@Spork Schivago   The router configs look good. You have the right encapsulation on the trunk interface - the vlan's are up and trunking. I have not worked on this router specifically, but on the 3850 when working on the WLC you have to issue the wireless mobility controller command then you need to specify the vlan that is the management. Is there something in your config that you will need to change to reflect the vlan 1 to vlan 10 change? I would first think to review the WLC configs and make sure everything is linking up.    As for your Flex Connect configuration: there is nothing wrong with using flex connect, it just can add more complexity to the setup. For simplicity I would probably use Local mode. It is a basic access port type configuration. Flex mode you need to do a trunking setup on the switch port and then additional configs for the AP setup. Flex connect can be great for having multiple SSID's on different localized subnets, but it is just a more complex setup.    The configs above you have the "spanning-tree portfast disable" command on those three interfaces. Was there a reason for that? Generally on an access port you want to enable spanning-tree portfast. An exception if you had a device sending BPDU's like a generic switch or some versions of older linux systems could send BPDU's (however rare for currect OS types).      ... View more

@JPH85   The  224.0.0.1 IP is the all-hosts group multicast. So something is trying to start a multicast message. A few questions:   Do you have a VRF and if so is the interface coming in on a VRF or global table? Is that IP a public IP for your DMVPN crypto portion - or is it a Private IP coming through the tunnel for LAN traffic? If it is LAN related is it an IP you can track down?   Your right that there isn't much information out there on that specific error code (that is helpful anyways). I would suggest looking at the other information in the logs to help direct you to another troubleshooting step.    Troubleshooting steps:   do you have "ip multicast routing" enabled? are you using "ip pim sparse-dense mode" what does "show ip igmp snooping" give you? show ip mroute summary     Debugs you could try - just not all at once :D debug ip mroute debug ip igmp debug ip pim debug ip mpacket       ... View more

@Iain,   This sounds like an interesting setup, but your provided solution does not sound good at all. There are ways you can work that in, but it is not a good idea. Your router is a router and not a firewall. This setup could best be done on a firewall for the restrictions.   I think the best solution would be to put a new switch in front of your router, and then you would connect your WAN link into that switch – your router to the switch and their firewall to the switch. This would allow your router and their firewall to both be on the same /29 WAN IP block.   Since their link is not directly attached to your router that dramatically improves your security. You could go a step farther and put an outbound ACL on your inside interface to block the IP you provided them. This prevents them from coming to your inside network via your WAN interface. I would assume you have some ACL on your WAN interface to block generic traffic attacks (if not look into it), but if so, just add that new IP to the deny list and lock it out there too.   You can use a high end or dummy switch. It depends on your network and level of control. Obviously at managed switch will give you greater controls including SNMP, NetFlow, and other things if desired, but an unmanaged switch would work for this situation as well.   If you wanted to use your existing LAN switch you could do that too. You would isolate your WAN traffic on a pure L2 VLAN. This is a safe method but does put a heavy burden on your switch. This, however, is an option if you don’t have a budget for another switch. It would be my last option though if I could avoid it. ... View more

I am sure there is a way to architect it like that. It just requires more complex configurations. The static NAT can be changed to do a NAT pool so that you are mapping SubnetA/24 to the SubnetB/24 as a dynamic 1-to-1. To have this done in both directions I would probably split that NAT table up to different devices. i.e. use J2 to dynamic NAT towards R1, and R2 to dynamic NAT towards J1.   Trying to do that on the same router would be confusing to read the NAT tables (and the configurations) if you were another engineer working through the configs while troubleshooting. Think of it as if you had a complex problem going how difficult would it be to troubleshoot if you had thousands of lines of translations from many IP’s in both directions. The job to write the original configs, have others maintain it, and then troubleshooting is certainly not something I would ever put into an actual production network.     However, for the purpose of education setting it up in a lab is good to do just to work it out. ... View more

Thanks for the update on the hardware. I see that in your original post but didn’t realize that was the router model. It looks similar to the 1811’s and such where it looks to have a router and switchblade/module in it. If you are connecting your AP’s to the switch module you will want them setup as Access Mode, not trunked mode. The only purpose for using a trunking configuration for an AP is if you will be using Flex Connect. That typically isn’t a feature set though unless you have an actual dedicate WLC like 4400, 5500, or 8500. So, for your purposes, I can’t see a reason to use trunking to your AP’s.   As for the native vlan. That is a whole different topic, but basically, the native vlan is to mark traffic that did not come in tagged. The trunks can only forward tagged traffic so if you have data coming from a router first that would otherwise not be tagged that traffic can then be forwarded via the native vlan.   The purpose of my statements towards changing the Native Vlan was mainly because I was suggesting you not use VLAN 1, and if you are not going to use vlan1 then you needed to change the Native VLAN to something other than vlan1. There are many security vulnerabilities to why not to use vlan 1 as well as Cisco’s best practices states to not use it for multiple other reasons.   Cool – hopefully you figure it out, but if not just message back. Good luck!     ... View more

