what I would have set to get it running , what the below says is anything coming from the 192.168.41 or 42 network nat to the public ip address , also gives default route as edge route pointing everything out to public ip as that's the only way you can go
interface GigabitEthernet0/0
description WAN TO INTERNET
ip address x.x.62.166 255.255.255.248
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface GigabitEthernet0/1
description LAN TO INTRANET
ip address 192.168.42.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
interface GigabitEthernet0/2
description WIRELESS TO FIBER
ip address 192.168.41.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
ip nat inside source list 1 interface GigabitEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 x.x.62.161
!
access-list 1 permit 192.168.41.0 0.0.0.255
access-list 1 permit 192.168.42.0 0.0.0.255
access-list 1 deny any
10-06-2015 09:08 AM
Doesn't work. This is why this is getting frustrating. Very very frustrating.
To be able to work on this without network interruption on the floor, I have to put this thing behind the cisco wireless.
So here's the new config with your exact changes:
ip name-server 68.105.28.16
ip name-server 68.105.29.16
!
interface GigabitEthernet0/0
ip address 192.168.42.5 255.255.255.0
ip nat outside
ip virtual-reassembly in
no ip route-cache
duplex auto
speed auto
!
interface GigabitEthernet0/1
ip address 192.168.41.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
no ip route-cache
duplex auto
speed auto
!
interface GigabitEthernet0/2
no ip address
ip virtual-reassembly in
no ip route-cache
shutdown
duplex auto
speed auto
!
!
ip default-gateway 192.168.42.1
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
no ip nat service sip udp port 5060
ip nat inside source list 1 interface GigabitEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 192.168.42.1
!
access-list 1 permit 192.168.41.0 0.0.0.255
access-list 1 permit 192.168.42.0 0.0.0.255
Except "deny all" gives me:Translating "deny"...domain server (68.105.28.16)
I have a Cisco wireless router facing the internet on network 192.168.42, the bottom 100 are not dynamically assigned so I know .5 works as I can ping out of the router when assigning g0/0 to .5 and "ping google.com". Which works. If I call traceroute:
Translating "google.com"...domain server (68.105.28.16) [OK]
Type escape sequence to abort.
Tracing the route to google.com (216.58.219.14)
VRF info: (vrf in name/id, vrf out name/id)
1 192.168.42.1 4 msec 4 msec 0 msec
3 wsip-184-176-47-136.sd.sd.cox.net (184.176.47.136) 4 msec 0 msec 4 msec
4 fed1sysc01-gex0905.sd.sd.cox.net (68.6.8.60) 4 msec 0 msec 4 msec
5 sanjbprj01-ae0.0.rd.sj.cox.net (68.1.5.184) 20 msec 24 msec 24 msec
6 paltbprj02-ae1-308.rd.pt.cox.net (68.105.31.37) 20 msec 24 msec 24 msec
7 216.239.49.168 16 msec 16 msec
216.239.49.170 24 msec
8 209.85.246.253 [MPLS: Label 24328 Exp 4] 16 msec
209.85.246.20 [MPLS: Label 625856 Exp 4] 16 msec
209.85.246.10 [MPLS: Label 634768 Exp 4] 40 msec
9 64.233.174.206 [MPLS: Label 304242 Exp 4] 40 msec 16 msec 16 msec
10 209.85.248.124 16 msec 16 msec 16 msec
11 209.85.240.107 16 msec 16 msec 12 msec
12 google.com (216.58.219.14) 12 msec 16 msec 16 msec
So I know I'm connecting. But the computer can ping the router g0/0 and g0/1 just not the 192.168.42.1 which is the cisco wireless.
The computer is 192.168.41.5/24 with a gateway to 192.168.41.1
What am I missing here??
The solutions to this I'm finding, do not work.
10-06-2015 09:25 AM
Can you -
1) remove this line from your NAT acl -
access-list 1 permit 192.168.42.0 0.0.0.255
2) do a "clear ip nat translations *" on the router
3) ping an internet IP and then post "sh ip nat translations" from your router.
Jon
10-06-2015 09:45 AM
This is the current config:
ip nat inside source list 1 interface GigabitEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 192.168.42.1
!
access-list 1 permit 192.168.41.0 0.0.0.255
I then cleared the nat translation from the router, and I started pinging from both the computer and router different internal ip addresses, including 192.168.41.1 and the 42.1 and google, and "show ip nat translation" does not give any output
10-06-2015 10:05 AM
Can you post your entire router configuration.
Jon
10-06-2015 10:10 AM
The entire config is below:
Building configuration...
Current configuration : 1978 bytes
!
! Last configuration change at 16:03:55 UTC Tue Oct 6 2015
! NVRAM config last updated at 16:04:32 UTC Tue Oct 6 2015
! NVRAM config last updated at 16:04:32 UTC Tue Oct 6 2015
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname xx
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 xx
!
no aaa new-model
memory-size iomem 25
!
no ipv6 cef
no ip routing
!
!
!
!
!
ip name-server 68.105.28.16
ip name-server 68.105.29.16
no ip cef
multilink bundle-name authenticated
!
!
crypto pki token default removal timeout 0
crypto pki token default removal timeout 0
!
!
license udi pid CISCO2911/K9 sn FTX1648AKVJ
license accept end user agreement
license boot module c2900 technology-package datak9
!
!
!
redundancy
!
!
!
!
!
!
interface Embedded-Service-Engine0/0
no ip address
no ip route-cache
shutdown
!
interface GigabitEthernet0/0
ip address 192.168.42.5 255.255.255.0
ip nat outside
ip virtual-reassembly in
no ip route-cache
duplex auto
speed auto
!
interface GigabitEthernet0/1
ip address 192.168.41.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
no ip route-cache
duplex auto
speed auto
!
interface GigabitEthernet0/2
no ip address
ip virtual-reassembly in
no ip route-cache
shutdown
duplex auto
speed auto
!
!
ip default-gateway 192.168.42.1
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
no ip nat service sip udp port 5060
ip nat inside source list 1 interface GigabitEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 192.168.42.1
!
access-list 1 permit 192.168.41.0 0.0.0.255
!
!
!
!
!
!
control-plane
!
!
!
line con 0
password xx
login
line aux 0
password xx
login
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output lat pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
password xx
login
transport input all
!
scheduler allocate 20000 1000
end
10-06-2015 10:12 AM
You need to enable routing ie.
"ip routing"
Jon
10-06-2015 10:26 AM
So you would only want to disable routing for DHCP? It's working by the way. Holy lord. Thank you. THANK YOU.
10-06-2015 10:30 AM
You probably wouldn't want to disable routing even if you were using DHCP.
For some reason some of the newer IOSs seem to disable it or that is my experience on these forums.
It's quite rare that you would ever want to manually disable it on a router.
Glad to hear it's working.
Jon
10-06-2015 10:42 AM
I'm glad too! I think I can switch this thing out tonight now and I can say I had a rough crash course into cisco configuration. I can say it was a punch in the face but it is also fascinating. While I was configuring this thing, I was wondering to myself, how do I programmatically make cisco changes? If you had a large ISP center and you had these beasts on chassis, it seems ridiculous to configure and make widespread changes just by hunkering around like I did, making individual calls and logging in every time. Is Python the language of choice for network engineers for making widespread changes or automating network configuration?
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide