help subinterface doesnt work

[A7M876]

am try hard to change all configuration but still doesn't work : 

router model : 881 

router configuration 

#show running-config
Building configuration...

Current configuration : 2013 bytes

!
ip name-server 87.101.202.133
ip name-server 87.101.203.9
ip cef
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated

interface FastEthernet0
 no ip address
!
interface FastEthernet1
 no ip address
!
interface FastEthernet2
 no ip address
!
interface FastEthernet3
 no ip address
!
interface FastEthernet4
 no ip address
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface FastEthernet4.1115
 description " TO ITC Modem "
 encapsulation dot1Q 60
 ip address 87.101.135.100 255.255.255.252
 ip nat outside
 ip virtual-reassembly in
!
interface Vlan1
 description " Conneted To Switch "
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip nat inside source list 101 interface FastEthernet4.1115 overload
ip route 0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0 87.101.135.6
!
!
access-list 101 deny   ip any 192.168.1.0 0.0.0.255
access-list 101 permit ip 192.168.1.0 0.0.0.255 any
!

help me please my company is not work 

[marce1000]

             >help me please my company is not work ?

 Please elaborate in networking-technical terns what  the problem is (?)

 M.

[A7M876]

the problem I had received new IP address from the ISP and I can't configure my router for new IP

here is the new IP I had received.

Port: sub-interface (1115)

branch IP address : 87.101.135.100

Gateway: 87.101.135.6

DNS: 87.101.202.133

DNS: 87.101.203.9

and I made the configuration as the attached in my post but doesn't 

[Georg Pauwen]

Hello,

the access list doesn't look right. Change:

access-list 101 deny ip any 192.168.1.0 0.0.0.255
access-list 101 permit ip 192.168.1.0 0.0.0.255 any

to just:

access-list 101 permit ip 192.168.1.0 0.0.0.255 any

[A7M876]

I had change the access list but still WAN doesn't work 

[Georg Pauwen]

Hello,

the IP address you have received and the subnet mask do not belong to the same subnet as the gateway IP.

Change the IP address to:

ip address 87.101.135.100 255.255.255.0

[A7M876]

the subnet from DSP/ISP is like below 

Port: sub-interface (1115)

branch IP address : 87.101.135.100 /30

Gateway: 87.101.135.6 /30

DNS: 87.101.202.133

DNS: 87.101.203.9

[Georg Pauwen]

Hello,

who is your ISP/Provider ? Typically, when they ask you to use a specific subinterface, the corresponding VLAN needs to match.

Try:

interface FastEthernet4.1115
description " TO ITC Modem "
encapsulation dot1Q 1115
ip address 87.101.135.100 255.255.255.252
ip nat outside
ip virtual-reassembly in

[A7M876]

till doesn't work I can't ping 8.8.8.8

[Georg Pauwen]

Hello,

what is the LED status of interface FastEthernet4 ? Do you have physical connectivity at all ?

In your original configuration, you had Vlan 60 configured, does this Vlan actually exist on your router ? That is, did you manually create it ?

881#conf t

881(config)#vlan 60

?

[A7M876]

attached picture

[luis_cordova]

Hi @A7M876 

Try this change:

We changed the encapsulation from 60 to 1115

We changed the mask from /30 to /24, because having the mask /30, the configured ip did not belong to the same network.

We simplify the ACL to a single instruction

interface FastEthernet4.1115
 description " TO ITC Modem "
 encapsulation dot1Q 1115
 ip address 87.101.135.100 255.255.255.255
 ip nat outside
 ip virtual-reassembly in
!
access-list 101 permit ip 192.168.1.0 0.0.0.255 any

Regards

[A7M876]

I had changed the mask to /24, with same configuration you had sent to me

but still all users can't access and use (emails, internet,etc) 

[Georg Pauwen]

Hello,

create Vlan 1115 in the same way, and then use 'encapsulation dot1q 1115' on the subinterface...

[A7M876]

did you mean like this 

881#vlan 1115

881# encapsulation dot1Q 1115

881# ip address 87.101.135.100 255.255.255.252
 881# ip nat outside
881#  ip virtual-reassembly in