Cisco 887 and TC 500GB dns issues
Hi,
I have a strange problem here so hopefully someone can help.
I recently replaced a Netgear adsl modem with a new Cisco 887 ADSL2 modem router. Now the Cisco does the PPPoE and the TC is in bridge mode. TC does the DHCP and clients connect to it via wireless. The Cisco takes care of all rounting and internet traffic.
My problem is that when I connect to the TC via the wireless with a PowerBook 17", IMac 21", IPhone 4, Ipad 1 and 2, web browsing times out on most sites.
But if I connect a Win XP, Win 7 or Blackberry to the TC wireless, no problem at all. All sites are quick and resolve instantly.
I checked all settings of all devices that the TC hands out and they are all the same. Same gateway, same DNS servers, same subnets and so on.
Even If I bypass the TC and connect via ethernet to the Cisco, the PowerBook and the IMac have the same issues. I connect Win XP and Win 7 to the Cisco and no problems.
Is there something I'm missing in the Cisco config that affects all Mac devices? I've had the Cisco checked by a CCIE and he sees no issues.
Is there a problem on the Macs connecting to the Cisco?
Any help would be greatly appreciated.
Regards,
AP
It is interesting as I just hit the problem last night for a simple setup.. not cisco. But standard ISP and wireless adsl modem router. It has worked fine up to last week according to my friend. She went to use it one day and no go.. but the router is getting IP address and gateway. From the PC it can open the router gui no problem. But no way will it pass packets.. it can ping the ISP gateway and sometimes the dns servers but is not consistent.
I used another modem and the issue was exactly the same. I tried wireless instead of ethernet.. no change. So now we are down to PC or ISP.. !!
ISP says everything good on their end.. although I take that with so much salt.. it needs preserving. They say that until you can prove the issue is them.
Anyway I had to get it going so bridged the modem and used pppoe client on the computer.. away everything goes. It is still having issues with ping to some sites.. so I still think this might be ISP. It can also be MTU but I tried lowering that in the router and got nowhere. She is finishing an MBA.. so I promised to reformat the computer after the end of term, and I can have another go.
Everything is supposed to work except when it doesn't. Good to teach humility every now and then. Just wish it didn't need to be so hard.
Similar Messages
-
Hello there
I recently bought a cisco 887w and i'm having problem with wireless. The question is: is there any way to disable the very VERY annoying wlan-ap0 interface to boot from the main cisco IOS? Couln't find anything related with this over the internet :( I do really want to use dot11radio 0 from main router interface just like on my old cisco 877. Any help?Nicolas thank you for your answer,
Yes, i did notice that c887w has a real ap inside. That's not too much flexible for me for the main reason that this is not intergrated like c877w as i thought. This has many disadvantages for me like i have to keep 2 different configurations, i have to login by typing service-module wlan-ap0 blah blah blah, two different managment IPs and so on. Dissapointed... but i'll get used to it : ) Fortunately they didn't do the same thing on fastethernet interface module..LOL! Hopefully on next IOS releases they do include an option to use dot11radio from main cisco IOS.
I'll have my time with this now.. I'll keep searching the cisco.com for a suitable config for me. If you have any tip for wireless bridging with the main BVIs on the router interface i'd apprieciate that : )
And for last something off topic... i noticed (not sure) that weighted early random detection (WRED.. QoS) is not supported. Is that true?
TX!!! -
E2100L Cisco Connect and Network Magic compatibility issues with Mac OS X 10.7 Lion
When you will release the latest version for Wireless router Linksys E2100L?, because I bought a MAC with Lion and I can´t use my Router.
Regards,
DanielOlder versions of Cisco Connect for Mac computers have compatibility issues with the latest release of Mac OS X (10.7 “Lion”). Only Cisco Connect versions 1.4.11222 and newer are compatible with the Lion operating system.
Here is the link to ensure that Cisco Connect can be installed on your Mac: http://www6.nohold.net/Cisco2/ukp.aspx?vw=1&docid=a4e763be954243cfa0ab960c0fac7105_KB_23xxx_EN_v1.xm...
There is no such information about the release of Cisco Connect for E2100L for the Mac OS X (10.7 “Lion”) compatibility, so you need to wait for further release of the firmrware for E2100L. -
Cisco switches and virtual ip address(load balancing address) on xenapp portals
Hi I am quite new in configuring cisco switches and stumble across an issue after installing xenapp7.6 with load balanced portal to the ddc`s
It seems i only can ping or get access to portal if using real ip address behind cisco switch from other subnets in my network.
I can ping ddc01 and ddc02 and connect to the portal with http without problem. However when i triy to access the load balancing address of the ddc`s
it wont answer to ping or http
In same subnett it is no problem connecting to the load balancing address of the ddc`s, but in loactions on other subnets i only can access real server ip
eks
dd01 192.168.1.4 ok ping and access behind cisco switch from subnets
ddc02 192.168.1.5 ok to ping access behind cisco switch from subnets
load balancing for both ddc 192.168.1.6 not able to get answer og access from subnets, only in same subnett
Is there any way to configure switch to access the load balancing address of the ddc`s ?
Regards
Pål Arne RøbergWrong forum. This forum is dedicated to feedback related to CSC framework itself. You should not wish for response here.
Moved by moderator, no longer apply. -
Cisco Valet and Apple TV2 problem.
I just installed a new Cisco Valet router, and though my lap and desktops work fine, I'm unable to get past the "setting time and date" notification when trying to wirelessly connect my Appletv. I tried rebooting the module, but even after waiting considerable time, I simply end up with the screensaver. Any suggestions would be appreciated from this new member
BobWhat is the answer to that problem? I have a cisco router and have the same issue. Thanks
-
Routing issue between Cisco Nexus and Cisco 4510 R+E Chassis
We have configured Cisco Nexus 7K9 as core and Cisco 4510 R+E as access switches for Server connectivity.
