8

We have been struggling with this for a few weeks now. CISCO 3825 (15.1 IOS) with properly established PPPoE (ie can ping the net from inside the cli).

The problem we are having is that the client's cannot ping the outside world. I have the client connected directly to the router, and am having no luck getting to the net. The config:

Updated Config

interface GigabitEthernet0/0
 no ip address
 duplex auto
 speed auto
 media-type rj45
 pppoe enable group global
 pppoe-client dial-pool-number 1
 no cdp enable
!
interface GigabitEthernet0/1
 ip address 192.168.2.1 255.255.255.0
 ip broadcast-address 192.168.2.255
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto
 media-type rj45
 no cdp enable
!
interface Dialer0
 ip address negotiated
 ip mtu 1492
 ip flow ingress
 ip nat outside
 ip virtual-reassembly in
 encapsulation ppp
 ip route-cache policy
 dialer pool 1
 ppp authentication pap callin
 ppp pap sent-username [email protected] password 0 foobarme
 ppp ipcp dns request accept
 ppp ipcp route default
 ppp ipcp address accept
 no cdp enable
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!         
ip nat inside source list 1 interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 Dialer0
!
no cdp run

The ppoe establishes perfectly. Both interfaces are up/up however, just can't ping the internet using a directly connected client. No dhcp, the clients have static ip addresses

I am sure this question has been answered, but nothing I have read has been able to get me up.

One thing to note is that f0/1 has a bcast of 255.255.255.255. The client interface is set to 192.168.2.255. Could this be the problem? I need to minimize downtime as much as possible, and really appreciate your help.

Brief

Interface                  IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0         unassigned      YES NVRAM  up                    up      
GigabitEthernet0/1         192.168.2.1     YES NVRAM  up                    up      
Dialer0                    <public ip>     YES IPCP   up                    up      
NVI0                       unassigned      YES unset  administratively down down    
Virtual-Access1            unassigned      YES unset  up                    up      
Virtual-Access2            unassigned      YES unset  up                    up

Full

do show ip interface      
GigabitEthernet0/0 is up, line protocol is up
  Internet protocol processing disabled
GigabitEthernet0/1 is up, line protocol is up
  Internet address is 192.168.2.1/24
  Broadcast address is 192.168.2.255
  Address determined by non-volatile memory
  MTU is 1500 bytes
  Helper address is not set
  Directed broadcast forwarding is disabled
  Outgoing access list is not set
  Inbound  access list is not set
  Proxy ARP is enabled
  Local Proxy ARP is disabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is enabled
  IP fast switching on the same interface is disabled
  IP Flow switching is disabled
  IP CEF switching is enabled
  IP CEF switching turbo vector
  IP multicast fast switching is enabled
  IP multicast distributed fast switching is disabled
  IP route-cache flags are Fast, CEF
  Router Discovery is disabled
  IP output packet accounting is disabled
  IP access violation accounting is disabled
  TCP/IP header compression is disabled
  RTP/IP header compression is disabled
  Policy routing is disabled
  Network address translation is enabled, interface in domain inside
  BGP Policy Mapping is disabled
  Input features: Stateful Inspection, Virtual Fragment Reassembly, Virtual Fragment Reassembly After IPSec Decryption, MCIk
  Output features: NAT Inside, Stateful Inspection, NAT ALG proxy, Post-Ingress-NetFlow
  WCCP Redirect outbound is disabled
  WCCP Redirect inbound is disabled
  WCCP Redirect exclude is disabled
Dialer0 is up, line protocol is up
  Internet address is <public ip>/32
  Broadcast address is 255.255.255.255
  Address determined by IPCP
  MTU is 1492 bytes
  Helper address is not set
  Directed broadcast forwarding is disabled
  Outgoing access list is not set
  Inbound  access list is not set
  Proxy ARP is enabled
  Local Proxy ARP is disabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is enabled
  IP fast switching on the same interface is enabled
  IP Flow switching is disabled
  IP CEF switching is enabled
  IP CEF switching turbo vector
  IP Null turbo vector
  IP multicast fast switching is enabled
  IP multicast distributed fast switching is disabled
  IP route-cache flags are Fast, Policy, CEF
  Router Discovery is disabled
  IP output packet accounting is disabled
  IP access violation accounting is disabled
  TCP/IP header compression is disabled
  RTP/IP header compression is disabled
  Policy routing is disabled
  Network address translation is enabled, interface in domain outside
  BGP Policy Mapping is disabled
  Input features: Stateful Inspection, Dialer i/f override, Ingress-NetFlow, Virtual Fragment Reassembly, Virtual Fragment k
  Output features: Post-routing NAT Outside, Stateful Inspection, NAT ALG proxy, Post-Ingress-NetFlow, Dialer idle reset, Dt
  WCCP Redirect outbound is disabled
  WCCP Redirect inbound is disabled
  WCCP Redirect exclude is disabled
NVI0 is administratively down, line protocol is down
  Internet protocol processing disabled
Virtual-Access1 is up, line protocol is up
  Internet protocol processing disabled
Virtual-Access2 is up, line protocol is up
  Peer address is 64.230.11.5
  Dialer interface is Dialer0

As always, can ping within cli but not from directly connected client. DNS on client set to 8.8.8.8, can ping the router etc.. It looks like a gateway route issue for dia0?

