Cisco 887VA LAN cannot see WAN NAT issue?

[MusicMonkey]

Hello, this is my first post here, and I'm pretty new to configuring Cisco products.

I've got a Cisco 887VA-M, its connected to the internet, and devices can connect to it, but devices on VLAN1 cannot access the internet.

the router will ping 8.8.8.8, bbc.co.uk and 192.168.1.2 (the only device on FE0)

the PC can ping 192.168.1.1 (the router) but cannot ping anything else

my 5p bet is on the issue being here:

ip nat inside source list 101 interface Ethernet0.101 overload
ip nat inside source list nat-list interface Dialer3 overload
ip route 0.0.0.0 0.0.0.0 Dialer3

I'll paste the whole config, I'd also like to remove dialer2 but it won't allow me until Ethernet0 stops pointing at it, which is a line i struggled to remove... feel free to explain that too!

I'm open to any suggestions, improvements, criticism -- I just want it to work!

Thanks

Building configuration...

Current configuration : 4224 bytes
!
! Last configuration change at 00:27:15 GMT Sun Oct 7 2018 by spilkins
version 15.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router01
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
clock timezone GMT 0 0
!
crypto pki trustpoint TP-self-signed-49874977
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-49874977
revocation-check none
rsakeypair TP-self-signed-49874977
!
!
crypto pki certificate chain TP-self-signed-49874977
certificate self-signed 01
30820227 30820190 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
2F312D30 2B060355 04031324 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 34393837 34393737 301E170D 31383130 30313230 30313434
5A170D32 30303130 31303030 3030305A 302F312D 302B0603 55040313 24494F53
2D53656C 662D5369 676E6564 2D436572 74696669 63617465 2D343938 37343937
3730819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100AE67
7C2C39DC 6D3DD206 CA7193D3 467036C2 2C08BDE1 33FD9A59 C393DFB8 62EC288C
9D3CE6F8 44F3B26C 80FC3F4A D6D5FF94 293F2D01 DF354317 9AFB4356 A177B7E4
1E62A42F 88E3140A 8E5568A6 9DA75067 C14C0B3C 40C84D9C 899D6E06 3BED98FA
AADEEAD0 88D57524 51518CF7 67C59D32 CAE47522 3A9F71CD B55CF23B 0B070203
010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603 551D2304
18301680 1482B526 85A202F0 CCB47F25 4F8F6931 A504091E 33301D06 03551D0E
04160414 82B52685 A202F0CC B47F254F 8F6931A5 04091E33 300D0609 2A864886
F70D0101 05050003 81810082 BB6E852B 63FD8486 3213A34C 5B1ECDCB 9007FF68
C4C7A02D D7D50EB6 1DFBBFB7 F1A7F831 217846E7 6BA1D84C 543B467C 29631347
65E0050F ACCF3BB5 066EF0ED 67F8D0C1 A6898ADE 36762033 9E7943AF 99A11F8C
FA52855B 2E2853A2 525396E1 62307D11 F8D2D85E 8D887E10 5DA6467F 1E63CBF2
0C161060 488FA573 FD6151
quit
!
!
!
!
!
!
ip domain name aa.local
ip name-server 212.159.13.49
ip name-server 212.159.13.50
ip cef
no ipv6 cef
!
!
!
!
!
!
!
!
!
!
!
!
license udi pid C887VAM-K9 sn FGL210224KB
license boot module c800 level advsecurity
!
username ******** privilege 15 secret 9 ********
!
!
!
!
!
controller VDSL 0
!
!
!
!
!
!
!
!
!
!
!
interface ATM0
no ip address
shutdown
no atm ilmi-keepalive
!
interface Ethernet0
description Plusnet
no ip address
ip virtual-reassembly in
no ip route-cache
pppoe enable group global
pppoe-client dial-pool-number 3
pppoe-client dial-pool-number 2
!
interface Ethernet0.101
description PrimaryWANDesc_PlusnetFibre
encapsulation dot1Q 101
ip nat outside
ip virtual-reassembly in
no ip route-cache
pppoe enable group global
pppoe-client dial-pool-number 3
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface Vlan1
ip address pool dhcp1
ip tcp adjust-mss 1412
!
interface Dialer3
description PrimaryWANDesc_PlusnetFibre_Ethernet0.101
ip address negotiated
ip access-group 101 in
ip mtu 1492
ip nat outside
ip virtual-reassembly in
encapsulation ppp
ip tcp adjust-mss 1452
dialer pool 3
dialer-group 3
ppp mtu adaptive
ppp authentication chap callin
ppp chap hostname spilkins@plusdsl.net
ppp chap password 0 s0m3rs4ult
ppp ipcp dns request accept
ppp ipcp route default
ppp ipcp address accept
no cdp enable
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
!
ip nat inside source list 101 interface Ethernet0.101 overload
ip nat inside source list nat-list interface Dialer3 overload
ip route 0.0.0.0 0.0.0.0 Dialer3
!
dialer-list 1 protocol ip permit
!
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
line con 0
no modem enable
line aux 0
line vty 0 4
login
transport input all
!
scheduler allocate 20000 1000
ntp server ntp.plus.net source ATM0
!
end

[Francesco Molino]

Hi

You're missing the acl for nat.
Dont know why you have configured Ethernet0 with 2 dialers and also vlan1 with dhcp. Where is your dhcp pool?