We are experiencing problem in terms of ARP learning and Ping issues between Cisco Nexus and end hosts.Hi,
So you have N7k acting as L3 with servers connected to 4510?.
Do you see the MAC associated with failing ARP in 4510?. Is it happening with all or few servers?. Just to verify if it is connectivity issue between N7k and 4510, you can configure an SVI on 4510 and assign address from same raneg (server/core range) and perform a ping.
This will help narrow down if issue is between server to 4510 or 4510 to N7k.
Thanks,
Nagendra -
[SOLVED] Greetings... and DNS issues... (why is it so slow?)
Hey everybody!
My name is Stephen. I'm new to Arch (hence I'm posting in the newb forum). A bit of background: I'm a CS major in the good 'ole US of A. I used Debian/Ubuntu for 2 years before now. I actually installed Arch just yesterday, so today is my second day of usage. Why do I want to switch from Ubuntu? Several reasons, but they can all be summed up thusly: I want to tinker with and understand how my machine works. I don't want to interface with a blackbox that just "works." Arch seems to be geared towards what I want.
And I've been learning alot, haha. Which I why I am now here to ask for help.
I originally installed Arch at school. Everything was great. Then I took my laptop home and I found out something was wrong. Pacman took an extra 5-15 secs before each download started, but once the download started, I got normal speeds. I observed a similar behavior in my web browsers I tried (Firefox/Surf). No matter what I do, this behavior persists. I suspect this is a DNS issue, and thus I have tried the follow methods of correction so far.
1) Reinstalling to a default configuration.
2) Disabling IPV6.
3) Screwing around with etc/hosts, etc/resolv.conf, and etc/dhcpcd.conf (though I probably did something wrong. Also, I'm not sure how to force Arch to accept my changes after modifying these files.)
I also read somewhere that using HTTP mirrors works better for pacman, but I already was using an HTTP mirror anyway, so I knew that couldn't be the problem.
I have not tried DNS caching yet. However, given that every other machine in the house runs fine, I suspect it is my configuration that is wrong. Does anybody know how I can pinpoint this as DNS for sure? And if so, how I can fix it? Thanks for all your time/help!
Here are some config files/snippets of interest. Most of this should be straight from a basic Arch install.
etc/resolv.conf
# Generated by dhcpcd from eth0
# /etc/resolv.conf.head can replace this line
domain domain.actdsltmp
nameserver 192.168.0.1
nameserver 216.165.129.157
# /etc/resolv.conf.tail can replace this line
Note that 192.168.0.1 is the address of my router on my LAN. I believe the second address is a DNS provided by my ISP.
etc/hosts
#<ip-address> <hostname.domain.org> <hostname>
127.0.0.1 localhost.localdomain localhost moebius
::1 localhost.localdomain localhost
etc/rc.conf snippet
HOSTNAME="moebius"
eth0="dhcp"
INTERFACES=(eth0)
# Routes to start at boot-up (in this order)
# Declare each route then list in ROUTES
# - prefix an entry in ROUTES with a ! to disable it
gateway="default gw 192.168.0.1"
ROUTES=(!gateway)
Last edited by sskeirik (2011-03-14 23:21:19)Output of 'dig google.com a'
; <<>> DiG 9.7.3 <<>> google.com a
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52741
;; flags: qr rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available
;; QUESTION SECTION:
;google.com. IN A
;; ANSWER SECTION:
google.com. 10000 IN A 74.125.65.104
;; Query time: 17 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Mon Mar 14 14:09:45 2011
;; MSG SIZE rcvd: 44
Output of 'dig @8.8.8.8 google.com a'
; <<>> DiG 9.7.3 <<>> @8.8.8.8 google.com a
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43373
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;google.com. IN A
;; ANSWER SECTION:
google.com. 229 IN A 74.125.45.105
google.com. 229 IN A 74.125.45.99
google.com. 229 IN A 74.125.45.103
google.com. 229 IN A 74.125.45.147
google.com. 229 IN A 74.125.45.106
google.com. 229 IN A 74.125.45.104
;; Query time: 74 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Mar 14 14:10:37 2011
;; MSG SIZE rcvd: 124 -
Strange issue - unable to establish PPP with Cisco 887 VAG router on one particular ADSL line
I have a strange problem that I’m struggling to get to the bottom of with my ISP and wondered if anyone could help.
We have a site with an older Cisco 877 ADSL router which was working happily until a few weeks ago when the connection dropped suddenly (out-of-hours at 2am if that’s of any significance – made me think most likely something carrier/ISP related?) When connectivity was lost, the router could sync with the BT exchange (we are in the UK) but could not establish PPP.
We logged fault with our ISP – after some to’ing and fro’ing, they passed it onto BT and their engineers visited site, they fixed “a line fault” (we don’t get much detail on what was actually fixed) but we still could not establish connectivity – same thing, solid CD light but no PPP.
So, we replaced the router with another 877 – same again, solid CD but no PPP. We replaced all the cables and microfilter etc but no difference.
We tried a different Cisco router (a newer Cisco 887VAG) which, as I understand, uses a different modem chipset but no matter – PPP could still not be established. We tested this router on another ADSL line with the same ISP and it worked without issue, using the same ADSL account details, it was able to establish connectivity. So we figured this must still be a BT/ISP issue.
Since then we’ve had BT out again twice but they say there is no fault. The ISP say there is no issue with them. But we still cannot establish ADSL connectivity on this line, despite having tried 3 different ADSL routers and despite the fact the routers work with the same account details on another ADSL line.
