2

In my company network i am installing new cisco2811 router but i have problem, my LAN network can not ping and access network. i get point to point internet from ISP.

PTP IP is 192.186.86.200/24 and its switch port is 15 shown in picture.

LAN network IP 172.16.16.200/24 DHCP.

I have configured virtual interfaces in router.

Also implemented NAT rule but i don't now how to access internet.

My internet IP is 192.186.86.200/24.

I think I need to configure a NAT rule but don't know which type.

This is the router config:

Router#show running-config
Building configuration...


Current configuration : 3700 bytes
!
! Last configuration change at 18:10:56 UTC Thu Sep 20 2018
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
enable password Ylinx
!
no aaa new-model
!
!
dot11 syslog
ip source-route
!
!
ip cef
!
ip dhcp excluded-address 172.16.16.200
ip dhcp excluded-address 10.2.60.55
!
ip dhcp pool YLINX_LAN
 network 172.16.16.0 255.255.255.0
 dns-server 8.8.8.8
 default-router 172.16.16.200
 lease 10
 update arp
!
ip dhcp pool YLINX_SERVERS
 network 10.2.60.0 255.255.255.0
 dns-server 8.8.8.8
 default-router 10.2.60.200
 lease 10
 update arp
!
!
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
voice-card 0
!
crypto pki token default removal timeout 0
!
crypto pki trustpoint TP-self-signed-2879905090
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-2879905090
 revocation-check none
 rsakeypair TP-self-signed-2879905090
!
!

    quit
!
!
license udi pid CISCO2811 sn FHK0902F4V6
username naseer secret 5 $1$w6HC$W9eoccnVIhNDKbMr91f2e0
!
redundancy
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet0/0.400
 encapsulation dot1Q 400
 ip address 192.168.86.200 255.255.255.0
 ip nat outside
 ip virtual-reassembly in
!
interface FastEthernet0/0.401
 encapsulation dot1Q 401
 ip address 192.168.1.200 255.255.255.0
!
interface FastEthernet0/0.402
 encapsulation dot1Q 402
 ip address 172.16.16.200 255.255.255.0
!
interface FastEthernet0/0.403
 encapsulation dot1Q 403
 ip address 10.2.60.200 255.255.255.0
!
interface FastEthernet0/1
 ip address 1.1.1.1 255.255.255.0
 duplex auto
 speed auto
!
interface BRI0/1/0
 no ip address
 encapsulation hdlc
 shutdown
!
ip forward-protocol nd
ip http server
no ip http secure-server
!
!
ip nat outside source static 192.168.86.200 172.16.16.200
ip route 0.0.0.0 0.0.0.0 192.168.86.1 10
ip route 0.0.0.0 0.0.0.0 192.168.1.1 50
!
!
!
!
!
!
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
!
!
line con 0
 password Ylinx
 login
line aux 0
line vty 0 4
 password Ylinx
 login
 transport input all
line vty 5 15
 password Ylinx
 login
 transport input all
!
scheduler allocate 20000 1000
end

Switch interfaces config:

interface GigabitEthernet1/0/15 
 description YLINX_PTP
 switchport access vlan 400
 switchport trunk encapsulation dot1q
 switchport mode access

interface GigabitEthernet1/0/16
 description YLINX_161_DIRECT
 switchport access vlan 402
 switchport trunk encapsulation dot1q
 switchport mode access

interface GigabitEthernet1/0/18
 description YLINX_CISCO_ROUTER
 switchport trunk encapsulation dot1q 
 switchport mode trunk

interface GigabitEthernet1/0/21 
 description YLINX_SERVERS
 switchport access vlan 403
 switchport trunk encapsulation dot1q
 switchport mode access
12
  • ths is point to point(ISP) link IP Sep 21, 2018 at 12:46
  • gist.github.com/nbhatti/… Sep 21, 2018 at 12:47
  • my internet poiny to point IP Sep 21, 2018 at 12:48
  • Can you include a simple diagram? It's hard to see how devices are connected just from the router config. Does your ISP and internal LAN connect via a single trunk?
    – Ron Trunk
    Sep 21, 2018 at 12:58
  • 2
    On your switch configuration, the port is set to access. You need to set it to trunk mode.
    – Ron Trunk
    Sep 21, 2018 at 13:21

2 Answers 2

2

Welcome to Network Engineering! There are a few things wrong here:

  1. There is no inside nat statement. You have the outside NAT statement on fa 0/0.401. On your internal LAN interface (whichever that is), you need

    ip nat inside

  2. If you simply want internal hosts to reach the internet, change your NAT statement to:

    ip nat inside source list 1 interface FastEthernet0/0.401 overload

    access-list 1 0.0.0.0 255.255.255.255

If you want external hosts to make connections to internal hosts (like a web server), you need a different NAT statement, but you need to provide more information before we can recommend a configuration.

8
  • configure terminal ip nat inside source static 172.16.16.200 192.168.86.200 interface FastEthernet0/0.402 encapsulation dot1Q 402 ip address 172.16.16.200 255.255.255.0 ip nat inside interface FastEthernet0/0.400 encapsulation dot1Q 400 ip address 192.168.86.200 255.255.255.0 ip nat outside Sep 21, 2018 at 13:51
  • i have implement many NAT rule but not access internet Sep 21, 2018 at 13:52
  • ip nat inside source list 1 interface FastEthernet0/0.401 overload access-list 1 permit 0.0.0.0 255.255.255.255 Sep 21, 2018 at 13:55
  • ip nat inside source list 1 interface FastEthernet0/0.401 overload access-list 1 permit 0.0.0.0 255.255.255.255 Sep 21, 2018 at 14:04
  • sir where i will implement this NAT rule i have not FastEthernet0/0.401 interface Sep 21, 2018 at 14:05
0

Configure ISP allocated public ip address to router egress interfàce . And further configured Port address translation (PAT) for internet access (outbound traffic)

Static NAT one to one for inbound traffic

For PAT configuration

Router(config) # access-list 10 permit 172.16.16.0 0.0.0.0.255 any

Router(config) # ip nat inside source list 1 interfàce F0/1 overload

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.