Hi,

Have been troubleshooting a connection i created between a Cisco 2800 router and an Idirect X3 modem for hours. The X3 connects to the internet and works fine. so to improve the networks capabilities, I recently installed a Cisco 2800 router between the LAN and the Modem. but I cant seem to open web pages from any system on the LAN!#

Is it a NAT issue? Didn't configure NAT on the Cisco router, cos i expect that to be configured on the X3.

I dont think its a routing issue though, cos i just created a single default route pointing at the X3, and I can traceroute to internet sites from the router but not from a system on the network.

Any Cisco Guru in the house please help. Thanks.

laidback:

Hi,

Have been troubleshooting a connection i created between a Cisco 2800 router and an Idirect X3 modem for hours. The X3 connects to the internet and works fine. so to improve the networks capabilities, I recently installed a Cisco 2800 router between the LAN and the Modem. but I cant seem to open web pages from any system on the LAN!#
Is it a NAT issue? Didn't configure NAT on the Cisco router, cos i expect that to be configured on the X3.
I dont think its a routing issue though, cos i just created a single default route pointing at the X3, and I can traceroute to internet sites from the router but not from a system on the network.
Any Cisco Guru in the house please help. Thanks.

A few things.

How do you mean your modem connects to the internet and works fine? Are you saying you are trying to reach the internet using a PC on the back of the modem? If you have not, then let's start by doing that.


There a number of reasons your PCs are unable to reach the internet. I can help. Just do this first and let's take it from there.

Thanks!

Actually I can reach the internet from the back of my modem very well. It's the configuration on my router that's off. I really dont know what it is specifically.

So what's the mode of configuration of IP addresses on the PCs in your LAN, DHCP or static?

If DHCP, which of the devices on the network is configured as your DHCP server?

Its DHCP. I configured the router as a DHCP server and its giving out addresses as expected

So when you connect a laptop to the back of the modem,

1. do you assign a static IP address to the laptop or does the laptop pick up an address from the modem (DHCP)?.

2. If you assign an addresss to the laptop, what address do you assign? (Just write the first two octets of the address)

3. if DHCP please respond.

The Modem is also configured to act as DHCP server, but that's inconsequential, since the router actually doesn't foward broadcasts and is already acting as DHCP. Presently, the router is the DHCP server of the LAN.

When I connect to the modem directly, i rely on the DHCP server of the modem for addresses. but from the LAN, its the router that give s addresses.

This is the setup:

the router has two Ethernet interfaces. fa0/0 goes to a switch on the LAN and fa0/1 goes to the modem directly.

Now fa0/0 is on network 10.x.x.x

while fa0/1 is on the same subnet with the modem on network 83.229.x.x right?

So the router is meant to give out IPs in the 10.x.x.x network, which it does nicely. I also set it (the router) as default gateway on the IPs it gives out.


So I have no trouble reaching nodes on the 10.x.x.x network. But packets to the modem interface get dropped. I have this going on for routing:

ip route 10.0.0.0 255.0.0.0 10.x.x.x
ip 0.0.0.0 0.0.0.0 83.229.x.x

(don't want to use any routing protocol for now).

Now I can ping the router interface attached to the modem but cant ping the modem interface from a system on the LAN.

But i can ping all interfaces from within the router. I can even traceroute to remote sites on the internet from within the router only!

That means you are not natting.
You need to configure nat on your cisco router.

ip nat source list 1 interface fa0/1 overload.


This configures the router to nat all addresses in the list 1 which you will define as.

access list 1 permit 10.x.x.x 0.0.0.255

The 10.x.x.x is the internal network.


You then need to define interface fa0/0 as inside nat interface and interface fa0/1 as the outside nat interface.


int fa0/0
ip address x.x.x.x
ip nat inside


int fa0/1
ip address x.x.x.x
ip nat outside


and correct, you don't need any routing protocols.
define your static route this way.

ip route 0.0.0.0 0.0.0.0 int fa0/1


And this should get you up and running.