The 887VAG router we have currently connected has 3G backup so that is keeping us going in the meantime and also means I can login to the router remotely to check on the ADSL status.
But I’m struggling to pinpoint where the problem may lie. Strangely, if I turn on PPP negotiation and authentication debug then I’m not actually seeing any output from it at all?
Yet, the ATM interface is up and shows packets being sent and received:
ATM0 is up, line protocol is up
Hardware is MPC ATMSAR, address is bc16.6596.9b00 (bia bc16.6596.9b00)
MTU 1600 bytes, sub MTU 1600, BW 704 Kbit/sec, DLY 520 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ATM, loopback not set
Keepalive not supported
Encapsulation(s): AAL5
4 maximum active VCs, 1024 VCs per VP, 1 current VCCs
VC Auto Creation Disabled.
VC idle disconnect time: 300 seconds
Last input 00:00:28, output 00:00:07, output hang never
Last clearing of "show interface" counters 6d23h
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: Per VC Queueing
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
23886 packets input, 1676964 bytes, 0 no buffer
Received 0 broadcasts (0 IP multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
56469 packets output, 4418592 bytes, 0 underruns
0 output errors, 0 collisions, 6 interface resets
0 unknown protocol drops
0 output buffer failures, 0 output buffers swapped out
Does anyone have any ideas on where the problem may be and what more I can do to troubleshoot and provide the relevant evidence to our ISP (assuming it is an ISP/BT issue though the fact the same router works ok with the exact same details etc would seem to indicate it must be their issue!)Hi Jody,
thanks for the suggestions. Here's what I see from the ppp debugs (but I'm not sure how to interpret?)
Jan 6 14:50:22.838: pppoe_send_padi:
contiguous pak, size 74
00 01 09 00 AA AA 03 00 80 C2 00 07 00 00 FF FF
FF FF FF FF BC 16 65 96 9B 00 88 63 11 09 00 00
00 10 01 01 00 00 01 03 00 08 0C 00 00 01 00 00
04 A3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 ...
Jan 6 14:50:22.878: PPPoE 0: I PADO R:0030.8810.000b L:bc16.6596.9b00 0/38 ATM0.1
contiguous pak, size 71
BC 16 65 96 9B 00 00 30 88 10 00 0B 88 63 11 07
00 00 00 33 01 03 00 08 0C 00 00 01 00 00 04 A3
01 02 00 1F 62 72 61 73 2D 72 65 64 37 2E 6C 73
2D 62 61 73 2D 42 32 32 36 45 34 37 30 39 45 30
31 34 5A 01 01 00 00
Jan 6 14:50:24.885: OUT PADR from PPPoE Session
contiguous pak, size 85
00 01 09 00 AA AA 03 00 80 C2 00 07 00 00 00 30
88 10 00 0B BC 16 65 96 9B 00 88 63 11 19 00 00
00 33 01 03 00 08 0C 00 00 01 00 00 04 A3 01 02
00 1F 62 72 61 73 2D 72 65 64 37 2E 6C 73 2D 62
61 73 2D 42 32 32 36 45 ...
Jan 6 14:50:35.125: OUT PADR from PPPoE Session
contiguous pak, size 85
00 01 09 00 AA AA 03 00 80 C2 00 07 00 00 00 30
88 10 00 0B BC 16 65 96 9B 00 88 63 11 19 00 00
00 33 01 03 00 08 0C 00 00 01 00 00 04 A3 01 02
00 1F 62 72 61 73 2D 72 65 64 37 2E 6C 73 2D 62
61 73 2D 42 32 32 36 45 ...
Jan 6 14:50:45.364: OUT PADR from PPPoE Session
contiguous pak, size 85
00 01 09 00 AA AA 03 00 80 C2 00 07 00 00 00 30
88 10 00 0B BC 16 65 96 9B 00 88 63 11 19 00 00
00 33 01 03 00 08 0C 00 00 01 00 00 04 A3 01 02
00 1F 62 72 61 73 2D 72 65 64 37 2E 6C 73 2D 62
61 73 2D 42 32 32 36 45 ...
Jan 6 14:50:55.603: OUT PADR from PPPoE Session
contiguous pak, size 85
00 01 09 00 AA AA 03 00 80 C2 00 07 00 00 00 30
88 10 00 0B BC 16 65 96 9B 00 88 63 11 19 00 00
00 33 01 03 00 08 0C 00 00 01 00 00 04 A3 01 02
00 1F 62 72 61 73 2D 72 65 64 37 2E 6C 73 2D 62
61 73 2D 42 32 32 36 45 ...
Jan 6 14:51:05.843: OUT PADR from PPPoE Session
contiguous pak, size 85
00 01 09 00 AA AA 03 00 80 C2 00 07 00 00 00 30
88 10 00 0B BC 16 65 96 9B 00 88 63 11 19 00 00
00 33 01 03 00 08 0C 00 00 01 00 00 04 A3 01 02
00 1F 62 72 61 73 2D 72 65 64 37 2E 6C 73 2D 62
61 73 2D 42 32 32 36 45 ...
Jan 6 14:51:16.114: OUT PADR from PPPoE Session
contiguous pak, size 85
00 01 09 00 AA AA 03 00 80 C2 00 07 00 00 00 30
88 10 00 0B BC 16 65 96 9B 00 88 63 11 19 00 00
00 33 01 03 00 08 0C 00 00 01 00 00 04 A3 01 02
00 1F 62 72 61 73 2D 72 65 64 37 2E 6C 73 2D 62
61 73 2D 42 32 32 36 45 ...
