No internet access on from switch

Will Weeams · ‎07-09-2018

I setup inter vlan routing using a 2811 and a 3750 switch. I have sub interfaces on 2811. On Switch I can ping all the VLANs but I can not ping ISP Gateway and I can not get to internet from any vlan that is on the switch side.

Switch config:

Home_Switch#show run

Building configuration...

Current configuration : 2759 bytes

!

version 12.2

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname Home_Switch

!

boot-start-marker

boot-end-marker

!

no logging console

enable secret 5 $1$ODNh$g3/Qjp2LRwkVGAlri4CED0

!

no aaa new-model

switch 1 provision ws-c3750-24p

system mtu routing 1500

ip routing

!

spanning-tree mode pvst

spanning-tree extend system-id

!

vlan internal allocation policy ascending

!

interface FastEthernet1/0/1

switchport trunk encapsulation dot1q

switchport trunk native vlan 50

switchport mode trunk

!

interface FastEthernet1/0/2

switchport access vlan 10

switchport mode access

!

interface FastEthernet1/0/3

switchport access vlan 10

switchport mode access

!

interface FastEthernet1/0/4

switchport access vlan 10

switchport mode access

!

interface FastEthernet1/0/5

switchport access vlan 10

switchport mode access

!

interface FastEthernet1/0/6

switchport access vlan 10

switchport mode access

!

interface FastEthernet1/0/7

switchport access vlan 10

switchport mode access

!

interface FastEthernet1/0/8

switchport access vlan 10

switchport mode access

!

interface FastEthernet1/0/9

switchport access vlan 10

switchport mode access

!

interface FastEthernet1/0/10

switchport access vlan 10

switchport mode access

!

interface FastEthernet1/0/11

switchport access vlan 10

switchport mode access

!

interface FastEthernet1/0/12

switchport access vlan 10

switchport mode access

!

interface FastEthernet1/0/13

switchport access vlan 10

switchport mode access

!

interface FastEthernet1/0/14

!

interface FastEthernet1/0/15

!

interface FastEthernet1/0/16

!

interface FastEthernet1/0/17

!

interface FastEthernet1/0/18

!

interface FastEthernet1/0/19

!

interface FastEthernet1/0/20

!

interface FastEthernet1/0/21

!

interface FastEthernet1/0/22

!

interface FastEthernet1/0/23

!

interface FastEthernet1/0/24

!

interface GigabitEthernet1/0/1

!

interface GigabitEthernet1/0/2

!

interface Vlan1

no ip address

!

interface Vlan10

ip address 192.168.10.2 255.255.255.0

!

ip default-gateway 192.168.10.1

ip classless

ip route 0.0.0.0 0.0.0.0 192.168.2.1

ip route 0.0.0.0 0.0.0.0 192.168.1.1

ip route 0.0.0.0 0.0.0.0 192.168.10.1

ip route 192.168.10.0 255.255.255.0 192.168.10.1

ip route 192.168.20.0 255.255.255.0 192.168.10.1

ip route 192.168.30.0 255.255.255.0 192.168.10.1

ip route 192.168.40.0 255.255.255.0 192.168.10.1

ip route 192.168.50.0 255.255.255.0 192.168.10.1

ip http server

ip http secure-server

!

ip access-list standard TELNET-ACCESS

permit any

!

ip sla enable reaction-alerts

!

Router Config:

testlab_router#show run
Building configuration...

