Comunication between lan and wan ports ina 891FW

[aromero]

Hi everyone, I'm configuring a 891FW router and triying to communicate a pc connected to a wan port with another pc connected to a lan port but it does not working. I have tryed creating access-lists and assing them to the lan and wan ports that I'm using but, how I mentioned, it does not work.

The PC connected to the wan port is a web server and the pc connected to the lan port has to run an application installed on the web server. The pc connected to the lan port is a ftp server and the pc connected to the wan port has to access and get data from it.

How can I configure this router to do this?

Thanks

Adolfo 

[acampbell]

Hi,

A Very basic config

!
vlan 100
name LAN-VLAN
!
int gig 1/1
desc LAN PC
switchport mode acces
switcport access vlan 100
!
int g0/1
desc WEB SERVER CONNECTION
ip address 192.168.1.1 255.255.255.0
no shut
!
int vlan 100
ip address 192.168.100.1 255.255.255.0
no shut
!

Replace the IP subnets/addresses with your own as required

Regards
Alex

[aromero]

Hi Alex, thanks for the reply but it does not work. I tried to type the commands you sent but I can't, so I typed them this way:

vlan 100
name LAN-VLAN
!
int gig0    ! I don't know why the router does not accept this form g0/1
desc LAN PC
switchport mode acces
switcport access vlan 100
!
int g8  ! Again I don't know why the router does not accept this form g8/1
desc WEB SERVER CONNECTION
ip address 192.168.1.1 255.255.255.0
no shut
!
int vlan 100
ip address 192.168.3.1 255.255.255.0
no shut
!

I'm posting my running-conf 

Piso4#sh running-conf
Building configuration...

Current configuration : 4666 bytes
!
! Last configuration change at 10:43:50 GMT Mon Nov 14 2016
version 15.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Piso4
!
boot-start-marker
boot-end-marker
!
aqm-register-fnf
!
enable secret 5 $1$dbGG$p1KuSuCVeiuhuROqFtYhG/
enable password fase123
!
aaa new-model
!
!
!
!
!
!
!
aaa session-id common
clock timezone GMT -4 0
service-module wlan-ap 0 bootimage autonomous
!
crypto pki trustpoint TP-self-signed-102307588
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-102307588
revocation-check none
rsakeypair TP-self-signed-102307588
!
!
crypto pki certificate chain TP-self-signed-102307588
certificate self-signed 01
30820229 30820192 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31303233 30373538 38301E17 0D313631 31303731 35323530
365A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F
532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3130 32333037
35383830 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
BF651AB8 AFCF07B4 DEEC5847 ED972CFA 8366E176 A37E0125 D06AA563 AED18149
C1EA514A BF1878DB DEB34C91 AF3BC57A 0D1BDDC1 9B421A42 2D2C6F95 679ED1C3
02E7C1B4 2C7F270B 50391F34 F7E550A8 5AC53352 ADC92CCB 821599CE 35F23BBE
873242A1 AD6921A1 F55B9557 ADD8AC71 8D859858 5D8326D5 5A51B4DE EAFE6503
02030100 01A35330 51300F06 03551D13 0101FF04 05300301 01FF301F 0603551D
23041830 168014B0 5B435FAC 90988E24 7853EA17 A22FFCEA F12F5630 1D060355
1D0E0416 0414B05B 435FAC90 988E2478 53EA17A2 2FFCEAF1 2F56300D 06092A86
4886F70D 01010505 00038181 00600441 92B7CE72 A9FF852A 15CDE091 91F2401E
38A07655 E5C28D86 0C850FA1 65F32397 1D44474F 22BE9FE4 A8288691 287FB86A
F4C4125D C7C06888 F44EAA1D 3B366F62 DD9D9951 C300E6AB 2D31C3DF 3B2CE787
E9F121EE 2F0DB824 7029D1E3 5C6CE6F5 C9920020 CFE3B99D EAF38B1E 18E80521
B4F7FF9B B1343A83 F24D0683 41
quit
!
!
!
!