Jan 6 14:51:26.353: [0]PPPoE 0: O PADT R:0000.0000.0000 L:0000.0000.0000 0/38 ATM0.1
contiguous pak, size 74
00 01 09 00 AA AA 03 00 80 C2 00 07 00 00 00 00
00 00 00 00 00 00 00 00 00 00 88 63 11 A7 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 ...
Jan 6 14:51:46.576: pppoe_send_padi:
contiguous pak, size 74
00 01 09 00 AA AA 03 00 80 C2 00 07 00 00 FF FF
FF FF FF FF BC 16 65 96 9B 00 88 63 11 09 00 00
00 10 01 01 00 00 01 03 00 08 0C 00 00 01 00 00
04 A3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 ...
Jan 6 14:51:46.608: PPPoE 0: I PADO R:0030.8810.000b L:bc16.6596.9b00 0/38 ATM0.1
contiguous pak, size 71
BC 16 65 96 9B 00 00 30 88 10 00 0B 88 63 11 07
00 00 00 33 01 03 00 08 0C 00 00 01 00 00 04 A3
01 02 00 1F 62 72 61 73 2D 72 65 64 37 2E 6C 73
2D 62 61 73 2D 42 32 32 36 45 34 37 30 39 45 30
31 34 5A 01 01 00 00
Provider wouldn't have bumped us from ADSL to VDSL - but here's the output of show controller vdsl 0:
Controller VDSL 0 is UP
Daemon Status: Up
XTU-R (DS) XTU-C (US)
Chip Vendor ID: 'BDCM' 'IFTN'
Chip Vendor Specific: 0x0000 0x71C8
Chip Vendor Country: 0xB500 0xB500
Modem Vendor ID: 'CSCO' ' '
Modem Vendor Specific: 0x4602 0x0000
Modem Vendor Country: 0xB500 0x0000
Serial Number Near: FCZ1111C08V C887VAG 15.2(4)M
Serial Number Far:
Modem Version Near: 15.2(4)M
Modem Version Far: 0x71c8
Modem Status: TC Sync (Showtime!)
DSL Config Mode: AUTO
Trained Mode: G.992.1 (ADSL) Annex A
TC Mode: ATM
Selftest Result: 0x00
DELT configuration: disabled
DELT state: not running
Trellis: ON ON
SRA: disabled disabled
SRA count: 0 0
Bit swap: enabled enabled
Bit swap count: 1 8
Line Attenuation: 54.5 dB 31.5 dB
Signal Attenuation: 54.5 dB 0.0 dB
Noise Margin: 6.7 dB 11.0 dB
Attainable Rate: 2132 kbits/s 888 kbits/s
Actual Power: 16.7 dBm 12.7 dBm
Total FECC: 546 0
Total ES: 6 0
Total SES: 0 0
Total LOSS: 0 0
Total UAS: 486 486
Total LPRS: 0 0
Total LOFS: 0 0
Total LOLS: 0 0
Full inits: 14
Failed full inits: 1
Short inits: 0
Failed short inits: 1
Firmware Source File Name (version)
VDSL user config flash:vdsl.bin-A2pv6C035d_d23j (10)
Modem FW Version: 110802_1752-4.02L.03.A2pv6C035d.d23j
Modem PHY Version: A2pv6C035d.d23j
Vendor Version:
DS Channel1 DS Channel0 US Channel1 US Channel0
Speed (kbps): 0 1664 0 704
SRA Previous Speed: 0 0 0 0
Previous Speed: 0 1600 0 736
Total Cells: 0 2786872 0 0
User Cells: 0 68 0 0
Reed-Solomon EC: 0 546 0 0
CRC Errors: 0 9 0 0
Header Errors: 0 10 0 0
Interleave (ms): 0.00 8.00 0.00 8.00
Actual INP: 0.00 1.12 0.00 1.28
Training Log : Stopped
Training Log Filename : flash:vdsllog.bin
And here's the output from the ATM and dialer interfaces:
interface ATM0
no ip address
ip flow ingress
no atm ilmi-keepalive
end
interface ATM0.1 point-to-point
ip flow ingress
pvc 0/38
pppoe-client dial-pool-number 2
end
interface Dialer2
description OUTSIDE
ip address negotiated
ip access-group firewall in
ip mtu 1492
ip flow ingress
ip nat outside
ip inspect DEFAULT100 out
ip virtual-reassembly in
encapsulation ppp
dialer pool 2
dialer-group 2
ppp authentication chap callin
ppp chap hostname ###removed###
ppp chap password ###removed###
no cdp enable
crypto map dcvpn
end
As I say though, config-wise, everything should be correct - the same router works fine on another line (which should also confirm the authentication details are correct - at least in as far as it matches what the ISP have on their RADIUS)
Any further thoughts? -
So my airport extreme recently had some nat/dns issue and in the airport utility displayed a warning about it and to correct it. I wasn't sure what to do so i pressed the resolve icon and now my guest network is not working.
Anytime you change networking hardware, it is always a good idea to perform a complete power recycle of your networking components.
I would recommend that you do the following as a minimum:
Power-down the modem, AirPort base station, and computer(s).
Disconnect the AirPort base station from the Internet broadband modem.
While all of the devices are powered-down, perform a "factory default" reset on the base station. This will get it back to its "out-of-the-box" configuration and make setting it up much easier, especially if you use the "Assist me" process within the AirPort Utility. (ref: Resetting an AirPort Base Station or Time Capsule)
After the base station resets, go ahead and power it back down.
Reconnect the AirPort base station to the Internet broadband modem. For the Extreme and Time Capsule, be sure to connect the cable to the base station's WAN (circle-of-dots) port.
Power-up the modem; wait at least 10-15 minutes to allow it adequate time to initialize.
