Hello, I've got a problem that hopefully you can help with:   Remote Office. PC - MTU Default 1500 Switch - MTU Default 1500 Firewall - MTU Default 1500 Cisco WAN Router: inside interface - MTU Default 1500 outside interface - MTU 1600 >>> Note: Outside interfaces on Cisco Routers links to 1GB BT Fibre line. AES128 IPSEC VPN tunnel configured on the Cisco Routers.   >>> Head Office. Cisco WAN Router: outside interface - MTU 1600  inside interface - MTU Default 1500 Firewall - MTU Default 1500 Switch - MTU Default 1500 Server - MTU Default 1500 The PC can access everything at head office on the Server. HTTP is perfect. Unless it's HTTPS traffic. Then it struggles to load the pages. They load eventually, but often time out. I believe this may be fragmentation, but not sure what to change/where/why? ... View more

Hello. I have a Cisco 887va which is connected to an ADSL line. The internal network is a 192.168.1.x nework (255.255.255.0). My WAN is a staticly assigned IP from the ISP - to save giving my actual IP I'll give an example 50.50.50.50 I have a webserver which serves https (tcp 443). This sits on 192.168.1.10. This has outbound internet through the Cisco. I would like to make the https of the web server available externally, but only to 1 source IP (60.60.60.60). How do I make this available? My ISP have said I can use 50.50.60.61 - that is one of the IPs i'm allowed to use. I'd like this as simple as possible. I don't have a firewall (cbac/zbf). Just standard ACLs for management access to my WAN for SSH. I look forward to hearing from you. John. ... View more

Hello. I've got an 887va that is used for ADSL. Everything works fine. It's a basic setup to allow internal users to get onto the internet. I've recently ran a NMAP and NESSUS scan against the external WAN IP and everything now looks fine apart from DNS. It looks like from anywhere externally on the internet you can perform an nslookup using my router external WAN IP. I've tested and this is indeed the case. I'd like to turn that inciming DNS lookup feature off - I don't believe it is needed for anything. I'd rather not set up the CBAC or ZBF just for this. Please note my internal users MUST be able to still be able to browse to sites like www.yahoo.com and have it resolved correctly. I look forward to hearing from you on how I achieve this. I've included my entire config below and put the interesting parts in bold: ! ! Last configuration change at 17:31:15 GMT Wed Jan 8 2014 by admin version 15.2 no service pad service timestamps debug datetime msec service timestamps log datetime msec service password-encryption service sequence-numbers ! hostname xxxxxxxx ! boot-start-marker boot-end-marker ! ! enable secret 4 xxxxxxxxxxx enable password 7 xxxxxxxxxxxxxxxxxx ! aaa new-model ! ! aaa authentication login local_auth local ! ! ! ! ! aaa session-id common memory-size iomem 10 clock timezone GMT 0 0 clock summer-time BST recurring last Sun Mar 1:00 last Sun Oct 2:00 ! crypto pki trustpoint TP-self-signed-xxxxxxxx enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-xxxxxxxxxxxx revocation-check none rsakeypair TP-self-signed-xxxxxxxxxx ! ! crypto pki certificate chain TP-self-signed-xxxxxxxxxxx certificate self-signed 01   xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx                 quit ! ! ! ip dhcp excluded-address 192.168.0.1 192.168.0.10 ! ip dhcp pool myDHCPpool import all network 192.168.0.0 255.255.255.0 default-router 192.168.0.1 dns-server 192.168.0.1 ! ! ! ip domain name xxxxxxx.com ip name-server 8.8.8.8 ip name-server 8.8.4.4 ip cef no ipv6 cef ! ! license udi pid CISCO887VA-K9 sn xxxxxxxxxxxxxx ! ! username admin privilege 15 secret  xxxxxxxxxxxxxxxxxxxxxxxxx ! ! ! ! ! controller VDSL 0 ! ! ! ! ! ! ! ! ! ! interface Ethernet0 no ip address shutdown ! interface ATM0 no ip address no atm ilmi-keepalive ! interface ATM0.1 point-to-point pvc 0/38   encapsulation aal5mux ppp dialer   dialer pool-member 1 ! ! interface FastEthernet0 description Uplink to Switch switchport access vlan 50 no ip address ! interface FastEthernet1 switchport access vlan 50 no ip address shutdown ! interface FastEthernet2 switchport access vlan 50 no ip address shutdown ! interface FastEthernet3 switchport access vlan 50 no ip address shutdown ! interface Vlan1 no ip address ! interface Vlan50 ip address 192.168.0.1 255.255.255.0 ip nat inside ip virtual-reassembly in ! interface Dialer0 ip address negotiated no ip redirects no ip unreachables no ip proxy-arp ip nat outside ip virtual-reassembly in encapsulation ppp dialer pool 1 ppp chap hostname user@xxxxxxxxx.com ppp chap password 7 xxxxxxxx no cdp enable ! ip forward-protocol nd no ip http server ip http access-class 10 ip http secure-server ! ip dns server ip nat inside source list 1 interface Dialer0 overload ip route 0.0.0.0 0.0.0.0 Dialer0 ! access-list 1 permit 192.168.0.0 0.0.0.255 access-list 10 permit xx.xx.xx.xx (External IP) access-list 10 permit yy.yy.yy.yy (External IP) access-list 10 permit 192.168.0.0 0.0.0.255 dialer-list 1 protocol ip permit ! snmp-server community nagios-RVR RO 10 snmp-server location xxx snmp-server contact xxxx ! ! ! ! line con 0 login authentication local_auth no modem enable line aux 0 login authentication local_auth line vty 0 4 access-class 10 in password 7 xxxxxxxxxxxxx login authentication local_auth transport input ssh ! ntp server 1.uk.pool.ntp.org ! end ... View more