!
ip dhcp excluded-address 192.168.4.1 192.168.4.10
ip dhcp excluded-address 192.168.4.2
ip dhcp excluded-address 192.168.4.3
ip dhcp excluded-address 192.168.4.4
ip dhcp excluded-address 192.168.4.5
ip dhcp excluded-address 192.168.4.6
ip dhcp excluded-address 192.168.4.7
ip dhcp excluded-address 192.168.4.8
ip dhcp excluded-address 192.168.4.9
!
ip dhcp pool NET-POOl
network 192.168.4.0 255.255.255.0
default-router 192.168.4.1
dns-server 192.168.4.1
domain-name Piso4.bo
lease 0 4 30
!
!
!
no ip domain lookup
ip cef
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
license udi pid C891FW-A-K9 sn FJC2031L3BF
!
!
username root privilege 15 secret 5 $1$U/zi$EH/ioNE4f0uzUa/qMewby/
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface BRI0
no ip address
encapsulation hdlc
shutdown
isdn termination multidrop
!
interface FastEthernet0
no ip address
shutdown
duplex full
speed auto
!
interface GigabitEthernet0
description LAN PC
switchport access vlan 100
no ip address
!
interface GigabitEthernet1
description WEB SERVER CONNECTION
no ip address
shutdown
!
interface GigabitEthernet2
no ip address
shutdown
!
interface GigabitEthernet3
no ip address
shutdown
!
interface GigabitEthernet4
no ip address
shutdown
!
interface GigabitEthernet5
no ip address
shutdown
!
interface GigabitEthernet6
no ip address
shutdown
!
interface GigabitEthernet7
no ip address
shutdown
!
interface GigabitEthernet8
description WEB SERVER CONNECTION
ip address 192.168.1.1 255.255.255.0
duplex auto
speed auto
!
interface Wlan-GigabitEthernet8
no ip address
!
interface wlan-ap0
description Embedded Service module interface to manage the embedded AP
ip unnumbered Vlan1
!
interface Vlan1
ip address 192.168.4.1 255.255.255.0
!
interface Vlan100
ip address 192.168.3.1 255.255.255.0
!
interface Async3
no ip address
encapsulation slip
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
!
!
!
!
!
!
!
control-plane
!
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
line con 0
no modem enable
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
stopbits 1
line 3
modem InOut
speed 115200
flowcontrol hardware
line vty 0 4
privilege level 15
password fase456
transport input telnet ssh
transport output telnet ssh
line vty 5 15
privilege level 15
transport input telnet ssh
transport output telnet ssh
!
scheduler allocate 20000 1000
!
end

Could you tell me please what I'm doing wrong?

Regards

Adolfo

[Richard Burts]

Adolfo

I do not see any issue in the config that you posted that would prevent communication between a server connected to the WAN on Gig8 and a host/FTP server connected on Gig0. That is where the devices are connected? Can you give us the IP addresses configured on the server and on the host? And can you give us what is configured as the default gateway for each of those devices?

It would be helpful if you would post the output of show arp (or perhaps show ip arp).

HTH

Rick

[aromero]

Hi Rick, thanks for your reply, answering your questions: yes I connected this PC on Gig8:

IP: 192.168.1.2; NM: 255.255.255.0; GW: 192.168.1.1 (Ip that I assigned to Gi8 router port)

and connected this other PC on Gig0:

IP: 192.168.3.2; NM: 255.255.255.0; GW: 192.168.3.1 (Ip that I assigned to Gi0 router port)

I tried to configure a default gateway on the router but I can't do it, I used the ip default-gateway command and does not work, so I just configure the IP address to the ports Gi0 and Gi8 and assign them to te PCs as gateways.

These are the lines that I obtain tipping show arp and show ip arp

Piso4#sh arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 192.168.1.1 - 0042.68f4.e480 ARPA GigabitEthernet8
Internet 192.168.1.2 2 d485.64ec.b80e ARPA GigabitEthernet8
Internet 192.168.3.1 - 0042.68f4.e46e ARPA Vlan100
Internet 192.168.3.2 2 0017.0848.f674 ARPA Vlan100
Internet 192.168.4.1 - 0042.68f4.e46e ARPA Vlan1
Internet 192.168.4.11 77 0042.68f4.e482 ARPA Vlan1
Internet 192.168.30.11 0 6431.50d2.4fc3 ARPA FastEthernet0
Internet 192.168.30.12 9 00e0.4de0.16d4 ARPA FastEthernet0
Internet 192.168.30.100 - 0042.68f4.e478 ARPA FastEthernet0

Piso4#sh ip arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 192.168.1.1 - 0042.68f4.e480 ARPA GigabitEthernet8
Internet 192.168.1.2 3 d485.64ec.b80e ARPA GigabitEthernet8
Internet 192.168.3.1 - 0042.68f4.e46e ARPA Vlan100
Internet 192.168.3.2 3 0017.0848.f674 ARPA Vlan100
Internet 192.168.4.1 - 0042.68f4.e46e ARPA Vlan1
Internet 192.168.4.11 78 0042.68f4.e482 ARPA Vlan1
Internet 192.168.30.11 0 6431.50d2.4fc3 ARPA FastEthernet0
Internet 192.168.30.12 10 00e0.4de0.16d4 ARPA FastEthernet0
Internet 192.168.30.100 - 0042.68f4.e478 ARPA FastEthernet0
Internet 192.168.30.191 0 0018.decf.8753 ARPA FastEthernet0

What am I doing wrong?

Regards

Adolfo

[Richard Burts]

Adolfo

Thank you for the additional information. I do not see anything in the config that looks like a mistake. Based on what you have posted I would expect that these two hosts should communicate with each other. If they are not working as you expect then perhaps I should ask how are you testing them (what are you doing to see if they work)? Are you testing for basic IP connectivity? Or are you testing to see if the web application works?