Power-up the AirPort base station; wait at least 5-10 minutes. Note: The AirPort's status light may continue to flash amber after it has intialized. That is because, there may be some additional configuration items necessary, like setting up wireless security, before the overall setup is completed to get a green status.
Power-up your computer(s).
In this basic configuration, the AirPort base station will broadcast an unsecured wireless network with a Network Name (SSID) of Apple Network NNNNNN. Network clients, connected to the base station either by wire or wireless, should now be able to access the Internet through the ISP's modem. Once Internet connectivity has been verified, you can use the AirPort Utility to configure the base station for wireless security and any other desired options. Please post back your results. -
VPN client connect to CISCO 887 VPN Server bat they stop at router!!
Hi
my scenario is as follows
SERVER1 on lan (192.168.5.2/24)
|
|
CISCO-887 (192.168.5.4) with VPN server
|
|
INTERNET
|
|
VPN Cisco client on xp machine
My connection have public ip address assegned by ISP, after ppp login.
I've just configured (with Cisco Configuration Professional) the ADSL connection and VPN Server (Easy VPN).
All the PC on LAN surf internet and remote PC connect to VPN Cisco server via cisco VPN client.
But all remote PC after connection to Cisco VPN server don't ping SERVER1 in lan and therefore don't see SERVER1 and every other resource in LAN.
They can ping only router!!!
They are configured with Cisco VPN client (V5.0.007) with "Enabled Trasparent Tunnelling" and "IPSec over UDP NAT/PAT".
What is wrong in my attached configuration? (I've alspo tried to bind Virtual-Template1 both to unnambered Dialer0 and to Loopback0 but without luck)
Peraps ACL problem?
Building configuration...
Current configuration : 5019 bytes
! Last configuration change at 05:20:37 UTC Tue Apr 24 2012 by adm
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname gate
boot-start-marker
boot-end-marker
no logging buffered
aaa new-model
aaa authentication login default local
aaa authentication login ciscocp_vpn_xauth_ml_1 local
aaa authentication login ciscocp_vpn_xauth_ml_2 local
aaa authorization exec default local
aaa authorization network ciscocp_vpn_group_ml_1 local
aaa authorization network ciscocp_vpn_group_ml_2 local
aaa session-id common
memory-size iomem 10
crypto pki token default removal timeout 0
crypto pki trustpoint TP-self-signed-453216506
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-453216506
revocation-check none
rsakeypair TP-self-signed-453216506
crypto pki certificate chain TP-self-signed-453216506
certificate self-signed 01
quit
ip name-server 212.216.112.222
ip cef
no ipv6 cef
password encryption aes
license udi pid CISCO887VA-K9 sn ********
username adm privilege 15 secret 5 *****************
username user1 secret 5 ******************
controller VDSL 0
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp client configuration group EXTERNALS
key 6 *********\*******
dns 192.168.5.2
wins 192.168.5.2
domain domain.local
pool SDM_POOL_1
save-password
crypto isakmp profile ciscocp-ike-profile-1
match identity group EXTERNALS
client authentication list ciscocp_vpn_xauth_ml_2
isakmp authorization list ciscocp_vpn_group_ml_2
client configuration address respond
virtual-template 1
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
crypto ipsec profile CiscoCP_Profile1
set transform-set ESP-3DES-SHA1
set isakmp-profile ciscocp-ike-profile-1
interface Loopback0
ip address 10.10.10.10 255.255.255.0
interface Ethernet0
no ip address
shutdown
interface ATM0
no ip address
no atm ilmi-keepalive
interface ATM0.1 point-to-point
pvc 8/35
encapsulation aal5snap
protocol ppp dialer
dialer pool-member 1
interface FastEthernet0
no ip address
interface FastEthernet1
no ip address
interface FastEthernet2
no ip address
interface FastEthernet3
no ip address
interface Virtual-Template1 type tunnel
ip unnumbered Dialer0
tunnel mode ipsec ipv4
tunnel protection ipsec profile CiscoCP_Profile1
interface Vlan1
ip address 192.168.5.4 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly in
interface Dialer0
ip address negotiated
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname ******@*******.****
ppp chap password 0 alicenewag
ppp pap sent-username ******@*******.**** password 0 *********
ip local pool SDM_POOL_1 192.168.5.20 192.168.5.50
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 600 life 86400 requests 10000
ip nat inside source list 1 interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 Dialer0
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 192.168.5.0 0.0.0.255
access-list 100 remark CCP_ACL Category=4
access-list 100 permit ip 192.168.5.0 0.0.0.255 any
dialer-list 1 protocol ip permit
line con 0
line aux 0
line vty 0 4
transport input all
endHello,
Your pool of VPN addresses is overlapping with the interface vlan1.
Since proxy-arp is disabled on that interface, it will never work
2 solutions
1- Pool uses a different network than 192.168.5
2- Enable ip proxy-arp on interface vlan1
Cheers,
Olivier -
VPN client connect to CISCO 887 VPN Server but I can't ping Local LAN
Hi
my scenario is as follows
SERVER1 on lan (192.168.1.4)
|
|
CISCO-887 (192.168.1.254)
|
|
INTERNET
|
|
VPN Cisco client on windows 7 machine
My connection have public ip address assegned by ISP, after ppp login.
I've just configured (with Cisco Configuration Professional) the ADSL connection and VPN Server (Easy VPN).
All the PC on LAN surf internet and remote PC connect to VPN Cisco server via cisco VPN client.
But all remote PC after connection to Cisco VPN server don't ping SERVER1 in lan and therefore don't see SERVER1 and every other resource in LAN. I can't even ping the gateway 192.168.1.254
I'm using Cisco VPN client (V5.0.07) with "IPSec over UDP NAT/PAT".