To allow your pc to reach internet you should have an acl that looks like:
ip access-list extended 101
Permit ip 192.168.1.0 0.0.0.255 any

This is a simple acl that'll allow your lan access Internet.

Also add ip nat inside under interface vlan 1

[MusicMonkey]

Thanks Francesco,

I've now got a single line of ACL, which should let me out, and now I feel like I'm being really slow, but do I need to add some settings to one of the interfaces or something? I've still got the same issue:

-Router can ping 8.8.8.8

-Router can ping 192.168.1.2

-192.168.1.2 can ping 192.168.1.1

-192.168.1.2 can't ping 8.8.8.8

In other news, I'm confused by the DHCP config - I couldn't find it, then once I'd started making another those lines of config seemed to 'come back'... -- no I'm not convinced that what happened either!

Thanks for being quick at getting back to me

here's my config as it looks this morning:

Building configuration...

Current configuration : 4337 bytes
!
! Last configuration change at 19:13:46 GMT Sun Oct 7 2018 by spilkins
version 15.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router01
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
clock timezone GMT 0 0
!
crypto pki trustpoint TP-self-signed-49874977
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-49874977
revocation-check none
rsakeypair TP-self-signed-49874977
!
!
crypto pki certificate chain TP-self-signed-49874977
certificate self-signed 01
30820227 30820190 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
2F312D30 2B060355 04031324 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 34393837 34393737 301E170D 31383130 30313230 30313434
5A170D32 30303130 31303030 3030305A 302F312D 302B0603 55040313 24494F53
2D53656C 662D5369 676E6564 2D436572 74696669 63617465 2D343938 37343937
3730819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100AE67
7C2C39DC 6D3DD206 CA7193D3 467036C2 2C08BDE1 33FD9A59 C393DFB8 62EC288C
9D3CE6F8 44F3B26C 80FC3F4A D6D5FF94 293F2D01 DF354317 9AFB4356 A177B7E4
1E62A42F 88E3140A 8E5568A6 9DA75067 C14C0B3C 40C84D9C 899D6E06 3BED98FA
AADEEAD0 88D57524 51518CF7 67C59D32 CAE47522 3A9F71CD B55CF23B 0B070203
010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603 551D2304
18301680 1482B526 85A202F0 CCB47F25 4F8F6931 A504091E 33301D06 03551D0E
04160414 82B52685 A202F0CC B47F254F 8F6931A5 04091E33 300D0609 2A864886
F70D0101 05050003 81810082 BB6E852B 63FD8486 3213A34C 5B1ECDCB 9007FF68
C4C7A02D D7D50EB6 1DFBBFB7 F1A7F831 217846E7 6BA1D84C 543B467C 29631347
65E0050F ACCF3BB5 066EF0ED 67F8D0C1 A6898ADE 36762033 9E7943AF 99A11F8C
FA52855B 2E2853A2 525396E1 62307D11 F8D2D85E 8D887E10 5DA6467F 1E63CBF2
0C161060 488FA573 FD6151
quit
!
!
!
ip dhcp excluded-address 192.168.1.1
!
ip dhcp pool dhcp1
import all
network 192.168.1.0 255.255.255.248
default-router 192.168.1.1
!
!
!
!
ip domain name aa.local
ip name-server 212.159.13.49
ip name-server 212.159.13.50
ip cef
no ipv6 cef
!
!
!
!
!
!
!
!
!
!
!
!
license udi pid C887VAM-K9 sn FGL210224KB
license boot module c800 level advsecurity
!
!
username ******* privilege 15 secret 9 ********
!
!
!
!
!
controller VDSL 0
!
!
!
!
!
!
!
!
!
!
!
interface ATM0
no ip address
shutdown
no atm ilmi-keepalive
!
interface Ethernet0
description Plusnet
no ip address
ip virtual-reassembly in
no ip route-cache
pppoe enable group global
pppoe-client dial-pool-number 3
!
interface Ethernet0.101
description PrimaryWANDesc_PlusnetFibre
encapsulation dot1Q 101
ip nat outside
ip virtual-reassembly in
no ip route-cache
pppoe enable group global
pppoe-client dial-pool-number 3
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface Vlan1
ip address pool dhcp1
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1412
!
interface Dialer3
description PrimaryWANDesc_PlusnetFibre_Ethernet0.101
ip address negotiated
ip mtu 1492
ip nat outside
ip virtual-reassembly in
encapsulation ppp
ip tcp adjust-mss 1452
dialer pool 3
dialer-group 3
ppp mtu adaptive
ppp authentication chap callin
ppp chap hostname ********
ppp chap password 0 ********
ppp ipcp dns request accept
ppp ipcp route default
ppp ipcp address accept
no cdp enable
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
!
ip nat inside source list 101 interface Ethernet0.101 overload
ip nat inside source list nat-list interface Dialer3 overload
ip nat inside source static 192.168.1.1 81.174.169.155
ip route 0.0.0.0 0.0.0.0 Dialer3
!
dialer-list 1 protocol ip permit
dialer-list 3 protocol ip permit
!
access-list 101 permit ip 192.168.1.0 0.0.0.255 any
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
line con 0
no modem enable
line aux 0
line vty 0 4
login
transport input all
!
scheduler allocate 20000 1000
ntp server ntp.plus.net source ATM0
!
end

