1

So, in this (seemingly) never ending saga of me driving three hours to fail, I ran into another problem. I have a router and a switch on the side of a mountain that I need to get Internet to, and about five end devices that will rely on that Internet connection. I was able to ping the Internet (google.com and 8.8.8.8) from the router, but I was not able to ping the Internet from my switch, or end devices connected to said switch.

I was able to ping the public and private addresses of the router from the end devices, but I was not able to ping anything past that. My running configurations for both the router and the switch are below.

Router running configuration (the router is a Cisco 1900):

Connected.
!
ip domain name aftonradio.com
ip cef
no ipv6 cef
multilink bundle-name authenticated
!
cts logging verbose
!
crypto pki trustpoint TP-self-signed-338930330
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-338930330
 revocation-check none
 rsakeypair TP-self-signed-338930330
!
!
crypto pki certificate chain TP-self-signed-
    <!-- OMITTED -->
license udi pid CISCO1921/K9 sn FGL192424AJ
!
!
username <!-- OMITTED -->
!
redundancy
!
!
ip ssh time-out 60
ip ssh authentication-retries 5
!
!
!
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 ip address <!-- Public address -->
 ip nat outside
 ip virtual-reassembly in
 duplex full
 speed auto
!
interface GigabitEthernet0/1
 ip address 192.168.2.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 duplex full
 speed auto
!
ip forward-protocol nd
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat pool NATPOOL 192.168.2.1 192.168.2.11 prefix-length 24
ip nat inside source list 1 pool NATPOOL
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0
!
!
!
access-list 1 permit 192.168.2.0 0.0.0.255
!
!
!
control-plane
!
!
banner motd ^C BE VERY CAREFUL IN HERE! UNAUTHORIZED ACCESS PROHIBITED!!! ^C
!
<!-- OUTPUT OMITTED -->
!
scheduler allocate 20000 1000
!
end

Switch running configuration (The switch is a 300 series):

config-file-header
AftonSwitch
v1.4.2.4 / R800_NIK_1_4_194_194
CLI v1.0
set system mode switch

file SSD indicator encrypted
@
ssd-control-start
ssd config
ssd file passphrase control unrestricted
no ssd file integrity control
ssd-control-end cb0a3fdb1f3a1af4e4430033719968c0
!
voice vlan oui-table add 0001e3 Siemens_AG_phone________
voice vlan oui-table add 00036b Cisco_phone_____________
voice vlan oui-table add 00096e Avaya___________________
voice vlan oui-table add 000fe2 H3C_Aolynk______________
voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
voice vlan oui-table add 00d01e Pingtel_phone___________
voice vlan oui-table add 00e075 Polycom/Veritel_phone___
voice vlan oui-table add 00e0bb 3Com_phone______________
hostname AftonSwitch
line ssh
password 84670ba1e3259880245906ea38214cd08c0c9df9 encrypted
exit
<!-- OUTPUT OMITTED -->
ip ssh port 22
ip ssh server
ip ssh password-auth
ip ssh pubkey-auth auto-login
!
interface vlan 1
 ip address 192.168.2.2 255.255.255.0
 no ip address dhcp
!
interface gigabitethernet1
 description Router
 switchport mode access
!
interface gigabitethernet2
 description Transmitter
 switchport mode access
!
interface gigabitethernet3
 description Raspberry_Pi
 switchport mode access
!
interface gigabitethernet4
 description New_Nautel_Transmitter
 switchport mode access
!
interface gigabitethernet5
 shutdown
 switchport mode access
!
interface gigabitethernet6
 shutdown
 switchport mode access
!
interface gigabitethernet7
 shutdown
 switchport mode access
!
interface gigabitethernet8
 shutdown
 switchport mode access
!
interface gigabitethernet9
 shutdown
 switchport mode access
!
interface gigabitethernet10
 description Management_Interface
 switchport mode access
!
exit
ip default-gateway 192.168.2.1

According to everything I read here, we did everything we needed to in order to distribute Internet connectivity to the end devices. What did I miss?

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Feb 21 '18 at 19:08
0

You seem to be trying to mix NAT implementations.

Try this for addresses .2 to .11 (although I would not recommend allowing the switch to access the public Internet).:

no ip nat pool NATPOOL 192.168.2.1 192.168.2.11 prefix-length 24
!
ip nat inside source list 1 interface GigabitEthernet0/0 overload
!
no access-list 1 permit 192.168.2.0 0.0.0.255
!
access-list 1 permit 192.168.2.2 0.0.0.0
access-list 1 permit 192.168.2.3 0.0.0.0
access-list 1 permit 192.168.2.4 0.0.0.0
access-list 1 permit 192.168.2.5 0.0.0.0
access-list 1 permit 192.168.2.6 0.0.0.0
access-list 1 permit 192.168.2.7 0.0.0.0
access-list 1 permit 192.168.2.8 0.0.0.0
access-list 1 permit 192.168.2.9 0.0.0.0
access-list 1 permit 192.168.2.10 0.0.0.0
access-list 1 permit 192.168.2.11 0.0.0.0
!

You should also not route to the interface, but route to the next hop address:

no ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0
!
ip route 0.0.0.0 0.0.0.0 <next hop ISP address>
!
4
  • I'm am on the mountain now, still having the same issue. I issued your commands and I can still ping the Internet from the router, but nowhere else Sep 9 '17 at 0:25
  • Do you happen to have a firewall or ISP modem between your router and the Internet?
    – Ron Maupin
    Sep 9 '17 at 4:09
  • We have a small Linsys modem in between our router and our internet. Does that matter? Sep 9 '17 at 18:07
  • Yes, it could be a problem, depending on how it is configured. Unfortunately, questions about consumer-grade devices are off-topic here.
    – Ron Maupin
    Sep 9 '17 at 18:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.