chira.cipri@gmail.com   This is absolutely possible. This is actually a fairly common type of setup when going from a corporate network towards a client network. The objective is that your client network will only see a provided IP or range of IP's. What you will want to do is create a loopback interface on your R2 router. The subnet used in that loopback will become your NAT range. That NAT range is used by R1 and any other traffic in R1 to target networks behind J1.    For example, if 172.16.10.251 is a host within J1's network you can then map that IP to 50.1.1.251 with a NAT. You would then use a route-map in your NAT statements to specify that any traffic coming from 192.168.10.0/24 bound for  172.16.10.0/24 will NAT'd to the inside interface of your NAT router (Inside being J2 and outside being R1).   All that J2 will see is the Fa2/0 interface IP on R2. Your hosts in R1 will target the 50.1.1.x IP instead of the 172.16.10.x IP. This should give you what you're looking for I believe. You may have to tweak the IP's if I didn't fully understand your topography.    Here is a config example you can reference:   Router - R2 interface Loopback10 description for Host to Host NAT Pool ip address 50.1.1.1 255.255.255.0 interface FastEthernet1/0 description Towards R1 ip address 10.1.1.1 255.255.255.252 ip nat outside ! interface FastEthernet2/0 description Towards J1 ip address 10.2.1.1 255.255.255.252 ip nat inside ! ip route 50.1.1.0 255.255.255.0 10.2.1.2 name NAT-Range-to-Client ip route 50.1.1.251 255.255.255.255 10.2.1.2 name Host1-1 ip route 50.1.1.252 255.255.255.255 10.2.1.2 name Host1-2 ! ! ip nat inside source route-map rm-NAT interface FastEthernet2/0 overload ip nat outside source static 192.168.10.251 50.1.1.251 ip nat outside source static 192.168.10.252 50.1.1.252 ! ip access-list extended acl-NAT-Overload permit ip 10.0.0.0 0.127.255.255 172.16.10.0 0.0.0.255 permit ip 192.168.10.0 0.0.2055.255 172.16.10.0 0.0.0.255 deny ip any any ! ! route-map rm-NAT permit 10 match ip address acl-NAT-Overload ! ! ! ! ... View more

@Spork Schivago,   What is the router and WLC type your using? That has a lot to do with the configs. Some devices default to dot1q encapsulation like the Cisco 4510, while others you have to specify it like the Cisco 6500.   Off the top I would first suggest not using VLAN 1 at all. This can pose problems later on when trying to scale up your network, and there are many other reasons not to use it. You should move the IP address from vlan 1 to any other number, then shutdown your vlan1 SVI. Then you should do specify a native vlan. Currently because you have not specified one it is using vlan 1. So then your trunk configuration should look something like:   vlan 10 name DataNet ! vlan 900 name NativeID ! interface vlan 1 no ip address shutdown ! interface vlan 10 description Data ip address 10.0.0.2 255.255.255.0 no shutdown ! interface Wlan-GigabitEthernet0/1/8 switchport trunk native vlan 900 switchport trunk allowed vlan 10,40 switchport mode trunk end   Then verify the actual status of your trunks by doing a show interface trunk command to see if vlan 10 and 40 are being allowed or being pruned. Also run the show interface command on the wlan-gig0/1/8 interface. That should identify the encapsulation type that is being used. The command would be   show interface wlan-gig0/1/8 switchport <Sample Output> Name: WLAN-Gig0/1/8 Switchport: Enabled Administrative Mode: trunk Operational Mode: trunk Administrative Trunking Encapsulation: dot1q Operational Trunking Encapsulation: dot1q Negotiation of Trunking: On Access Mode VLAN: 1 (default) Trunking Native Mode VLAN: 900 (Native-dot1Q) Administrative Native VLAN tagging: enabled Voice VLAN: none   So: move off of vlan 1 add new vlan to trunk add a native vlan to trunking interface test – if it doesn’t work then: show interface wlan-gig0/1/8 switchport show interface trunking show logging ... View more

Known Break sequences for various programs just so that it is out there of what it should be.   ... View more

Break Sequence for Cisco devices   The change in computers that have moved away from serial ports and an actual “break” key on the keyboards makes it difficult for many people to get a Cisco device to drop to rommon mode on startup for recovery procedures. Now that laptops do not come with serial ports by standard and require a USB to serial adapter for network engineers to console into devices this has also caused issues with traditional break sequences.   The most common programs like HyperTerminal, Putty, and SecureCRT have a break sequence which is “Ctrl-Break”. The fact that many computers, laptops, and keyboards do not have a “break” key makes it very difficult to drop into rommon when accessing a Cisco device from the console port.   A rarely known trick to accessing the rommon mode of a Cisco device can be done without the use of the “break” key. It is more involved, but considering that most people will reload a switch/router numerous times in frustration to get the rommon prompt that this trick is actually a faster method.   Simulated Break Sequence for Cisco Devices: The best method that I have found to work time after time is a simulated break sequence. This is a very straight forward method. Start with the router (or device – will reference router for simplicity) powered on. Access the routers console port with the standard console connection settings:   9600 baud rate No parity 8 data bits 1 stop bit No flow control   Once the prompt is up. Press enter to get some commands to the device even if it is to get the “login” to fail from a failed login attempt. Once done, change your console settings to the setup below.   1200 baud rate No parity 8 data bits 1 stop bit No flow control   Once the baud rate is changed then you will no longer see any new responses on your screen. Power cycle the router and immediately press and hold the space bar. Keep it pressed for about 10 – 20 seconds. Change your Baud rate back to 9600 and press enter. You should be in rommon mode. If not then repeat and hold the space bar down longer.   This process has worked for me on every device I have tried it on. Try it next time your stuck looking for the break key on your keyboard. For those that do have the Break key here are the known sequences below. IF those don’t work – try the above.   Good luck!   ... View more