Let's know how you get on.

Yeah, actually I'm Natting just as you described, however let me reconfigure my default route like you have described and see,

Sorry I thought you said earlier that you are not natting on the Cisco router.

Nope still can't reach out,

Pings to the modem interface from the LAN report:

reply from x.x.x.x : destination net unreachable

x.x.x.x is router's address.

nateevs:

Sorry I thought you said earlier that you are not natting on the Cisco router.

Yeah, but a few hours ago i implemented NAT, before then pings were just timing out, but after the nat, 'destination net unreachable'

Can you copy and paste the running config of the router.
If the spam bot won't allow, copy and paste on a notepad and attach to your post.

I am assuming that your modem and the Cisco router's fa0/1 address are in the same subnet right?

Ok ,

Please find attached.

Yeah, the modem and router are in the same subnet. checked that too.

I am sorry. I just had a some time to look at your config.
Off the top of my head, I could not see anything wrong with it.

Can you please give me till the evening? I am leaving work now, when I get home I will try to simulate your network, run a few tests and let you know what the problem is.

Hey laidback,


I just got home and I just realized something on a second look. You are not permitting addresses assigned to your LAN to nat.

So you have

access-list 10 permit 10.13.2.5
access-list 10 permit 10.13.2.4
access-list 10 permit 10.13.2.6
access-list 10 permit 10.13.2.1
access-list 10 permit 10.13.2.3
access-list 10 permit 10.13.2.2


but these are the same addresses excluded in your DHCP excluded address configuration as shown below.

ip dhcp excluded-address 10.13.2.1 10.13.2.8


So effectively all addresses in the the excluded address range will get natted but consider that the router will not assign the PCs in your LAN any address in this range since you have asked it not to do so.  The first assignable address in your LAN will therefore be 10.13.2.9 and I don't see any access lists permitting this address and any higher.

What you need to do is to then clear off that access list and replace with

access list 10 permit 10.13.2.0 0.0.0.255

It doesn't have be 0.0.0.255 permitting the whole subnet, Iam just assuming you may want to as I don't know how many hosts you have in your LAN. You can adjust to what is appropriate.

Also, there isn't any need for the ip access-group 10 out command that you applied to the outside interface. This command is telling the access list to try to route traffic directly to the outside interface thereby by-passing the nat configuration and that's why you are getting the "destination net unreachable" ICMP replies. Remove that command and effect the suggestions and you should have you PCs able to route to the internet.



Let's know how you get on.

@Laidback.

I can see the spambot is blocking your posts. No I am not using a simulator. I have 2 live ADSL circuits to the internet with 5 public IP addresses on each circuit in my home lab. So I am able to replicate many problems live, not just on a simulator.

I have subsequently simulated your network with the exact set-up and the problem is solved. Follow the corrections I stated above and all your PCs will reach the internet. If you need more help, you can register a new username to post in here.

Bros you won't even confirm if you got it running or not. Haba!
Confirming that it works could be crucial info for other people.

here are the changes as they are now:

ip access-group out (i removed this line)

ip route 0.0.0.0 0.0.0.0 fa0/1 (i removed this and brought back this: ip route 0.0.0.0 0.0.0.0 83.229.v.v)

I left the dhcp exclusions since my system is static using one of them.

I left the NAT the way it has been

Yeah that's basically it. I'm going to clean the configs again and start implementing them one by one to really see the effects of each.

Oh nice to know you came back to see this. I didn't ask you to remove the excluded addresses command. I only asked you to include addresses that will be assigned via dhcp to the access-list. Those addresses are 10.13.2.9 and above.

If you don't add those addresses to the access-list, they will not be translated and your PCs will not be able to route to the internet.

@laidback hope you hv "en secret" configured,as well as console password and don't vty configured on it? cos this is the internet pal, any ill intentioned person can telnet into your router with d info. in your attachment, I must say I learnt from the ds trend sha, it seemed like a really cool lab activity ripe for troubleshooting,