I might suggest the following set of steps as one approach to testing for basic connectivity:

! ping from the router to one device

ping 192.168.1.2

! ping from the router to that host with a different source address

ping 192.168.1.2 source vlan100

! ping from the router to the other device

ping 192.168.3.2

! ping from the router to the other device with a different source address

ping 192.168.3.2 source Gig8

HTH

Rick

[aromero]

Rick, I`m just sending pings between both PCs, but any of them responds.

These are the results that I obtain to the suggestions that you made:

Piso4#ping 192.168.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
Piso4#ping 192.168.1.2 source vlan100
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
Packet sent with a source address of 192.168.3.1
.....
Success rate is 0 percent (0/5)
Piso4#ping 192.168.3.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.3.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
Piso4#ping 192.168.3.2 source gi8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.3.2, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.1
.....
Success rate is 0 percent (0/5)

As you can see ping does not responde when I try to use a different net source,

Any other suggestions?

Regards

Adolfo

[Richard Burts]

Adolfo

Thank you for doing the tests that I suggested. The results show that there is some problem with the default gateway on both devices. By default the router will use the IP of the outbound interface as the source of a ping which was the first step in my test. And the second step tells the router to use a different source address.

When the connected PC (or server) can respond to ping when the source address is local and does not respond to ping when the source address is remote then something is wrong with the default gateway of the PC (or server). Please check those devices again and see what they have as default gateway.

HTH

Rick

[aromero]

Rick, as I told you, for the PC with te IP address 192.168.1.2 the gateway is 192.168.1.1 (the IP address that I assigned to the router port G8 because I do not know waht other IP address use for this), and por the PC with the IP address 192.168.3.2 the gateway is 192.168.3.1(the IP address that I assigned to the router port G0 because I do not know what other IP address use for this)

By the way, thank you very much for your time helping me.

Can you think of anything else?

Regards

Adolfo 

[Richard Burts]

Adolfo

You are welcome. I am glad to be able to use some of my time to help others on the forum and to share some of what I have learned.

I have never seen a situation where a device was able to respond to local ping and not able to respond to ping from a remote source that was not some kind of problem with the default gateway of the device. Would you post the output of ipconfig from these hosts?

HTH

Rick

[aromero]

Rick, I did not post them, but here they are:

C:\WINDOWS\system32>ipconfig

Configuración IP de Windows

Adaptador de Ethernet Conexión de área local:

Sufijo DNS específico para la conexión. . :
Vínculo: dirección IPv6 local. . . : fe80::406:39e2:4f23:aaca%3
Dirección IPv4. . . . . . . . . . . . . . : 192.168.1.2
Máscara de subred . . . . . . . . . . . . : 255.255.255.0
Puerta de enlace predeterminada . . . . . : 192.168.1.1

Adaptador de LAN inalámbrica Conexión de área local* 2:

Estado de los medios. . . . . . . . . . . : medios desconectados
Sufijo DNS específico para la conexión. . :

and the for teh other PC:

C:\Documents and Settings\adolfo.romero>ipconfig

Configuración IP de Windows

Adaptador Ethernet Conexión de área local :

Sufijo de conexión específica DNS :
Dirección IP. . . . . . . . . . . : 192.168.3.2
Máscara de subred . . . . . . . . : 255.255.255.0
Puerta de enlace predeterminada : 192.168.3.1

Adaptador Ethernet Conexiones de red inalámbricas :

Sufijo de conexión específica DNS : fase.bo
Dirección IP. . . . . . . . . . . : 192.168.30.191
Máscara de subred . . . . . . . . : 255.255.255.0
Puerta de enlace predeterminada : 192.168.30.1

Regards

Adolfo

[Richard Burts]

Adolfo

Thank you for posting this output. I am quite surprised by it. It does clearly show that the host interfaces are configured with correct address, mask, and default gateway. And yet something is preventing these hosts from responding to a ping from a remote source.

I do not believe that the issue has anything to do with the configuration of your router and continue to believe that there is something on the host that is preventing the access. Perhaps the output of the commands arp -a and of route print from the hosts might supply some insight?

HTH

Rick

[aromero]

Rick, I'm lost, as you see apparently everything is well configured, but does not work. I'll try with other PCs but if something comes to your mind please write me.

Regards

Adolfo

[Richard Burts · Accepted solution]

Adolfo

Would you post the output of arp -a and of route print from both of the PCs.

HTH

Rick

[aromero]

Rick, FINALLY I SOLVE IT...

You were right all the time, the problem were the gateways. In both PCs I have wifi adapters with very different IP addresess and gateways, they were the problem when I turn off them all begun to work.

Thanks a lot for your help

Regards

Adolfo