Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Gary Turner
Stats
Member since
12-15-2010
13
Posts
0
Helpful
1
Solution
07-07-2016
05:44 AM
Hi
See below the Interface definition:
interface Dialer0 description $FW_OUTSIDE$ ip address negotiated ip mtu 1452 ip nat outside ip access-group 101 in encapsulation ppp dialer pool 1 dialer-group 1 ppp authentication chap callin ppp chap hostname xxxxxx@broadband.net.uk ppp chap password 0 xxxxxxx no cdp enable ip virtual-reassembly !
So the access-list is applied to the inbound route.
I will try the rule you suggest, I expect it will work as it is allowing anything in and as such removes the FW in the same way issue no access-list 101 gets things working but having no firewall blocking random requests isn't going to work.
We have other sites that do not require a global permit rule, indeed they have a a global deny, these sites work so the firwall must be keeping track of the conenctions fromt he inside and allowing a response on the the same.
Regards
Gary
... View more
07-06-2016
01:40 PM
Hi
Thanks for your help but I'm not sure I follow you.
This is a general internet access FW which aplies PAT/NAT to the system originating the request to an unknown destinaton I cannot define inbound rules for every connection initiated.
We do not has such rules on any of the other IOS based routers we have so I'm thinking there is a different on the IOS XE config that I'm missing.
Regards
Gary
... View more
07-05-2016
10:09 AM
Hi, I'm seeing packet drops such as this:
*Jul 4 21:49:42.780: %FMANFP-6-IPACCESSLOGP: SIP0: fman_fp_image: list 101 denied tcp 82.165.172.29(80) -> 87.127.7.33(4099), 4 packets
in response to a request to a website www.peartreecleaning.co.uk.
the access list looks like this:
access-list 101 remark Auto generated by SDM for NTP (123) access-list 101 permit udp any eq ntp any eq ntp access-list 101 remark PPTP VPN access-list 101 permit gre any any access-list 101 permit tcp any any eq 1723 access-list 101 permit udp host 208.67.220.220 eq domain any access-list 101 permit udp host 208.67.222.222 eq domain any access-list 101 deny ip 192.168.30.0 0.0.0.255 any access-list 101 permit icmp any any access-list 101 permit icmp any any echo access-list 101 permit icmp any any echo-reply access-list 101 permit icmp any any time-exceeded access-list 101 permit icmp any any unreachable access-list 101 deny ip 10.0.0.0 0.255.255.255 any access-list 101 deny ip 172.16.0.0 0.15.255.255 any access-list 101 deny ip 192.168.0.0 0.0.255.255 any access-list 101 deny ip 127.0.0.0 0.255.255.255 any access-list 101 deny ip host 255.255.255.255 any access-list 101 deny ip host 0.0.0.0 any access-list 101 deny ip any any log
Thanks.
Gary
... View more
07-04-2016
05:31 PM
Hi
I'm struggling with a router config where I can see in the log that the response to an outbound request is being block by the ACL on the outside interface. The router is an ISR4321 running IOS XE 16.
The implementation is common enough:
Internal Network --> VLAN1/GigEthernet1 <-- R1 --> Dialer0/GigEthernet0 --> ADSL Modem --> Provider
I have NAT enabled and access-list 100 on the outside of VLAN1 and access-list 101 on the outside of the Dialer0 interface.
If I drop access-list 101 I can browser the web, if I add it back in only ping and DNS lookups seem to work and I can seen the response packets from a website I'm accessing being drop by the access list rule so it looks like the established sessions are not be respected.
I'm sure I'm missing a single command from my config but can't find it for looking!
