Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Daniel Boling
Stats
Member since
08-03-2011
33
Posts
15
Helpful
5
Solutions
12-09-2013
05:11 PM
Here is a really good discussion I remember reading a while back: https://learningnetwork.cisco.com/thread/37638
... View more
12-09-2013
04:58 PM
Bryan, Wilson is asking you to run the commands show interfaces and show interfaces status err-disabled from the CLI and post the output. You might also make sure the 3COM switch does not have any conflicting VLAN configuration.
... View more
10-01-2013
10:51 PM
Eric, You do have to have ip nat inside configured in your subinterfaces. Let's narow this down a bit. Have (at least) the following configured: interface GigabitEthernet0/0 Ip address dhcp ip nat outside no shutdown interface GigabitEthernet0/1 no ip address no shutdown interface GigabitEthernet0/1.16 encapsulation dot1Q 16 ip address 192.168.15.1 255.255.255.0 ip nat inside ip nat inside source list 1 interface GigabitEthernet0/0 overload access-list 1 permit 192.168.16.0 0.0.0.255 ip route 0.0.0.0 0.0.0.0 dhcp Try: Router# ping 8.8.8.8 Assuming you get a successful reply, please try this: Router# ping 8.8.8.8 source 192.168.16.1 Do you get a reply?
... View more
09-29-2013
02:35 PM
Andre, Use "ip address negotiated" instead of "ip address dhcp hostname MYROUTER" under the Dialer0 interface
... View more
09-29-2013
01:36 PM
Nathan, I have ran into similar issues in the past with static NAT statements disappearing. (ex: https://supportforums.cisco.com/thread/2214331) As this sounds like a software issue, I would suggest to upgrade your router to the latest iOS release.
... View more
06-13-2013
07:33 AM
I have this configuration in many routers: ip local pool COMPANYVPN_POOL 172.30.255.1 172.30.255.254 crypto ipsec transform-set COMPANYVPN_SET esp-3des esp-sha-hmac crypto isakmp client configuration group COMPANYVPN key <company_password> dns <company_dns_ip> domain <company_domain_name> pool COMPANYVPN_POOL acl COMPANYVPN_ACL netmask 255.255.255.0 crypto isakmp profile COMPANY_IKE_PROFILE match identity group COMPANYVPN client authentication list COMPANYVPN_VPN_XAUTH isakmp authorization list COMPANYVPN_VPN_GROUP client configuration address respond virtual-template 1 crypto ipsec profile COMPANYVPN_IPSEC_PROFILE set transform-set COMPANYVPN_SET set isakmp-profile COMPANYVPN_IKE_PROFILE interface Virtual-Template1 type tunnel ip unnumbered <internet-facing interface> tunnel mode ipsec ipv4 tunnel protection ipsec profile COMPANYVPN_IPSEC_PROFILE ip access-list extended COMPANYVPN_ACL permit ip 172.30.255.0 0.0.0.255 any permit ip <company_subnet_id> <company_wildcard_mask> any aaa new-model aaa authentication login default local aaa authentication login COMPANYVPN_VPN_XAUTH group radius aaa authorization exec default local aaa authorization network COMPANYVPN_VPN_GROUP local radius-server host <company_radius_ip> key <radius_key> This configuration works perfectly on every router I've configured using the Cisco VPN Client on Windows, and the native Cisco IPsec VPN client on Mac, except for this one. I have the above configured on a CISCO861-K9 and can successfully connect with both PC and Mac. However, the Mac is unable to contact the local network. The show crypto ipsec sa command reveals the following: PC: local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) remote ident (addr/mask/prot/port): (172.30.255.52/255.255.255.255/0/0) Mac: local ident (addr/mask/prot/port): (172.30.255.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (172.30.255.53/255.255.255.255/0/0) The difference in this router than the others with the same configuration, is that this router also has a site-to-site VPN configured (crypto map is configured under the internet-facing interface). Why is the local ident assigned a different value for the Mac? Thank you
... View more
Labels:
05-31-2013
05:43 AM
interface wlan-ap0 description Service module interface to manage the embedded AP ip unnumbered Vlan1 The configuration needed by your router will be different than my example above. You need to log into the module to configure wireless settings. Please refer to these documents: http://www.cisco.com/en/US/docs/routers/access/1900/software/configuration/guide/wlan.html http://www.cisco.com/en/US/docs/routers/access/800/880/software/configuration/guide/880_basic_device_wireless_config.html
... View more
05-29-2013
05:47 PM
Richard, Your router has many different types of interfaces (WAN interface(s), switch ports, wireless radio's, etc.) You can create a BVI (Bridge Group Virtual Interface) to interconnect your integraded wireless radio and switch ports. Below is sample code from another post I made, which whould be a good example for you to work with. If you are still having issues, please post your config so we can assist you further. ! Create an SSID and broadcast: dot11 ssid MY_SSID vlan 1 authentication open authentication key-management wpa guest-mode wpa-psk ascii MY_PASSWORD ! Configure the physical interface, assuming you have a Dot11Radio0 interface interface Dot11Radio0 no shutdown no ip address encryption vlan 1 mode ciphers tkip ssid MY_SSID ! Configure a subinterface interface Dot11Radio0.1 encapsulation dot1Q 1 native bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 spanning-disabled bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding ! Configure a BVI, where x.x.x.x x.x.x.x is your LAN gateway IP address and subnet mask interface BVI1 ip address x.x.x.x x.x.x.x ip nat inside ip virtual-reassembly ! Modify your VLAN configuration interface Vlan1 no ip address ip nat inside ip virtual-reassembly bridge-group 1 bridge-group 1 spanning-disabled ! Other commands bridge 1 route ip
... View more
05-27-2013
11:34 PM
You either need to add dns manually if you are keeping your static ip on your workstation, or change your workstation back to dhcp so you can acquire ip settings from your dhcp pool in the router. * you beat me to it John Sent from Cisco Technical Support iPhone App
... View more
05-27-2013
11:06 PM
Make sure you also configure DNS on your computer. Try Google's public DNS servers 8.8.8.8 and 8.8.4.4 Can you ping an public IP address from your computer such as 8.8.8.8?
