3

The router is connected to ISP which is 3500 series. There is a core switch connected to the router to the inside network. I can ping the internet from the router. but I cannot ping the internet from core switch and accesses switch. Any help please? Here is the configuration:

1 Router

OWWDSEROUTER#sh run
Building configuration...
Current configuration : 1552 bytes
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname OWWDSEROUTER
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 xxxx
!
no aaa new-model
!
!
!
!
!
!
!
!
!
!
!
!
!
!
no ip domain lookup
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
cts logging verbose
!
!
license udi pid C3900-SPE150/K9 sn FOC19102APP
!
!
!
redundancy
!
!
!
!
!
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 ip address 10.151.49.234 255.255.240.0
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 ip address 192.168.10.1 255.255.255.252
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/2
 no ip address
 shutdown
 duplex auto
 speed auto
!
router rip
 version 2
 network 192.168.10.0
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip nat inside source list NATADDRESSES interface GigabitEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 10.151.48.1
!
ip access-list standard NATADDRESSES
 permit 10.0.0.0 0.0.0.255
!
!
!
!
control-plane
!
!
!
line con 0
 password pa55w0rd
 logging synchronous
line aux 0
line 2
 no activation-character
 no exec
 transport preferred none
 transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
 stopbits 1
line vty 0 4
 password Pa55w0rd
 login
 transport input all
line vty 5 15
 login
 transport input none
!
scheduler allocate 20000 1000
!
end

2 core switch configuration

OWWDSECS#sh run
Building configuration...
Current configuration : 5423 bytes
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname OWWDSECS
!
boot-start-marker
boot-end-marker
!
enable secret 5 xxx
!
!
!
no aaa new-model
system mtu routing 1500
ip routing
ip dhcp excluded-address 10.1.10.1 10.1.10.20
ip dhcp excluded-address 10.1.20.1 10.1.20.20
!
ip dhcp pool vlan20
   network 10.1.20.0 255.255.255.0
   domain-name owwdse.gov.et
   dns-server 213.55.96.166
   default-router 10.1.20.1
!
ip dhcp pool vlan10
   network 10.1.10.0 255.255.255.0
   default-router 10.1.10.1
   domain-name OWWDSE.GOV.ET
   dns-server 213.55.96.148 4.2.2.2
!
!
no ip domain-lookup
!
password encryption aes
!
crypto pki trustpoint TP-self-signed-3930400128
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-3930400128
 revocation-check none
 rsakeypair TP-self-signed-3930400128
!
!
crypto pki certificate chain TP-self-signed-3930400128
 certificate self-signed 01
  30820241 308201AA A0030201 02020101 300D0609 2A864886 F70D0101 04050030
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
  69666963 6174652D 33393330 34303031 3238301E 170D3933 30333031 30303031
  31365A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 39333034
  30303132 3830819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
  8100BA3F C1ED6F08 0A7015C1 38713F23 AD545F99 5ED37090 822C5E83 D2A1FD1E
  35EF4E41 1F56637B C7364828 BF407113 48F4283E 3FA354F4 3415BFB4 E3B0B99B
  7B4DDA78 6FCD06FF CED2D5E9 DE22D914 7CC3C5FA D07B1AC0 F810A046 E1110294
  435D8C8E D98D1776 267F4A19 AE69DC19 82C18255 BA3BA6FD DBBA7795 3DC1622C
  45770203 010001A3 69306730 0F060355 1D130101 FF040530 030101FF 30140603
  551D1104 0D300B82 094F5757 44534543 532E301F 0603551D 23041830 1680145D
  75FE33FC 207F4677 776D4C37 D9739CA3 7501F730 1D060355 1D0E0416 04145D75
  FE33FC20 7F467777 6D4C37D9 739CA375 01F7300D 06092A86 4886F70D 01010405
  00038181 00B08206 69843C74 87C271CB 3A214EFB D5DD8FB3 D6D152D9 7741A520
  BEC7A10D 2B6690B7 F29DA32E 283E0E45 5EE1138A 8DC702B5 735599C9 71E1F2B5
  868012A6 0E803AEF D2DB7E10 6683F1A2 9F98A370 8CA7F3D0 F26E618D C748B0FC
  F5C447C2 A41C7333 AB621F84 E9251AD2 02EB4C25 0763F885 F5C884D2 CE3B4142
  0684AD2F BF
  quit
spanning-tree mode pvst
spanning-tree extend system-id
!
!
!
!
vlan internal allocation policy ascending
!
ip ssh time-out 5
ip ssh authentication-retries 5
ip ssh version 2
!
!
!
interface FastEthernet0
 no ip address
 no ip route-cache cef
 no ip route-cache
 no ip mroute-cache
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
 no switchport
 ip address 192.168.10.2 255.255.255.252
!
interface GigabitEthernet0/3
!
interface GigabitEthernet0/4
!
interface GigabitEthernet0/5
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/6
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/7
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/8
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/9
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/10
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/11
 switchport access vlan 20
 switchport mode access
!
interface GigabitEthernet0/12
 switchport access vlan 20
 switchport mode access
!
interface GigabitEthernet0/13
 switchport access vlan 20
 switchport mode access
!
interface GigabitEthernet0/14
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet0/15
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet0/16
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet0/17
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet0/18
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet0/19
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet0/20
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet0/21
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet0/22
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet0/23
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet0/24
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet1/1
!
interface GigabitEthernet1/2
!
interface GigabitEthernet1/3
!
interface GigabitEthernet1/4
!
interface TenGigabitEthernet1/1
!
interface TenGigabitEthernet1/2
!
interface Vlan1
 description MANAGEMENT
 ip address 10.1.1.2 255.255.255.0
!
interface Vlan2
 no ip address
 shutdown
!
interface Vlan10
 description DATA
 ip address 10.1.10.1 255.255.255.0
!
interface Vlan20
 description INTERNET
 ip address 10.1.20.1 255.255.255.0
!
router rip
 version 2
 network 10.0.0.0
 network 192.168.10.0
 no auto-summary
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.10.1
!
ip http server
ip http secure-server
!
!
!
!
line con 0
 password pa55w0rd
 logging synchronous
 login
line vty 0 4
 password pa55w0rd
 login
 transport input all
line vty 5 15
 login
 transport input none
!
end
5
  • I´m seem you have Rip running on your switch and router. Can you tried to ping de 2 vlans interfaces from your router, to see if the routing protocol is working well?? Sep 23, 2015 at 12:50
  • ping works well from router to vlans as well as to client PC Sep 23, 2015 at 13:28
  • from client PC i can ping to the router out side Ethernet port. the only problem ping not working outside the router Sep 23, 2015 at 13:32
  • Could you please show routes from switch and router. Then NAT table from the router and traceroute from one of the PCs in your VLAN 20.
    – Dex
    Sep 23, 2015 at 14:45
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 12, 2017 at 18:12

