1

I have set up a sub interface on Gi0/1 and I would like to provide access to the internet for devices on the VLAN that routes to Gi0/1.200. The devices pick up DHCP addressing just fine but cannot access the internet and do not see to route to 0.0.0.0/0

Can anyone please help me with what I am missing? Here is my running config

    Current configuration : 6283 bytes
!
! Last configuration change at 13:03:45 gmt Thu Nov 2 2017 by admin
!
version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname EASI-FW1
!
boot-start-marker
boot-end-marker
!
!
logging buffered 51200 warnings
enable secret 5 $1$Wdss$ruUuTeVDT/yXXHu17XZ5n.
!
no aaa new-model
ethernet lmi ce
clock timezone gmt -8 0
!
!
!
!
!
!
!
!
!
!
!
!
ip domain name easi.local
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
crypto pki trustpoint TP-self-signed-1664236970
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-1664236970
 revocation-check none
 rsakeypair TP-self-signed-1664236970
!
!
crypto pki certificate chain TP-self-signed-1664236970
 certificate self-signed 01

        quit
license udi pid CISCO1921/K9 sn 
!
!
username admin privilege 15 secret 5 
!
redundancy
!
!
!
!
lldp run
!
!
class-map match-any Voice
 match protocol sip
 match protocol rtp audio
class-map match-any QoS-Bulk
 match protocol secure-nntp
 match protocol smtp
 match protocol tftp
 match protocol ftp
class-map match-any QoS-Management
 match protocol snmp
 match protocol dns
 match protocol secure-imap
class-map match-any QoS-Inter-Video
 match protocol rtp video
class-map match-any QoS-Voice-Control
 match access-group name Voice-Control
!
policy-map QOS
 class Voice
  priority percent 25
  set dscp ef
 class QoS-Inter-Video
  bandwidth remaining percent 10
  set dscp af41
 class QoS-Bulk
  bandwidth remaining percent 5
  random-detect dscp-based
  set dscp af11
 class QoS-Management
  bandwidth remaining percent 1
  set dscp cs2
 class QoS-Voice-Control
  priority percent 5
  set dscp ef
 class class-default
  fair-queue
!
!
!
!
!
!
!
!
!
!
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 no ip address
 duplex auto
 speed auto
!
interface GigabitEthernet0/0.1
 description LAN
 encapsulation dot1Q 1 native
 ip address 10.20.75.1 255.255.255.0
 ip access-group Local in
 ip access-group Local out
 ip flow ingress
 ip flow egress
 ip nat inside
 ip virtual-reassembly in
 ip policy route-map LAN
!
interface GigabitEthernet0/0.76
 description SteelNet76
 encapsulation dot1Q 76
 ip address 10.20.76.1 255.255.255.0
 ip access-group Local in
 ip access-group Local out
 ip flow ingress
 ip flow egress
 ip nat inside
 ip virtual-reassembly in
 ip policy route-map WLAN76
!
interface GigabitEthernet0/0.200
 description Voice
 encapsulation dot1Q 200
 ip address 10.20.77.1 255.255.255.0
 ip access-group Local in
 ip access-group Local out
 ip helper-address 10.20.75.11
 ip flow ingress
 ip nat inside
 ip virtual-reassembly in
 ip policy route-map SIP200
!
interface GigabitEthernet0/1
 description WAN
 ip address dhcp
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
 service-policy output QOS
!
ip forward-protocol nd
!
no ip http server
ip http access-class 23
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat inside source static tcp 10.20.75.11 443 interface GigabitEthernet0/1 443
ip nat inside source static tcp 10.20.75.11 987 interface GigabitEthernet0/1 987
ip nat inside source static tcp 10.20.75.11 1723 interface GigabitEthernet0/1 1723
ip nat inside source route-map LAN interface GigabitEthernet0/1 overload
ip nat inside source route-map SIP200 interface GigabitEthernet0/1 overload
ip nat inside source route-map WLAN76 interface GigabitEthernet0/1 overload
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 track 1
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 2
!
ip access-list extended LAN
 permit ip 10.20.75.0 0.0.0.255 any
 deny   ip any any
ip access-list extended SIP200
 permit ip 10.20.77.0 0.0.0.255 any
 deny   ip any any
ip access-list extended WLAN76
 permit ip 10.20.76.0 0.0.0.255 any
 deny   ip any any
!
!
route-map WLAN76 permit 20
 match ip address WLAN76
 set interface GigabitEthernet0/1
 set default interface GigabitEthernet0/1
!
route-map LAN permit 10
 match ip address LAN
 set interface GigabitEthernet0/1
 set default interface GigabitEthernet0/1
!
route-map SIP200 permit 30
 match ip address SIP200
 set interface GigabitEthernet0/1
 set default interface GigabitEthernet0/1
!
!
access-list 23 permit XXX.XXX.XXX.XXX
access-list 23 permit 10.20.75.0 0.0.0.255
access-list 23 permit 10.20.77.0 0.0.0.255
access-list 24 permit 10.20.77.0 0.0.0.255
access-list 120 permit ip 0.0.0.11 255.255.255.0 any
!
control-plane
!
!
!
line con 0
 login local
line aux 0
line 2
 no activation-character
 no exec
 transport preferred none
 transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
 stopbits 1
line vty 0 4
 access-class 23 in
 privilege level 15
 login local
 transport input ssh
line vty 5 15
 access-class 23 in
 privilege level 15
 login local
 transport input telnet ssh
!
scheduler allocate 20000 1000
!
end
  • I have a couple of questions. Why are you using the deny ip any any at the end of the ACLs? ACLs have an inherent deny all at the end. Why are you using route maps for your NAT? That is something you would do for multiple WAN connections. Why do you have a track on the default route? You do not define an object to track. – Ron Maupin Nov 2 '17 at 21:29
  • I would also point out that you do not have any firewall or ACL enabled on the WAN interface, which leaves you vulnerable, especially since you have not disabled the HTTP server (normally disabled as a security risk). – Ron Maupin Nov 2 '17 at 21:31
  • You are also trying to apply an access list Local, which doesn't exist, to some interfaces. You really do not want to apply the same ACL both inbound and outbound on an interface. The general rule is to apply a standard ACL as close to the destination as possible, and an extended ACL as close to the source as possible, but applying non-existent ACLs will cause problems. – Ron Maupin Nov 2 '17 at 21:32
  • This is a ISR that I have inherited and I am trying to clean up in the process of setting up a new network on it. The person who initially configured it knows less about Cisco iOS than I do. bad sign. That is why there are route maps configured for the NAT. I just need to get this sub interface to be able to reach the internet and once that is done I can begin the cleanup process and locking down things. – bakesale Nov 2 '17 at 21:34
  • > You are also trying to apply an access list Local, which doesn't exist, to some interfaces. So I should just be applying the ACL 24 that I created just for that network? – bakesale Nov 2 '17 at 21:35
0