What is wrong in my attached configuration? (I've alspo tried to bind Virtual-Template1 both to unnambered Dialer0 and to Loopback0 but without luck)
Perhaps ACL problem?
Building configuration...
Current configuration : 4921 bytes
! Last configuration change at 14:33:06 UTC Sun Jan 26 2014 by NetasTest
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname TestLab
boot-start-marker
boot-end-marker
enable secret 4 5ioUNqNjoCPaFZIVNAyYuHFA2e9v8Ivuc7a7UlyQ3Zw
aaa new-model
aaa authentication login default local
aaa authentication login ciscocp_vpn_xauth_ml_1 local
aaa authentication login ciscocp_vpn_xauth_ml_2 local
aaa authorization exec default local
aaa authorization network ciscocp_vpn_group_ml_1 local
aaa authorization network ciscocp_vpn_group_ml_2 local
aaa session-id common
memory-size iomem 10
crypto pki trustpoint TP-self-signed-3013130599
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3013130599
revocation-check none
rsakeypair TP-self-signed-3013130599
crypto pki certificate chain TP-self-signed-3013130599
certificate self-signed 01
3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 33303133 31333035 3939301E 170D3134 30313236 31333333
35305A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 30313331
33303539 3930819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100A873 940DE7B9 112D7C1E CEF53553 ED09B479 24721449 DBD6F559 1B9702B7
9087E94B 50CBB29F 6FE9C3EC A244357F 287E932F 4AB30518 08C2EAC1 1DF0C521
8D0931F7 6E7F7511 7A66FBF1 A355BB2A 26DAD318 5A5A7B0D A261EE22 1FB70FD1
C20F1073 BF055A86 D621F905 E96BD966 A4E87C95 8222F1EE C3627B9A B5963DCE
AE7F0203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
551D2304 18301680 14E37481 4AAFF252 197AC35C A6C1E8E1 E9DF5B35 27301D06
03551D0E 04160414 E374814A AFF25219 7AC35CA6 C1E8E1E9 DF5B3527 300D0609
2A864886 F70D0101 05050003 81810082 FEE61317 43C08637 F840D6F8 E8FA11D5
AA5E49D4 BA720ECB 534D1D6B 1A912547 59FED1B1 2B68296C A28F1CD7 FB697048
B7BF52B8 08827BC6 20B7EA59 E029D785 2E9E11DB 8EAF8FB4 D821C7F5 1AB39B0D
B599ECC1 F38B733A 5E46FFA8 F0920CD8 DBD0984F 2A05B7A0 478A1FC5 952B0DCC
CBB28E7A E91A090D 53DAD1A0 3F66A3
quit
no ip domain lookup
ip cef
no ipv6 cef
license udi pid CISCO887VA-K9 sn ***********
username ******* secret 4 5ioUNqNjoCPaFZIVNAyYuHFA2e9v8Ivuc7a7UlyQ3Zw
username ******* secret 4 Qf/16YMe96arcCpYI46YRa.3.7HcUGTBeJB3ZyRxMtE
controller VDSL 0
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp client configuration group EXTERNALS
key NetasTest
dns 8.8.4.4
pool VPN-Pool
acl 120
crypto isakmp profile ciscocp-ike-profile-1
match identity group EXTERNALS
client authentication list ciscocp_vpn_xauth_ml_2
isakmp authorization list ciscocp_vpn_group_ml_2
client configuration address respond
virtual-template 1
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
mode tunnel
crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
mode tunnel
crypto ipsec profile CiscoCP_Profile1
set transform-set ESP-3DES-SHA1
set isakmp-profile ciscocp-ike-profile-1
interface Ethernet0
no ip address
shutdown
interface ATM0
no ip address
no atm ilmi-keepalive
hold-queue 224 in
pvc 8/35
pppoe-client dial-pool-number 1
interface FastEthernet0
no ip address
interface FastEthernet1
no ip address
interface FastEthernet2
no ip address
interface FastEthernet3
no ip address
interface Virtual-Template1 type tunnel
ip address 192.168.2.1 255.255.255.0
tunnel mode ipsec ipv4
tunnel protection ipsec profile CiscoCP_Profile1
interface Vlan1
ip address 192.168.1.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
interface Dialer0
ip address negotiated
ip mtu 1452
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname ****
ppp chap password 0 *********
ppp pap sent-username ****** password 0 *******
no cdp enable
ip local pool VPN-Pool 192.168.2.210 192.168.2.215
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 600 life 86400 requests 10000
ip nat inside source list 100 interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 Dialer0
access-list 100 remark
access-list 100 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 100 remark
access-list 100 permit ip 192.168.1.0 0.0.0.255 any
access-list 120 remark
access-list 120 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
line con 0
exec-timeout 5 30
password ******
no modem enable
line aux 0
line vty 0 4
password ******
transport input all
end
Best Regards,I've updated ios to c870-advipservicesk9-mz.124-24.T8.bin and tried to ping from rv320 to 871 and vice versa. Ping stil not working.
router#sh crypto session detail
Crypto session current status
Code: C - IKE Configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
X - IKE Extended Authentication, F - IKE Fragmentation
Interface: Dialer0
Uptime: 00:40:37
Session status: UP-ACTIVE
Peer: 93.190.178.205 port 500 fvrf: (none) ivrf: (none)
Phase1_id: 192.168.1.100
Desc: (none)
IKE SA: local 93.190.177.103/500 remote 93.190.178.205/500 Active
Capabilities:(none) connid:2001 lifetime:07:19:22
IPSEC FLOW: permit ip 10.1.1.0/255.255.255.0 10.1.2.0/255.255.255.0
Active SAs: 4, origin: dynamic crypto map
Inbound: #pkts dec'ed 0 drop 30 life (KB/Sec) 4500544/1162
Outbound: #pkts enc'ed 5 drop 0 life (KB/Sec) 4500549/1162 -
DNS Issues with Time Capsule - DNS Proxy periodically dies
hi all .... looking for some suggestions
I have a time capsule 1TB, connected to a linksys adsl modem in bridge mode, with the TC acting as DHCP server for my local clients. In the PPPoE settings I also enter the primary and secondary addresses for DNS that my ISP supplied.