3 Answers 3

1

Here are your vlans interfaces configuration:

interface Vlan10
 description DATA
 ip address 10.1.10.1 255.255.255.0

interface Vlan20
description INTERNET
ip address 10.1.20.1 255.255.255.0

With ip address 10.1.20.1 and 10.1.10.1, then, i guess: 10.1.10.0/24 and 10.1.20.0/24

But in your access list, on the nat section, you only match one network, 10.0.0.0:

ip access-list standard NATADDRESSES
permit 10.0.0.0 0.0.0.255

Thats it, 10.0.0.0/24 from 10.0.0.1 to 10.0.0.254, and not 10.1.10.0 and 10.1.20.0. I guess you need to change NATADDRESSES like this:

ip access-list standard NATADDRESSES
 permit 10.1.10.0 0.0.0.255
 permit 10.1.20.0 0.0.0.255
1
0

Seems to be RIP and static routing running in your setup . Still static routing is picked by router because of its administrative distance of static route is lower than RIP

There is no specific static route Configured in router pointing towards coreswitch egress interface for reverse traffic . Configure this route and further check connectivity . Then you should be able to ping from core switch as well .

Router(config)# ip route 10.0.0.0 subnetmask 255.255.255.255 pointing towards gateway 192.168.10.2

0

Let's follow a packet from your local network (either 10.1.10.X or 10.1.20.X) and going to the Internet:

  1. When it reaches the Core switch it will be routed to 192.168.10.1 (default route)
  2. From Router it will be routed to the Internet.
  3. Because it matches the access list NATADDRESSES and going through GigabitEthernet0/0, NAT applies and the address 10.1.10.X or 10.1.20.X will be replaced by 10.151.49.234 just before the packet leaves Router

Let's now consider a packet originating from the Core switch:

  1. Because the origin of the packet is a local process on the Core going to the Internet, it will be routed to Router and gets the source address 192.168.10.2 (the outgoing interface)
  2. Because 192.168.10.2 doesn't match the access list NATADDRESSES, the packet will be routed to the Internet without being translated
  3. The packet will continue its journey until it reaches either a router that doesn't accept routing packets with private addressing, or the final destination and in this case that final destination has no route to 192.168.10.2 and this is why you can't ping the Internet from Core

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.