If I wanted to do this, it would look something like this:

service password-encryption
!
no lldp run
!
interface GigabitEthernet0/0.1
 no ip access-group Local in
 no ip access-group Local out
 no ip flow ingress
 no ip flow egress
 no ip policy route-map LAN
!
interface GigabitEthernet0/0.76
 no ip access-group Local in
 no ip access-group Local out
 no ip flow ingress
 no ip flow egress
 no ip policy route-map WLAN76
!
interface GigabitEthernet0/0.200
 no ip access-group Local in
 no ip access-group Local out
 no ip flow ingress
 no ip policy route-map SIP200
!
no ip nat inside source route-map LAN interface GigabitEthernet0/1 overload
no ip nat inside source route-map SIP200 interface GigabitEthernet0/1 overload
no ip nat inside source route-map WLAN76 interface GigabitEthernet0/1 overload
ip nat inside source list 10 interface GigabitEthernet0/1 overload
no ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 track 1
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1
!
ip access-list 10 permit 10.20.75.0 0.0.0.255
ip access-list 10 permit 10.20.76.0 0.0.0.255
ip access-list 10 permit 10.20.77.0 0.0.0.255
!
  • NEVER route to an (ethernet) interface. That is not doing what you think it is. Luckily, DHCP is replacing it as soon as IP usable on the interface. – Ricky Beam Nov 3 '17 at 1:06
1

This router is not your DHCP server. If things in VLAN 200 are getting an address at all, the router has done it's job. You need to go to your DHCP server to fix the scope for VLAN 200. (i.e. define a default route)

Everything about this configuration -- which you've post more than once now -- is a complete nightmare. "ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1" is enough to trigger an "erase nvram" and start over -- and fire whatever nut created this mess.

  • he is no longer with the company, nor did he know cisco. This is an Aruba and Fortinet shop. This customer is switching their ISP soon and I will reconfigure the default route once they do. GI0/1 is changing to a static IP assignment. Thanks for the feedback. – bakesale Nov 3 '17 at 16:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.