not able to route outside lab network

[robert_cotton11]

I purchased CCNA lab equipment a few weeks ago. I am also studying for the CCNA. I have a 1841 that is connected via ethernet to the rest of my network. when I ssh into it I am able to route out to the internet and my home network. However I also have 2 2821's and 2 2950 switches and when I am logged in I am able to route only up to the FA interface that is connected to my home network. I only have basic static routes configured and to me it should be working but I am missing something. I have tried using the T! interfaces and also tried using the ethernet inferfaces. I need to clean up my configs before I post them if that would also be of help. thanks for looking.

[Jon Marshall]

We are going to need -

1) the configurations

2) a quick layout diagram. Doesn't have to be anything fancy.

3) a description of where you are pinging from ie. IP address and where you are pinging to.

Can you add all the above as attachments.

Jon

[robert_cotton11]

I have attached all requested information. Please let me know if you need anything else. right now I have the serial ports shutdown and have it connected via ethernet through my switch.

[Jon Marshall]

Couple of clarifications first -

1) R1 and R2 have a 192.168.44.0/24 subnet  but your diagram doesn't show this ?

2) following on from that all your routers are on the 10.10.1.0/24 network. So do you want both routers to also have the same 192.168.44.0/24 subnet on their LAN interfaces ?

ie. if the core router tries to send traffic to 192.168.44.0/24 it is not going to know which router to send it to ie. R1 or R2 so I think you may want different IP subnets on their LAN interfaces.

So bearing that in mind you need to add routes to a number of devices -

your core router doesn't know about the 192.168.44.0/24 network so you need to add a route to it. But as I said above that means you should have it on only one of the routers ie. R1 or R2.

The more immediate problem is you cannot ping beyond 192.168.1.3 from R1,R2 or the switch.

This is probably because your ATT router does not have a route for 10.10.1.0/24 and that will be the source IPs when pinging from any of the internal devices.

So the easiest thing would be, if possible, to add a route to the ATT router for that subnet pointing to 192.168.1.3 on the core router.

If you can't do this then there is another thing we can do to fix it but try that first.

One last point. If you want internet connectivity for your internal devices the ATT device is also going to have to do NAT for the 10.10.1.0/24.  It may or may not be able to do this as some gateway devices only NAT the locally connected internal LAN ie.in your case 192.168.1.0/24.

So you need to check whether it can. If it can't then we can use that fix I was talking about which not only solves the routing but also the NAT problem as well.

See what you can do and feel free to come back with any more queries.

Jon

[robert_cotton11]

so the 44.x interfaces I have shutdown and they are not connected to anything. Do I just need to clear the configs for the interfaces I am not using. I thought I had put in aroute to the 192.168.1.0 network. So what I should put in on the corerouter would be ip route 192.168.1.0 255.255.255.0 192.168.1.254 ? Yeah this gateway provided by ATT won't do nat back to the 10.x network. 

[Jon Marshall]

It's not a route for 192.168.1.0/24 it is for 10.10.1.0/24 because the ATT router doesn't know about this network.

Before you add any routes do you want your 10.10.1.0/24 devices, and any other subnets you create, to be able to get to the internet ?

If so it my be easier to just use the alternative solution now if the ATT router won't do NAT for other subnets.

Can you confirm ?

Also it makes no difference if you are not using the 192.168.44.0/24 subnet whether you leave the interfaces up or shut them down.

I was just explaining that if you do want to use them at some time you will need to have that subnet on just one of your internal routers.

Jon

[robert_cotton11]

Looks like my reply didn't get posted. I would like that internal equipment to be able to access the internet. the NVG510 from what I can tell can not setup a static route back to my router. what is my option for getting R1, R2 and the switch to have access to the internet

[Jon Marshall · Accepted solution]

Add this to your configuration in the core router -

int fa0/0
ip nat outside

int fa0/1
ip nat inside

access-list 101 permit ip 10.10.10.0 0.0.0.255 any

ip nat inside source list 101 interface fa0/0 overload

If you add more internal subnets later then you will need -

1) to add a route to core router pointing to the relevant internal device eg. R1/R2

2) update acl 101 with the new subnet so it will be included in the NAT.

Note you can use a standard acl instead of an extended if you want and a lot of people do but I have just got into the habit of using extended acls.

Whichever you use the source network cannot be "any" otherwise it usually doesn't work.

And you should not use the "log" keyword for these acls as that will stop NAT working as well.

The above works by translating all internal IPs to the outside interface IP of your core router ie. 192.168.1.3.

So the ATT router can route back to this because it has a directly connected interface in that subnet and it does NAT for that subnet as well.

Sorry for the long winded explanation but as you are studying CCNA I thought you would probably want to understand it all and what can catch you out.

Jon

[robert_cotton11]

thank you so much for your help. That absolutely worked. I can now ping the gateway and other devices on my network.

[Jon Marshall]

No problem, glad to help.  

Good luck with your studies.

Jon

[robert_cotton11]

Ok I understand. yes I would like the internal routers to be able to access the internet. and the NVG510 apparently can not route back to the 10.x network. so what is the work around?