Thanks in advance Gary
... View more
- Tags:
- NAT firewall
Labels:
03-22-2012
08:26 AM
Hi I'm using CCP to configure my Cisco 881, I need to assign my IP address range to the WAN interface (176.35.224.112/29), however everytime i enter the IP Address with a /29 subnet mask or indeed one of the usable addresses with a /32 I'm told I need to "Enter a valid IP address". I have also attempted to set the interfaces IP address via IOS directly and was also told the address was incorrect. Can anyone throw any light on the messages real meaning as the IP address is obviously valid. Thanks Gary
... View more
Labels:
03-06-2012
06:07 AM
Hi I have 4 SF300 switches I need to cascade together but the user guides do not seem to cover the physical aspects of cascading the swtiches. Here is what I was planning perhaps someone could verify the setup or give me the benefit of their experience. SW1 (port GB2) --> SW2 (port GB1) SW2 (port GB2) --> SW3 (port GB1) SW3 (port GB2) --> SW4 (port GB1) SW3 (port GB2) --> SW1 (port GB1) - loopback for cascade cable redundancy. Does this sound about right? after initial use the setup will be changed to place switches 3 and 4 in a factory at which time we will then use the GBIC connectors and fibre to connect SW2 to SW3 and then SW4 back to SW1. Thanks in advance for the help. Gary
... View more
Labels:
02-21-2012
09:39 AM
Hi I'm trying to establish if the Cisco 857 can support annex-m to improve upstream speeds, I'm aware I may need to change the ADSL firmware to do this but I cannot find any information if the router suports Annex-M. Does anyone have any experience of the 857 on annex-M? Thanks Gary
... View more
Labels:
Created by
Gary Turner
in Small Business Routers
in Small Business Routers
03-27-2011
09:16 AM
03-27-2011
09:16 AM
Now I feel silly, it was right under my nose. Thanks
... View more
03-27-2011
02:26 AM
Hi I'm hoping to convert a few connections from ADSL to FTTC but would like not to have to replace the Cisco 857 router already installed. To achieve this I would need to allocate one of the Ethernet ports as the WAN interface and configure PPPOE for authentication. I have to admit to using Configuration Professional most of the time but don't mind getting my hands dirty in IOS if needed to achieve this so any sample configs or guidence would be very much appreciated. Thanks Gary
... View more
Labels:
Created by
Gary Turner
in Small Business Routers
in Small Business Routers
03-27-2011
02:16 AM
03-27-2011
02:16 AM
Hi We have a SRP527W running a ADSL based broadband connection currently, we would like to switch to using FTTC for the internet link. I have found through these forums how to enable the 4th ethernet port as the WAN interface but cannot see how we can then specify the PPPOE settings required for FTTC. Is this possible on the SRP527W or the other SRP520 range? Thanks Gary
... View more
Labels:
12-23-2010
11:53 AM
The 877 has a console port, it is worth connecting the blue serial cable to to see what is happening during the boot process on the router. you can do the things there you would normally via Telnet and more.
... View more
Created by
Gary Turner
in Small Business Routers
in Small Business Routers
12-15-2010
03:44 PM
12-15-2010
03:44 PM
Hi Second post, I have a new SRP 527W, I've run through the initial config and am looking at the features available, in comparison the the PDF Admin Guide I seem to have a number of options missing from the menu. My router only shows Time setup & Switch setting, these look like the top and bottom items ... so I'm missing around 10 items ... including the ability to upgrade the firmware. According to te status page my router has "1.01.09 (001) Apr 7 2010". Help much appreciated. Gary
... View more
Labels:
12-15-2010
03:02 PM
Hi I'm working on my first SRP500 range router, I've been using the 800 series for some time so the setup on these devices seems a little basic by comparison although the SRP500's have some very attractive features. I seem to be struggling with a 'simple' need, I want to disable the DHCP server on the Default VLAN, I already have a DHCP server on the network and wish to continue to use that. Unfortunately there isn't a X to delete this profile, how do I remove it or at least disable it. Many thanks Gary
... View more
Labels:
07-07-2016
Hi See below the Interface definition: interface Dialer0 description
$FW_OUTSIDE$ ip address negotia...
07-06-2016
Hi Thanks for your help but I'm not sure I follow you. This is a general
internet access FW which ap...
07-05-2016
Hi, I'm seeing packet drops such as this: *Jul 4 21:49:42.780:
%FMANFP-6-IPACCESSLOGP: SIP0: fman_fp...
07-04-2016
Hi I'm struggling with a router config where I can see in the log that
the response to an outbound r...
03-22-2012
HiI'm using CCP to configure my Cisco 881, I need to assign my IP
address range to the WAN interface...
03-06-2012
HiI have 4 SF300 switches I need to cascade together but the user guides
do not seem to cover the ph...
02-21-2012
HiI'm trying to establish if the Cisco 857 can support annex-m to
improve upstream speeds, I'm aware...
03-27-2011
HiI'm hoping to convert a few connections from ADSL to FTTC but would
like not to have to replace th...
03-27-2011
HiWe have a SRP527W running a ADSL based broadband connection currently,
we would like to switch to ...
12-23-2010
The 877 has a console port, it is worth connecting the blue serial cable
to to see what is happening...
Created by
Gary Turner
in Small Business Routers
12-15-2010
12-15-2010
HiSecond post, I have a new SRP 527W, I've run through the initial
config and am looking at the feat...
Public Statistics
| Date Registered | 12-15-2010 02:50 PM |
| Date Last Visited | 08-18-2017 03:53 AM |
| Total Messages Posted | 13 |