Current configuration : 2107 bytes
!
! Last configuration change at 07:58:49 UTC Mon Jul 9 2018 by wweeams
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname testlab_router
!
boot-start-marker
boot-end-marker
!
!
no logging console
!
no aaa new-model
!
!
dot11 syslog
ip source-route
!
!
ip cef
!
!
ip dhcp pool "BASE"
network 192.168.2.0 255.255.255.0
default-router 192.168.1.115 102.168.2.1
dns-server 208.67.220.220
!
!
ip domain name testlab.loc
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
voice-card 0
!
crypto pki token default removal timeout 0
!
!
!
!
license udi pid CISCO2811 sn FTX1328A0GR
username jbrown privilege 15 secret 5 $1$87w9$/b1AGUZQ851IX.YZzTS0J/
!
redundancy
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
interface FastEthernet0/1.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
!
interface FastEthernet0/1.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
!
interface FastEthernet0/1.30
encapsulation dot1Q 30
ip address 192.168.30.1 255.255.255.0
!
interface FastEthernet0/1.40
encapsulation dot1Q 40
ip address 192.168.40.1 255.255.255.0
!
interface FastEthernet0/1.50
encapsulation dot1Q 50 native
ip address 192.168.50.1 255.255.255.0
!
interface Serial0/0/0
no ip address
shutdown
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip nat inside source list 1 interface FastEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 192.168.1.1
ip route 192.168.2.0 255.255.255.0 192.168.2.2
ip route 192.168.3.0 255.255.255.0 192.168.2.2
ip route 192.168.4.0 255.255.255.0 192.168.2.2
ip route 192.168.5.0 255.255.255.0 192.168.2.2
!
access-list 1 permit any
!
!
!
!
!
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
exec-timeout 5 0
login local
transport input ssh
!
scheduler allocate 20000 1000
end

a.alekseev · ‎07-09-2018

interface FastEthernet0/1.10
ip nat inside

Richard Burts · ‎07-09-2018

It is certainly important to have ip nat inside on the vlan sub interfaces (and it needs to be on all the subinterfaces not just the .10 sub interface). But that is not the only issue. I find several things that need to be resolved or clarified.

The configuration makes vlan 50 the native vlan for the trunk. But I do not see vlan 50 being created on the switch or any reference to it besides the trunk. And in fact I do not see the other vlans being created on the switch. The switch does assign ports to vlan 10 and other ports assigned to vlan 1 (the default). But I do not see anything on the switch about vlans 20, 30, 40, and 50.

The switch configures 3 default routes. The first 2 of them are not correct and should be removed from the config

ip route 0.0.0.0 0.0.0.0 192.168.2.1

ip route 0.0.0.0 0.0.0.0 192.168.1.1

The third default route does point to the router interface address for vlan 10 and should work

ip route 0.0.0.0 0.0.0.0 192.168.10.1

All of the switch interfaces after 1/0/13 do not have specific vlan assignments so these ports are all in vlan 1. Since interface vlan 1 has no IP address any devices connected to these ports will not be able to get IP addresses and so will not work.

The switch has a number of static routes which are problematic. The first one is a route for the subnet of vlan 10

ip route 192.168.10.0 255.255.255.0 192.168.10.1

Since 192.168.10.0 is a connected subnet of the switch why is there a static route for it? And if vlan 10 is on the switch then why does the static route say to we go to the router to get to that subnet?

There are static routes for the subnets of the other vlans

ip route 192.168.20.0 255.255.255.0 192.168.10.1

ip route 192.168.30.0 255.255.255.0 192.168.10.1

ip route 192.168.40.0 255.255.255.0 192.168.10.1

ip route 192.168.50.0 255.255.255.0 192.168.10.1

But why do these static routes say to to get to these subnets we go through the router? Are these vlans and subnets not supposed to be on the switch?

On the router there are several issues in its config. The DHCP scope has some inconsistencies

network 192.168.2.0 255.255.255.0
default-router 192.168.1.115 102.168.2.1

It specifies a network of 192.168.2.0. But there is no interface on the router with an address in this subnet. Also it specifies a default router of 192.168.1.115. But the default router for a subnet should be an address in that subnet. And there is not anything on the router that defines subnet 192.168.1.0 so the address of 192.168.1.115 is not reachable. I assume that the second entry for default router was intended to be 192.168.2.1 and the entry is a typo.