Does this issue happen on the other vlans? I notice you have VLAN 114 and VLAN 124 in that same trunk. What happens if you put PC A on VLAN 114 on the 4500 and then move it to the 3560 on VLAN114, will you get the same issues as on VLAN103? -Toby Please don't forget to rate any helpful post. _____________________________________ There are no great limits to growth because there are no limits of human intelligence, imagination, and wonder. - Ronald Reagan ... View more

I take it that you are using DHCP on your network? I would try to use a static IP on your PC and then try and move it from switch to switch to see if the behaviour is the same. The issue may be more related to other issues such as duplicate IP's DHCP lease timers, or other issues. Check if a static IP on your machine will work. Additionally you could check for a stale ARP/MAC entry just by removing the PC from switch A and then before reconnecting it to Switch B, you can check the ARP or CAM table to see if the entries have cleared out. They may still be there if the timer hasn't expired so you may have to wait the duration of the timer, but I would be surprised if that was your issue. -Toby Please don't forget to rate any helpful post. _____________________________________ There are no great limits to growth because there are no limits of human intelligence, imagination, and wonder. - Ronald Reagan ... View more

As stated above you can configure the ASR router in many ways the exact same as you did any other router. You do not need to enable the VRF's, however for the management interface you can create a VRF if needed to help segment your routing table. In your case I would just leave it alone for now. The router will handle data just fine. I am using an ASR 1002 as our internet WAN router and I was able to pretty much port our 7200 config directly over to the ASR with little work to make the config compatible. -Toby Please don't forget to rate any helpful post. _____________________________________ There are no great limits to growth because there are no limits of human intelligence, imagination, and wonder. - Ronald Reagan ... View more

Ok I am struggling with this one the more I write my configs for it. I think I will put this in my lab tomorrow and try it out. This is about the direction I was thinking originally. This may need to be altered a little bit. The idea is to get a tunnel between both sites (this is just a GRE tunnel - no encryption), then pass your R2 Public IP over to R1 and have it NAT to your existing NAT list so it can route using the current configs. The goal is to minimize the amount of work. _______________________________________________________ R1 interface GigabitEthernet0/1 ip address 216.3.3.1 255.255.255.0 ! interface Tunnel0 description R1 VPN to R2 ip address 10.1.1.1 255.255.255.252 ip broadcast-address 10.1.1.3 ip mtu 1400 ip nat inside ip virtual-reassembly ip tcp adjust-mss 1360 load-interval 30 keepalive 5 4 tunnel source 216.3.3.1 tunnel destination 216.4.4.1 tunnel key 121212 ! ip nat inside source static 10.0.0.3 216.1.2.2 R2 interface GigabitEthernet0/1 ip address 216.4.4.1 255.255.255.0 ! interface Tunnel0 description R1 VPN to R2 ip address 10.1.1.2 255.255.255.252 ip broadcast-address 10.1.1.3 ip mtu 1400 ip virtual-reassembly ip tcp adjust-mss 1360 load-interval 30 keepalive 5 4 tunnel source 216.4.4.1 tunnel destination 216.3.3.1 tunnel key 121212 ! ip route 216.1.2.2 255.255.255.255 10.1.1.1 -Toby Please don't forget to rate any helpful post. _____________________________________ There are no great limits to growth because there are no limits of human intelligence, imagination, and wonder. - Ronald Reagan ... View more

This is a good start. I am typing this from my tablet so it is a bit hard to write up a config. I will write you up a config in the morning and send your way. You got the right idea,but there is more needed. The NAT will go on the R1 side of the tunnel. Using a route-map will best help look for the correct traffic. I will get you a basic config and you can modify it based on your IP's and environment. Toby Sent from Cisco Technical Support Android App ... View more

Obaid, My first thought here would be for you to create a point-to-point GRE tunnel from R2 to R1. This will provide your two routers a connection to each other. R2 can advertise out the 216.4.4.0/24 network, and then have a static route on it that points to the other side of the tunnel to R1 to get to the address range of Private range of your servers (once the packets get to R1 that router should have the routing table already setup properly). At this point you would just need to create a route-map on the R1 Tunnel that is looking for traffic from 216.4.4.2 on TCP port 80/443 and then NAT that traffic to your 10.0.0.0/24 range, similiar to what you already have set up on R1. Let me know if you need help with those configs. -Toby Please don't forget to rate any helpful post. _____________________________________ There are no great limits to growth because there are no limits of human intelligence, imagination, and wonder. - Ronald Reagan ... View more