... View more
05-27-2013
10:35 PM
I am not sure why your router is not taking the IP ACL subcommand. However, it looks like your configuration is correct using regular ACL. Please enable FastEthernet0/1: interface FastEthernet0/1 no shutdown To cleanup, you can remove the ACL that is not in use: no ip access-list standard INTERNET-BOUND-ACL
... View more
05-27-2013
10:04 PM
Since you have not worked with IP SLA before, I'll give an example on what Richard is referring to. Configure the following to your specifications. The example will test internet reachability by sending an ICMP echo request to Google's public DNS server (8.8.8.8) from the primary internet connection first. If the test does not meet the conditions (in this case, performed every 15 seconds with a 1000 millisecond timeout and threshold), the routing information for the secondary internet connection will be inserted in the routing table. Take note of the evernt manager applet at the end. I put this there to automatically clear all nat translations when the default route is updated. 1.1.1.1 (FastEthernet0/0) = next hop for primary internet connection 2.2.2.2 (FastEthernet0/1) = secondary internet connection track 1 ip sla 1 reachability delay down 1 up 1 ip nat inside source route-map NAT1 interface FastEthernet0/0 overload ip nat inside source route-map NAT2 interface FastEthernet0/1 overload ip route 0.0.0.0 0.0.0.0 1.1.1.1 track 1 ip route 0.0.0.0 0.0.0.0 2.2.2.2 2 ip route 8.8.8.8 255.255.255.255 FastEthernet0/0 1.1.1.1 ip route 8.8.8.8 255.255.255.255 Null0 2 ip sla 1 icmp-echo 8.8.8.8 source-interface FastEthernet0/0 timeout 1000 threshold 1000 frequency 15 ip sla schedule 1 life forever start-time now route-map NAT2 permit 1 match ip address 1 match interface FastEthernet0/1 ! route-map NAT1 permit 1 match ip address 1 match interface FastEthernet0/0 event manager applet IP_SLA_PROBE event track 1 state any action CLEAR_NAT cli command “clear ip nat translation forced”
... View more
05-27-2013
09:04 PM
I had typed standard as apposed to extended earlier, and had corrected the post. Let's try removing any existing ACLs and start from scratch. Please do a show running-config. There will be a line beginning with ip access-list, copy that entire line. example: show running-config ... ip access-list standard INTERNET_BOUND_ACL now, enter paste that line with the word no in front of it example: no ip access-list standard INTERNET_BOUND_ACL You should now have no ACLs (verify via show ip access-list). Now create a standard access list: ip access-list standard INTERNET_BOUND_ACL 10 permit 192.168.1.0 0.0.0.255
... View more
12-09-2013
Here is a really good discussion I remember reading a while back:
https://learningnetwork.cisco.com/...
12-09-2013
Bryan,Wilson is asking you to run the commands show interfaces and show
interfaces status err-disabl...
10-01-2013
Eric,You do have to have ip nat inside configured in your
subinterfaces.Let's narow this down a bit....
Created by
Daniel Boling
in Routing
09-29-2013
09-29-2013
Andre,Use "ip address negotiated" instead of "ip address dhcp hostname
MYROUTER" under the Dialer0 i...
09-29-2013
Nathan,I have ran into similar issues in the past with static NAT
statements disappearing. (ex:
http...
Created by
Daniel Boling
in Routing
06-13-2013
06-13-2013
I have this configuration in many routers:ip local pool COMPANYVPN_POOL
172.30.255.1 172.30.255.254c...
05-31-2013
interface wlan-ap0description Service module interface to manage the
embedded APip unnumbered Vlan1T...
05-29-2013
Richard,Your router has many different types of interfaces (WAN
interface(s), switch ports, wireless...
05-27-2013
You either need to add dns manually if you are keeping your static ip on
your workstation, or change...
05-27-2013
Make sure you also configure DNS on your computer. Try Google's public
DNS servers 8.8.8.8 and 8.8.4...
05-27-2013
I am not sure why your router is not taking the IP ACL subcommand.
However, it looks like your confi...
05-27-2013
Since you have not worked with IP SLA before, I'll give an example on
what Richard is referring to. ...
Public Statistics
| Date Registered | 08-03-2011 12:56 PM |
| Date Last Visited | 02-20-2019 02:06 AM |
| Total Messages Posted | 33 |
| Total Helpful Votes Received | 15 |