The configuration of address translation on the router uses access list 1 which has permit any. Using permit any for nat can be problematic. It would be better if the ACL specified the networks and subnets which should be translated.

The router has a static default route

ip route 0.0.0.0 0.0.0.0 192.168.1.1

But we do not know where 192.168.1.1 is. There is not any interface configured with that subnet. Perhaps this is the address of the outside interface which is learned by DHCP? We need some clarification for this.

The router has some other static routes which are puzzling:

ip route 192.168.2.0 255.255.255.0 192.168.2.2
ip route 192.168.3.0 255.255.255.0 192.168.2.2
ip route 192.168.4.0 255.255.255.0 192.168.2.2
ip route 192.168.5.0 255.255.255.0 192.168.2.2

What and where are these subnets supposed to be? Is it possible that they are supposed to be 20, 30, 40, and 50? And where is this next hop of 192.168.2.2? Is it supposed to be 192.168.20.2? Or is it something else?

When these are corrected or clarified then perhaps we will be closer to a config that works.

HTH

Rick

HTH

Rick

Will Weeams · ‎07-09-2018

****

*Update config*

VLANs have been created on the 3750. I see them now. I originally thought they would be pushed from the router to the switch but now have created them on the switch as well.

All default routes have been taken out except the “ip route 0.0.0.0 0.0.0.0 192.168.10.1”

The ports that are in VLAN 1 are not being used at this point. Leaving there until needing to use them. This is a home lab and I am only using 10 ports at this point.

Static routes have been removed and I can see routes in routing table.

On the router I fixed the dhcp pool.

I will fix the ACL later I just want to see if this thing will pass traffic for the time being.

The static route to 192.168.1.1 is the ISP default gateway from my time warner modem. Does that route need to be removed?

Here is config as of now with changes:

Router Config:

testlab_router#show run
Building configuration...

Current configuration : 2112 bytes
!
! Last configuration change at 15:47:12 UTC Mon Jul 9 2018 by wweeams
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname testlab_router
!
boot-start-marker
boot-end-marker
!
!
no logging console
!
no aaa new-model
!
!
dot11 syslog
ip source-route
!
!
ip cef
!
!
ip dhcp pool "BASE"
network 192.168.10.0 255.255.255.0
dns-server 208.67.220.220
default-router 192.168.10.1
!
!
ip domain name testlab.loc
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
voice-card 0
!
crypto pki token default removal timeout 0
!
!
!
!
license udi pid CISCO2811 sn FTX1328A0GR
username jbrown privilege 15 secret 5 $1$87w9$/b1AGUZQ851IX.YZzTS0J/
!
redundancy
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
interface FastEthernet0/1.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface FastEthernet0/1.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface FastEthernet0/1.30
encapsulation dot1Q 30
ip address 192.168.30.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface FastEthernet0/1.40
encapsulation dot1Q 40
ip address 192.168.40.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface FastEthernet0/1.50
encapsulation dot1Q 50 native
ip address 192.168.50.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Serial0/0/0
no ip address
shutdown
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip nat inside source list 1 interface FastEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 192.168.1.1
!
access-list 1 permit any
!
!
!
!
!
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
exec-timeout 5 0
login local
transport input ssh
!
scheduler allocate 20

Switch Config:

Home_Switch#show run
Building configuration...