I am able to successfully connect to the internet, and all clients successfully pick up an IP address, and each client picks up the TC as the DNS proxy. Everything works perfectly as it should.
Usually once per day, there seems to be a slight hickup with the internet connection (hard to tell whether I am losing the PPPoE or some other issue). When this happens, the PPPoE connection remains active, as I am able to access anything on the internet from an IP level. However, the DNS proxy service on the TC seems to die and as a result, all internet browsing fails. If I reboot the TC, everything comes back to normal. If I dont reboot, the only way to get browsing working is to manually enter the DNS IP address from ISP into the client PCs. However, this is a manual fix that I should not have to perform.
Looking for advice and guidance. Seems like a bug but I cant tell. If I was able to set the DHCP server to pass out the ISP supplied addresses that would also work, but I cant.Just got off the phone with support for this very same problem. DNS Proxy is definitely dying in the TC, looks like a firmware issue to me.
This is the 3rd TC I'm on. First was a 500GB, had this problem, replaced it under warranty at Apple's direction, replacement did the same, just upgraded this weekend to 1GB, and same issue still. All on 7.3.2 firmware.
TC 1TB, PPPoE to my ISP, ISP's DNS Servers listed in the PPPoE config in the TC.
When a host gets DHCP from the TC the only DNS returned is the TC itself, since it proxies the ISP DNS servers.
Once every day or two, the DNS proxy dies. local network works, and I can add my ISP's DNS addresses in my host config and I have DNS again, but this is definitely something dying in the DNS proxy in the TC.
Just for kicks trying to switch from my ISP's DNS servers to OpenDNS now since someone said that worked for them, but I am not hopeful... I don't see this as a host DNS issues at all.
The dead proxy is very clear:
$ nslookup apple.com. 192.168.1.1 # that's the TC
Server: 192.168.1.1
Address: 192.168.1.1#53
** server can't find apple.com: SERVFAIL
$ nslookup apple.com. 208.67.222.222 # that's OpenDNS
Server: 208.67.222.222
Address: 208.67.222.222#53
Non-authoritative answer:
Name: apple.com
Address: 17.149.160.49
I replaced a linksys router with the TC and am kind of unhappy that a $500 router dies every couple of days. My cheapo Linksys router never needed to be restarted, it only ever got rebooted once every year or so when the house lost power long enough for the UPS to run out of battery.
Help us out here Apple, I replaced a $50 router with a $500 because I like the flavor of your kool aid, and this thing dies every day or two. Even if you can't fix why the proxy is dying every couple of days, can you please at least update the firmware to maybe restart the proxy if it quits working? -
Cisco software and Router password?
Hi..
I have an e2000 wireless router. I have the latest software version for the Cisco software. My problem is this.. I have noticed that Cisco sets up the same password to access the router setup page as the wireless password... WHY?
What I mean is that... Anyone that connects to the main SSID will be able to connect to the setup page at 192.168.1.1...I know that I can change the password in the linksys setup page to whatever I want, but then when I open the Cisco software, it wants me to change the password to match what the administrator password is... this is ridiculous... why would CIsco do this?
Don't they realize that a wireless password is different than the Administrator password to access the router settings?
Am I missing something here?Well the software is really not that bad except for the password issue. I use OpenDns servers to protect my netword from porn, phishing, ect because I have kids. This is why a password to access the router settings is essential to prevent anyone but me to make any changes to those settings... but like I said, if it wasn't because of the password issue, the software is not that bad.
Anyway, I went back to Tomato firmware because with the regular e2000 firmware you can't intercept port 53 which can be used to bypass any DNS settings, which Tomato or DD-WRT are capable of intercepting and redirecting any DNS settings. -
Some time ago DNS started to work unstable.
I've read similar cases around, but none of them looks similar to mine...
DNS stop functioning all the time for several seconds...
E.g.. If I constantly do the nslookup than at least once a minute I'm getting behavior showed below.
At the same time, Google DNS responds with no issues.
I managed to configure most of my numerous devices to use Google DNS, but I do not like such approach.
Router firmware update did not help.
In router logs there is a line:
Apr 19 22:31:23 2011 System Log Message daemon.warn DNS: unknown PTR name format
I could not find correlation between this line and issue, but I did not look deep enough, though.
Any ideas?
Thank you.
DK
C:\Program Files (x86)\Far2>nslookup verizon.com 192.168.1.1
Server: myrouter.home
Address: 192.168.1.1
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
Non-authoritative answer:
Name: verizon.com
Address: 192.76.85.245
C:\Program Files (x86)\Far2>nslookup verizon.com 192.168.1.1
Server: myrouter.home
Address: 192.168.1.1
Non-authoritative answer:
Name: verizon.com
Address: 192.76.85.245
C:\Program Files (x86)\Far2>nslookup verizon.com 192.168.1.1
Server: myrouter.homeAddress: 192.168.1.1
DNS request timed out. timeout was 2 seconds.
DNS request timed out. timeout was 2 seconds.