[Francesco Molino]

share output of sh ip int brie please.
if you do ping 8.8.8.8 so vla1 do you get any reply?

[MusicMonkey]

Thanks for coming back to me

annoyingly in pasting it here, it's lost its columns!!

Interface IP-Address OK? Method Status Protocol
ATM0 unassigned YES NVRAM administratively down down
Dialer3 81.174.169.155 YES IPCP up up
Ethernet0 unassigned YES NVRAM up up
Ethernet0.101 unassigned YES unset up up
FastEthernet0 unassigned YES unset up up
FastEthernet1 unassigned YES unset down down
FastEthernet2 unassigned YES unset up down
FastEthernet3 unassigned YES unset up down
NVI0 unassigned YES unset administratively down down
Virtual-Access1 unassigned YES unset up up
Virtual-Access2 unassigned YES unset up up
Vlan1 192.168.1.1 YES manual up up

and then ping was successful..
Router01#ping 8.8.8.8 so vla1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/19/20 ms

thanks again

Matt

[Francesco Molino]

Which means now it works right from a client machine?

[MusicMonkey]

I'm afraid not. The actual client machine can't ping anything.. The cisco can ping the outside whether it offers a dummy ip or not, but devices connected to the LAN can't get out!

What I have just noticed is that I'm handing out the wrong subnet.. Clients are getting 255.255.255.248 which I never intended.. That's now back to 255.255.255.0 and the clients have undergone /release and /renew but it's not helped, its just tidier!

[Francesco Molino · Accepted solution]

Your DHCP pool isn't for a /24:

ip dhcp pool dhcp1
import all
network 192.168.1.0 255.255.255.248
default-router 192.168.1.1

If you want to have /24, let's clear it the right way.

no ip dhcp pool dhcp1

interface Vlan1
 no ip address pool dhcp1

 ip address 192.168.1.1 255.255.255.0

!

ip dhcp pool VLAN1

 network 192.168.1.0 255.255.255.0

 default-router 192.168.1.1

 dns-server 8.8.8.8 8.8.4.4

!

ip dhcp excluded-address 192.168.1.1

Then your clients should get an ip within 192.168.1.0/24 and it should work. Let me know

[mehdi.sadighian]

hi

if the client is connect to interface Ethernet0, then do this:

interface Ethernet0

ip nat inside

[MusicMonkey]

Thanks,

I'm connecting the clients to FE0 (fast ethernet 0)
I think ethernet 0 is the modem
I think it gets its settings in the Ethernet0.101 section

Unless someone cleverer says otherwise!

[mehdi.sadighian]

hi you right

so i think the problem is mismatch between dhcp pool mask and access list mask.

your dhcp pool mask is /29  but your access list wild card shows /24 mask.

example of working nat:

note access-list number (10) and nat pool:

ip nat pool p1 x.x.x.x x.x.x.x netmask 255.255.255.252
ip nat inside source list 10 interface Dialer1 overload

access-list 10 permit 192.168.0.0 0.0.0.255

[MusicMonkey · Accepted solution]

Thanks so much to @mehdi.sadighian and @Francesco Molino who stuck with me through this!! I'm now connected, and there were so many little things to solve that it was tricky to name one post as the solution, but I think you both were on the money: the problem was that my DHCP wasn't included in the Access List 'Firewall' rules.