Update - Working mtu mss for Cisco Bell Canada ip mtu 1492 ip tcp adjust-mss 1452

Everything is perfect now!

Thanks in Advance,

Nick.

Improve this question
10
  • 1
    Ricky's answer on your other question about this, which you accepted, addresses the presumed cause of this problem.
    – Brett Lykins
    Commented Jan 6, 2014 at 3:11
  • I will keep this thread alive and add that back into the config and see if that is the reason. I think I removed ip nat outside and moved it to Gig0/0 however, forgot to put it back...
    – Nick Cameo
    Commented Jan 6, 2014 at 3:30
  • There are 1700 users online right now. Can't bring the network down.... :(
    – Nick Cameo
    Commented Jan 6, 2014 at 3:31
  • nat doesn't require an outage to configure, assuming that it's done correctly. Think of it like this, 1700 users have degraded service right now
    – Mike Pennington
    Commented Jan 6, 2014 at 4:15
  • Mike I really appreciate your time. I need to physically switch over to the cisco from our dlink. Last time I did that, we had not net. I need to wait till 4am to do that :(
    – Nick Cameo
    Commented Jan 6, 2014 at 4:54

3 Answers 3

Reset to default
5

Adding to the other answers... the thing you lack now is an access-list to limit NAT to your inside addresses... if you apply this configuration, I think this should get you going as long as there aren't other subnets routed by this router.

!
interface GigabitEthernet0/1
 ip address 192.168.2.1 255.255.255.0
 ip nat inside

interface Dialer0
 ip nat outside
!
!! You might not need to do this, but just in case...
do clear ip nat trans *
no ip nat inside source list 1 interface Dialer0 overload
!
access-list 1 permit 192.168.2.0 0.0.0.255
!
ip nat inside source list 1 interface Dialer0 overload

I included pieces from Ricky and Brett's answers, which of course are also required.

Improve this answer
3
  • 1
    Got outside world access through the cisco! Thank you so much. The only thing is, I can access google search, however can't get past it when clicking on a link. Tried firefox, chrome, and lynx. Outgoing email works fine.
    – Nick Cameo
    Commented Jan 6, 2014 at 6:34
  • 2
    you may need mss adjust on the Lan intf or a lower mtu on the dialer... check this cisco link
    – Mike Pennington
    Commented Jan 6, 2014 at 6:57
  • Mike!!! Thank you!!!!! I love this place! We are up/up :). The mtu and mss that worked for us is as follows: ip mtu 1492 ip tcp adjust-mss 1452
    – Nick Cameo
    Commented Jan 6, 2014 at 14:55
7

*cough*

interface Dialer0
  ip nat outside
Improve this answer
6
  • Also check for 'ip nat inside source xxx' config, which it seems is also missing.
    – Łukasz Bromirski
    Commented Jan 6, 2014 at 3:04
  • @ŁukaszBromirski, it's there, you just have to scroll his code block a bit.
    – Brett Lykins
    Commented Jan 6, 2014 at 3:05
  • scroll down, it's there. (assuming list 1 is correct)
    – Ricky
    Commented Jan 6, 2014 at 3:05
  • Also @RickyBeam, I was just a minute too slow! Thats what I get for taking time to edit my typos ;)
    – Brett Lykins
    Commented Jan 6, 2014 at 3:06
  • Ah, you have to scroll the printout :P You're right Ricky, it is there. Let's hope ACL 1 is correct and 'ip nat outside' will do the trick.
    – Łukasz Bromirski
    Commented Jan 6, 2014 at 3:07
6

You are missing a critical NAT command.

Try adding ip nat outside under the outbound dialer interface interface Dialer 0.

With your current configuration you've identified the interface Gig 0/1 as the "Inside" interface, so the router knows when to apply NAT rules to the incoming traffic on that interface.

However, since the Dialer 0 interface does not have a NAT statement, the router doesn't know that it needs to translate the addressing and THEN try to route it.

Right now, your return traffic from the internet to a NATed host is presumably getting to your router and dying there.

I highly recommend checking out this article over at INE that goes over the details of "Inside" vs "Outside" interfaces in Cisco NATing.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.