871w as an additional access point

[All1edservices2486417200]

Hello everyone,

I have an 871w set up to add wireless connectivity to an existing network. When adding a client to the physical interfaces to test VLAN internet connectivity, however, a DHCP address is assigned but internet traffic on the terminal never reaches the network nor does the network recognize the IP the terminal shows as being 'connected'. Also, pings sourced from the VLAN do reach destinations. I've attached my config file, I think it's a routing issue of some kind, anybody with a suggestion conccur?

10.26.99.0 is the existing network. 10.26.99.1 is an existing 871w router set as the DHCP server for that network and 10.26.99.10 is a Windows Server 2003 DNS box. VLAN 2 and DHCP pool alpha were control sets for trialing DNS settings.

Thanks!

[Henrik Grankvist]

Hi!

I dont really understand the problem. Does the clients connected physically get an IP address from the router but can't reach the internet?

[All1edservices2486417200]

Exactly, my issue is with getting a DHCP-assigned address from the router on VLAN1, but not actually getting internet access or seeing the assigned address as "connected" from the router. Would any other debug commands be helpful?

[Henrik Grankvist]

If you can ping your internal network, like the other router (10.26.99.1).

And you can ping that address, add a default route:

csdd(config)#ip route 0.0.0.0 0.0.0.0 fastethernet4

[jan.ifkovitz]

hi at the first look there is a little thing... on the vlan interface configuration

interface Vlan1

ip address 10.88.1.1 255.255.255.0

ip helper-address 10.26.99.1

ip nat inside

ip virtual-reassembly

bridge-group 1

bridge-group 1 spanning-disabled

!

interface Vlan2

ip address 192.168.1.1 255.255.255.0

ip nat inside

ip virtual-reassembly

ip nat inside source list nat interface FastEthernet4 overload

!

you configure ip nat inside... but as i understand you want to integrate the router in an existing network. right ?

if this is an router on the stick you can abstain nat.... or do you want to do mascarding ?

then i see you have configured

rip and a static route...

can you post a "sh ip route" ? thinking about administrativ distances.....

[All1edservices2486417200]

For simplicity sake, I'd like to abstain nat entirely if it would still function without it. In that case should I simply remove the nat inside/outside lines? I configured RIP originally on the 10.0.0.0 network because I thought that would have prevented this problem, but after it happened anyway, I also added a direct static line thinking that would fix the issue, but it didn't.

also here are the reports to show ip, some ping attemps and a screenshot of my terminal's ip display:

[All1edservices2486417200]

Alas, I thought that would have worked originally, and it did not, so I thought the more specific route (10.0.0.0 255.255.255.0 -> 10.26.99.1) would have worked better. Using the no ip route command and deleting that route, and adding the route back you had above suggested however, didn't get it either unfortunatly. 

[Henrik Grankvist]

Yeah you can remove NAT by doing "no ip nat inside/outside" on the interfaces.

You could try removing: "bridge-group 1" and  "bridge-group 1 spanning-disabled" from interface vlan1, I don't know if  that is causing and issue, but you are not using a bridged interface at  this point so it wouldn't hurt.

And for the pings, when you pinged the client from the router, that could just be the firewall on the computer.

And from what I can see, the computer does not have a  DNS server configured, so it's not reveiving that from the server. Just  try to set like 4.2.2.2 manually and see if that solves anything.

[All1edservices2486417200]

Didn't I set up a bridged interface between the dot11radio0.1 and vlan1 so I could connect wireless users to the vlan though?

Also, setting the terminal machine's adapter settings for IPv4, in the DNS field, manually to 8.8.8.8 (google's public DNS) and 4.2.2.2, as well as manually setting it to our networks' actually-designated DNS server @ 10.26.99.10, didn't work yet either.

Would I configure the pointers (#dns-server a.b.c.d) to 10.26.99.10 (or whatever DNS server I end up using) in the VLAN interface, the DHCP pool, or just the global configuration? Can I automatically use a public or default (isp-assigned) dns server and still maintain network connectivity to an existing local domain network?

To further clarify the specific situation, in case any of this is context-sensitive:

These are lab settings I'm building for a deployment. When I get to the actual site, I'll be handling a Windows 2008 (possibly 2003) server set up as a dns/dhcp server for an existing network going into a switch (esentially as a router from the modem). I was going to put the 871 on the switch at the site, to recieve the DHCP-assigned address from the switch into F4. To make sure these users are added to the csdd.local domain (to use local printer pools and such), do I absolutely have to specifically route towards the existing DNS server (the windows box) somewhere in the 871w config file to direct traffic or is that irrelevant for domain functionality?

[Henrik Grankvist]

If you used bridged interfaces it would look something like this. Notice the BVI1 interface. It is what connects the two and it is on that interface you set the IP-address. (BVI = Bridged Virtual Interface).

interface Dot11Radio0

no ip address

no ip route-cache

!

encryption mode ciphers aes-ccm

!

ssid GruppQ-WPA2-Enterprise

!

speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0

station-role root

bridge-group 1

bridge-group 1 subscriber-loop-control

bridge-group 1 block-unknown-source

no bridge-group 1 source-learning

no bridge-group 1 unicast-flooding

bridge-group 1 spanning-disabled

!

interface FastEthernet0

no ip address

no ip route-cache

duplex auto

speed auto

bridge-group 1

no bridge-group 1 source-learning

bridge-group 1 spanning-disabled

hold-queue 160 in

!

interface BVI1

ip address 192.168.10.1 255.255.255.0

no ip route-cache

If you want the clients to get an IP address from the Windows configured DHCP-server you need to do a "ip helper-address" on vlan1 (or bvi1, if you will use that) that points to the servers IP address.

[Henrik Grankvist]

But it is still weird that the client can't get out on the internet, sounds like it may not be this router's problem. Maybe it's your router that is directly connected to the internet.

Maybe the subnet the client is on isn't allowed to be NAT:ed? I'm a bit confused at the moment.