One thing I found frustrating was the lack of a working config on the forums for any router to look at... t so below is my working config.. if people in the future come and use it for reference then please click 'helpful' on this or their posts! 

This is a basic setup for a Cisco 887VA-M-K9 - which picks up internet from an FTTC Plusnet connection

____

Building configuration...

Current configuration : 4343 bytes
!
! Last configuration change at 13:35:23 BST Sat Oct 13 2018
version 15.3
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
no service password-encryption
!
hostname Router01
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
clock timezone BST 0 0
clock summer-time BST recurring last Sun Mar 1:00 last Sun Oct 2:00
!
crypto pki trustpoint TP-self-signed-49874977
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-49874977
revocation-check none
rsakeypair TP-self-signed-49874977
!
!
crypto pki certificate chain TP-self-signed-49874977
certificate self-signed 01
30820227 30820190 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
2F312D30 2B060355 04031324 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 34393837 34393737 301E170D 31383130 30313230 30313434
5A170D32 30303130 31303030 3030305A 302F312D 302B0603 55040313 24494F53
2D53656C 662D5369 676E6564 2D436572 74696669 63617465 2D343938 37343937
3730819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100AE67
7C2C39DC 6D3DD206 CA7193D3 467036C2 2C08BDE1 33FD9A59 C393DFB8 62EC288C
9D3CE6F8 44F3B26C 80FC3F4A D6D5FF94 293F2D01 DF354317 9AFB4356 A177B7E4
1E62A42F 88E3140A 8E5568A6 9DA75067 C14C0B3C 40C84D9C 899D6E06 3BED98FA
AADEEAD0 88D57524 51518CF7 67C59D32 CAE47522 3A9F71CD B55CF23B 0B070203
010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603 551D2304
18301680 1482B526 85A202F0 CCB47F25 4F8F6931 A504091E 33301D06 03551D0E
04160414 82B52685 A202F0CC B47F254F 8F6931A5 04091E33 300D0609 2A864886
F70D0101 05050003 81810082 BB6E852B 63FD8486 3213A34C 5B1ECDCB 9007FF68
C4C7A02D D7D50EB6 1DFBBFB7 F1A7F831 217846E7 6BA1D84C 543B467C 29631347
65E0050F ACCF3BB5 066EF0ED 67F8D0C1 A6898ADE 36762033 9E7943AF 99A11F8C
FA52855B 2E2853A2 525396E1 62307D11 F8D2D85E 8D887E10 5DA6467F 1E63CBF2
0C161060 488FA573 FD6151
quit
!
!
!
ip dhcp excluded-address 192.168.1.1
!
ip dhcp pool VLAN1
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 8.8.8.8 8.8.4.4
!
!
!
ip domain name aa.local
ip name-server 212.159.13.49
ip name-server 212.159.13.50
ip cef
no ipv6 cef
!
!
!
!
!
!
!
!
!
!
!
!
license udi pid C887VAM-K9 sn FGL210224KB
license boot module c800 level advsecurity
!
!
username ******** privilege 15 secret 9 ********
!
!
!
!
!
controller VDSL 0
!
!
!
!
!
!
!
!
!
!
!
interface ATM0
no ip address
shutdown
no atm ilmi-keepalive
!
interface Ethernet0
description Plusnet
no ip address
ip virtual-reassembly in
no ip route-cache
pppoe enable group global
pppoe-client dial-pool-number 3
!
interface Ethernet0.101
description PrimaryWANDesc_PlusnetFibre
encapsulation dot1Q 101
ip nat outside
ip virtual-reassembly in
no ip route-cache
pppoe enable group global
pppoe-client dial-pool-number 3
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface Vlan1
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1412
!
interface Dialer3
description PrimaryWANDesc_PlusnetFibre_Ethernet0.101
ip address negotiated
ip mtu 1492
ip nat outside
ip virtual-reassembly in
encapsulation ppp
ip tcp adjust-mss 1452
dialer pool 3
dialer-group 3
ppp mtu adaptive
ppp authentication chap callin
ppp chap hostname MyLogin@MyISP.net
ppp chap password 0 ********
ppp ipcp dns request accept
ppp ipcp route default
ppp ipcp address accept
no cdp enable
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
!
ip nat inside source list 101 interface Dialer3 overload
ip nat inside source static 192.168.1.1 81.174.169.155
ip route 0.0.0.0 0.0.0.0 Dialer3
!
dialer-list 1 protocol ip permit
dialer-list 3 protocol ip permit
!
access-list 101 permit ip 192.168.1.0 0.0.0.255 any
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
line con 0
no modem enable
line aux 0
line vty 0 4
login
transport input all
!
scheduler allocate 20000 1000
ntp server uk.pool.ntp.org
!
end

[Francesco Molino]

You're welcome