3

Working on an issue with a 1800 series Cisco Router. Router get's Internet just fine, can ping Google, Microsoft, etc.. Router is connected to a switch, switch connects 2 workstations running Windows 10. Router hands out DHCP just fine, but doesn't route Internet. I can ping the router from the workstations. Attached is my running config.

    Router#show run
    Building configuration...

    Current configuration : 1848 bytes
    !
    ! Last configuration change at 00:45:46 UTC Thu Aug 9 2018
    version 15.1
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    !
    hostname Router
    !
    boot-start-marker
    boot-end-marker
    !
    !
    enable secret 5 hash.
    enable password password
    !
    no aaa new-model
    !
    dot11 syslog
    ip source-route
    no ip routing
    !
    !
    ip dhcp excluded-address 192.168.1.0 192.168.1.99
    !
    ip dhcp pool MY_LAN
     network 192.168.1.0 255.255.255.0
     default-router 192.168.1.1
     dns-server 8.8.4.4 8.8.8.8
    !
    !
    !
    no ip cef
    no ipv6 cef
    !
    multilink bundle-name authenticated
    !
    crypto pki token default removal timeout 0
    !
    !
    !
    !
    license udi pid CISCO1841 sn FHK12182B87
    !
    redundancy
    !
    !
    !
    !
    !
    !
    !
    !
    !
    interface FastEthernet0/0
     description ## INTERNET ##
     ip address dhcp
     ip access-group MY_WAN in
     ip nat outside
     ip virtual-reassembly in
     no ip route-cache
     speed auto
     half-duplex
     no mop enabled
    !
    interface FastEthernet0/1
     description ## MY LAN ##
     ip address 192.168.1.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
     no ip route-cache
     duplex auto
     speed auto
    !
    interface Serial0/0/0
     no ip address
     no ip route-cache
     shutdown
    !
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    !
    !
    ip nat inside source list 1 pool MY_LAN overload
    ip nat inside source list MY_LAN interface FastEthernet0/0 overload
    ip route 0.0.0.0 0.0.0.0 192.168.1.101
    ip route 0.0.0.0 0.0.0.0 192.168.1.102
    ip route 0.0.0.0 0.0.0.0 FastEthernet0/0 dhcp
    !
    ip access-list standard MY_LAN
     permit 192.168.1.0 0.0.0.255
    !
    ip access-list extended MY_WAN
     permit tcp any any established
     permit ip any any
    !
    access-list 1 permit 192.168.1.0 0.0.0.255
    !
    !
    !
    !
    !
    !
    control-plane
    !
    !
    !
    line con 0
    line aux 0
    line vty 0 4
     password ********
     login
     transport input all
    !
    scheduler allocate 20000 1000
    end

    Router#ping google.com
    Translating "google.com"...domain server (74.40.74.40) [OK]

    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 172.217.0.14, timeout is 2 seconds:
    !!!!!
    Success rate is 100 percent (5/5), round-trip min/avg/max = 8/11/12 ms
    Router#

Please let me know if I can clarify anything.

4

no ip routing

You explicitly TURNED OFF ROUTING. I see this so many times, it's the first thing I look for any config.

You should turn off source-route, but not routing.

Also, you've turned off cef, which forces the system to process switch every packet. You'll be lucky to hit double digit speeds like that.

0

You have your routing messed up. You do not need or want default routes pointing to your LAN. You are trying too hard on the routing and NAT:

no ip nat inside source list 1 pool MY_LAN overload
no ip nat inside source list MY_LAN interface FastEthernet0/0 overload
no ip route 0.0.0.0 0.0.0.0 192.168.1.101
no ip route 0.0.0.0 0.0.0.0 192.168.1.102
ip nat inside source list 1 interface FastEthernet0/0 overload
!

Also, your WAN ACL really isn't doing anything because it allows anything in based on the second line:

ip access-list extended MY_WAN
 permit tcp any any established
 permit ip any any !!! This line allows everything and it is before the implicit deny at the end !!!
!

You should remove the ACL from the WAN interface, get the NAT and routing working, then try to set up an ACL.

  • Sorry for my ignorance. Basically take out the 2 ip route lines. Remove the ACL from the WAN. This would be a good start, correct? – Evan Tempel Aug 9 '18 at 18:27
  • Put in the commands that I have for you in the first configuration block of my answer. Also, as @RickyBeam points out, you have explicitly disabled routing. – Ron Maupin Aug 9 '18 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.