Non-authoritative answer:
Name: verizon.com
Address: 192.76.85.245
C:\Program Files (x86)\Far2>nslookup verizon.com 192.168.1.1
Server: myrouter.home
Address: 192.168.1.1
Non-authoritative answer:
Name: verizon.com
Address: 192.76.85.245(I'm topicstarter here)...
Funny thing, I contacted Verizon customer support recently and encountered very intellegent and responsive person who read all the details (I used the live chat option) and suggested to replace router for free with the new one - not Westel, something starts with letter A.
I was little bit disappointed that new router had only 100Mb switch and no 5GHz band support... But at least it supports the wifi-N...
Anyway, I do not need all these bells and whisles cause I'm using NetGear router for wifi + Cisco home switch for wired network.
Sorry, I deviated from the main issue course.
I do not have any update on the DNS issue cause all my devices still configured to use Google DNS servers.
However, I expect that quite soon I will get Logitech Revue and will have update on this issue. -
Cisco 887 on BT ADSL2+ throughput freezes
Hi
We have some very frustrating issues with a Cisco 887 router on a BT ADSL2+ line.
Now the symptoms are, the line is up and running, synced at 4.5MB and then all of a sudden we can't browse anymore. The line is still up but packets are not forwarded anymore, throughput freezes.
Now we had problems in the past with this line where initially the download was about 900Kb (service was stable) and after many arguments with BT someone in their team 're-wrote the protocol' (I have no idea what that means) and the speed went up to 3.5MB. We had BT engineers on site, swapped the line on different pairs (which pumped the speed up to 5.1MB but with the cost of an intermitent service).
I've tried 2 routers, both 887 but with different IOS and modem software (one more up to date) but both presented the same behaviour.
I'll post below sh controller vdsl output command and a few bits of the config. Any help or ideas would be very much apreciated.
interface ATM0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
atm vc-per-vp 128
no atm ilmi-keepalive
hold-queue 224 in
pvc 0/38
oam-pvc 0
encapsulation aal5mux ppp dialer
dialer pool-member 1
interface Dialer0
ip address xxx
ip access-group 101 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat outside
ip inspect myfw out
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname xxx
ppp chap password xxx
ppp pap sent-username xxx password xxx
no cdp enable
hold-queue 224 in
Controller VDSL 0 is UP
Daemon Status: Up
XTU-R (DS) XTU-C (US)
Chip Vendor ID: 'BDCM' 'IFTN'
Chip Vendor Specific: 0x0000 0x827A
Chip Vendor Country: 0xB500 0xB500
Modem Vendor ID: 'CSCO' ' '
Modem Vendor Specific: 0x4602 0x0000
Modem Vendor Country: 0xB500 0x0000
Serial Number Near: FCZ1641C7YT 887VA-SE 15.1(4)M
Serial Number Far: 2301230123012301230123012301230
Modem Version Near: 15.1(4)M
Modem Version Far: 0x827a
Modem Status: TC Sync (Showtime!)
DSL Config Mode: AUTO
Trained Mode: G.992.5 (ADSL2+) Annex A
TC Mode: ATM
Selftest Result: 0x00
DELT configuration: disabled
DELT state: not running
Trellis: ON ON
Line Attenuation: 53.5 dB 32.3 dB
Signal Attenuation: 53.5 dB 32.5 dB
Noise Margin: 9.3 dB 5.8 dB
Attainable Rate: 6024 kbits/s 980 kbits/s
Actual Power: 0.0 dBm 12.6 dBm
Total FECS: 1383 0
Total ES: 63 0
Total SES: 0 0
Total LOSS: 0 0
Total UAS: 0 0
Total LPRS: 0 0
Total LOFS: 0 0
Total LOLS: 0 0
Bit swap: 6 0
Full inits: 7
Failed full inits: 0
Short inits: 0
Failed short inits: 0
Firmware Source File Name (version)
VDSL embedded VDSL_LINUX_DEV_01212008 (1)
Modem FW Version: 110506_1916-4.02L.03.A2pv6C032b.d23i
Modem PHY Version: A2pv6C032b.d23i
DS Channel1 DS Channel0 US Channel1 US Channel0
Speed (kbps): 0 5159 0 980
Previous Speed: 0 5063 0 984
Total Cells: 0 1366828 0 252517
User Cells: 0 376 0 94
Reed-Solomon EC: 0 1431 0 0
CRC Errors: 0 89 0 0
Header Errors: 0 328 0 0
Interleave (ms): 0.00 7.98 0.00 4.96
Actual INP: 0.00 1.10 0.00 0.24
Training Log : Stopped
Training Log Filename : flash:vdsllog.binHi
Your Ethernet 0 interface is shutdown it needs to be up.
I use the below in my Dialer 1 for my infinity
ppp authentication chap pap callin
ppp chap hostname [email protected]
ppp chap password 0 route
ppp pap sent-username [email protected] password 0 route
Rob
Maybe you are looking for
-
downloaded the darkness 2 on my 27 incn mac 3.2 ghz intel core i3 and 4 gb memory it wont start up and gives no error code need it fixed or refund money please help Heber
-
i just bought more icloud storage, why does it not let me backup my iPhone 5..says i need 1.4 GB of space?..I just bought 10 more in icloud.
-
How to create motif Region in Java???
How can u create Motif Region In Java or Java Swing??? If you know, please let me know. thanks Amit
-
Hello. I am a happy user of the hosted APEX service, who has successfully experimented with searching using Oracle Text (thanks to other posts here such as those from Denes.) I would like to now use a thesaurus but I cannot use the ctx_thes package t
-
Error in importing javax.servlet.ServletConfig;
Hi I am fairly new to servlets technology while importing package javax.servlet.ServletConfig; i got error Create class "ServletConfig" in package javax.servlet I'm using eclipse IDE