Current configuration : 2672 bytes
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Home_Switch
!
boot-start-marker
boot-end-marker
!
no logging console
enable secret 5 $1$ODNh$g3/Qjp2LRwkVGAlri4CED0
!
!
!
no aaa new-model
switch 1 provision ws-c3750-24p
system mtu routing 1500
ip routing
!
!
!
!
!
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
!
interface FastEthernet1/0/1
switchport trunk encapsulation dot1q
switchport trunk native vlan 50
switchport mode trunk
!
interface FastEthernet1/0/2
switchport access vlan 10
switchport mode access
!
interface FastEthernet1/0/3
switchport access vlan 10
switchport mode access
!
interface FastEthernet1/0/4
switchport access vlan 10
switchport mode access
!
interface FastEthernet1/0/5
switchport access vlan 10
switchport mode access
!
interface FastEthernet1/0/6
switchport access vlan 10
switchport mode access
!
interface FastEthernet1/0/7
switchport access vlan 10
switchport mode access
!
interface FastEthernet1/0/8
switchport access vlan 10
switchport mode access
!
interface FastEthernet1/0/9
switchport access vlan 10
switchport mode access
!
interface FastEthernet1/0/10
switchport access vlan 10
switchport mode access
!
interface FastEthernet1/0/11
switchport access vlan 10
switchport mode access
!
interface FastEthernet1/0/12
switchport access vlan 10
switchport mode access
!
interface FastEthernet1/0/13
switchport access vlan 10
switchport mode access
!
interface FastEthernet1/0/14
!
interface FastEthernet1/0/15
!
interface FastEthernet1/0/16
!
interface FastEthernet1/0/17
!
interface FastEthernet1/0/18
!
interface FastEthernet1/0/19
!
interface FastEthernet1/0/20
!
interface FastEthernet1/0/21
!
interface FastEthernet1/0/22
!
interface FastEthernet1/0/23
!
interface FastEthernet1/0/24
!
interface GigabitEthernet1/0/1
!
interface GigabitEthernet1/0/2
!
interface Vlan1
no ip address
!
interface Vlan10
ip address 192.168.10.2 255.255.255.0
!
interface Vlan20
ip address 192.168.20.1 255.255.255.0
!
interface Vlan30
ip address 192.168.30.1 255.255.255.0
!
interface Vlan40
ip address 192.168.40.1 255.255.255.0
!
interface Vlan50
ip address 192.168.50.1 255.255.255.0
!
ip default-gateway 192.168.10.1
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.10.1
ip http server
ip http secure-server
!
ip access-list standard TELNET-ACCESS
permit any
!
ip sla enable reaction-alerts
!
!
line con 0
line vty 0 4
access-class TELNET-ACCESS in
password Elmo2321
login
line vty 5 15
access-class TELNET-ACCESS in
password Elmo2321
login
!
end

Will Weeams · ‎07-09-2018

I forgot to add that with those changes I can now ping each vlan and the devices on them. I am not able to get to the vlans from the Time Warner ip range of 192.168.1.0 /24 to the VLANS I created.

Richard Burts · ‎07-09-2018

Thanks for the update. The updated configs look much better. The issue that I do see is that the IP addresses you specify in the vlan interface configs on the switch higher than vlan 10 use the same ip addresses on the vlan interface that the router uses. For example

interface Vlan20
ip address 192.168.20.1 255.255.255.0

You should correct this.

The static default route should be ok, assuming that 192.168.1.1 is the ISP gateway address. There is an option in configuring the static default route to specify that it is learned via DHCP rather than specifying the next hop address but what you have should work.

I am a bit puzzled with part of your response. You say that you are able to ping each vlan and the devices on them. Based on what I see in the switch config the only vlan that is active is vlan 10. What other vlans and devices are you talking about?

My guess is that the issue about getting to the vlans from Time Warner is that Time Warner does not have routes to those subnets.

HTH

Rick

HTH

Rick

Will Weeams · ‎07-09-2018

I moved ports into the different vlans and then connected a laptop and static ip for the vlans. I was able to get out to the internet on all the ports.

For the Time Warner side, do I just add a static route back to each vlan on the ISP router?

Richard Burts · ‎07-15-2018

I am a bit puzzled. In a previous post you tell us that "I am not able to get to the vlans from the Time Warner ip range of 192.168.1.0 /24 to the VLANS I created." And now you tell us " I was able to get out to the internet on all the ports." If you are able to get outside on all the ports then it would seem that the problem is resolved. Is that not the case?

HTH

Rick

HTH

Rick