Subnet mask 255.255.255.255 assigned to VPN client - can't ping LAN

Hi,
I configured PIX 501 with PPTP VPN to connect to the small office (PIX FW, Win 2000 Server, several Win clients, LAN IP 10.0.0.X/24):
ip local pool mypool 10.0.0.101-10.0.0.105
vpdn group mygroup accept dialin pptp
vpdn group mygroup ppp authentication mschap
vpdn group mygroup ppp encryption mppe 128 required
vpdn group mygroup client configuration address local mypool
vpdn group mygroup client configuration dns 10.0.0.15
vpdn group mygroup pptp echo 60
vpdn group mygroup client authentication local
vpdn username xxxx password *********
vpdn enable outside
I can connect to the office using Win VPN client, but I can't ping any hosts in the office network. I suspect that the reason for that is subnet mask assigned to the VPN client: 255.255.255.255. ipconfig of the VPN client:
PPP adapter Office:
Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : 10.0.0.101
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . :
Default GW is missing too, but I think this is not the main problem.
Any way, what is wrong with my config? How to fix subnet mask assigned to clients? Or may be my assumption is wrong and this mask is ok? What is wrong then?
Any input will be greatly appreciated!
George

Thanks for the prompt reply.
Here it does:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxxxxxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxx encrypted
hostname OSTBERG-PIX
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 80 permit ip 10.0.0.0 255.255.255.0 10.0.20.0 255.255.255.0
access-list inbound permit icmp any any
access-list inbound permit tcp any any eq pptp
access-list inbound permit gre any any
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 66.189.xxx.xxx 255.255.252.0
ip address inside 10.0.0.23 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool mypool 10.0.0.101-10.0.0.105
pdm location 10.0.0.0 255.255.255.0 inside
pdm location 10.0.0.15 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group inbound in interface outside
route outside 0.0.0.0 0.0.0.0 66.189.yyy.yyy 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
telnet 10.0.0.23 255.255.255.255 inside
telnet 10.0.0.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn group mygroup accept dialin pptp
vpdn group mygroup ppp authentication mschap
vpdn group mygroup ppp encryption mppe 128 required
vpdn group mygroup client configuration address local mypool
vpdn group mygroup client configuration dns 10.0.0.15
vpdn group mygroup pptp echo 60
vpdn group mygroup client authentication local
vpdn username ********* password *********
vpdn enable outside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
terminal width 80
Cryptochecksum:xxx
: end
There are remnants of old config, I just recently took over this network, some lines look odd to me, but I did not touch what works. VPN config is all mine.
PIX internal 10.0.0.23 - is a gateway for the network. DNS server in LAN - 10.0.0.15.
I've been reading about the problem and came across several posts that this subnet mask is normal, but it puzzles me - how can this host communicate with anyone else if there is no room for other hosts in this network (according to the mask)?!
Thanks again!
George

Similar Messages

Osx server 2.2.1 VPN subnet mask 255.255.255.255

Why is the subnet mask 255.255.255.255 and how can I change that?

Read http://en.wikipedia.org/wiki/Subnetwork
Allan

Reliability 255/255, txload 1/255, rxload 1/255

I can't seem to find the meaning of the following parameters when the sh int command is performed: reliability 255/255, txload 1/255, rxload 1/255..
Can someone please shed the light on it?
Thanks.

It's kind of a rough scale of the condition of the interface.
Reliability 255/255= 100% up and reliable
128/255 = 50% up and not-so reliable
txload 1/255 = 0-4% of traffic is coming from transmitted info. 128/255 would mean 50%of traffic is coming from transmitted info.
rxload is the same as tx except it's received data.
These values are kind of a high level dashboard on what the intreface is doing in regards to traffic. EIGRP Metrics are designed to use the reliability information, but is rarely imlemented.
FROM CISCO
Reliability of the interface as a fraction of 255 (255/255 is 100 percent reliability), calculated as an exponential average over 5 minutes.
txload/rxload=Load on the interface as a fraction of 255 (255/255 is completely saturated), calculated as an exponential average over 5 minutes.
http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_command_reference_chapter09186a00801a7edb.html#wp1229983

Cisco 6509 with Reliability 255/255, txload 238/255, rxload 8/255 interface

Hi there,
I'm having an issue with my Cisco 6509. One of Internet configured as trunk Interface direct with a HP7500 is showing reliability 255/255, txload 238/255, rxload 8/255.
The Issue is that my Cacti Server show me that only 10% of the link is in use but if you look at txload you can see that almost 100% of the bandwidth is in use..
What can I do in order to figure out what's going on with this Interface. I'm thing about to put wireshark and configure a port monitor in order to capture the packets.
Is anyone has any tip to do a troubleshoot with this issue??
SWITCH01#show int port-channel 10
Port-channel10 is up, line protocol is up (connected)
Hardware is EtherChannel, address is c47d.4fbf.a8c2 (bia c47d.4fbf.a8c2)
Description: CORECISCO_X_COREHP
MTU 1500 bytes, BW 2000000 Kbit, DLY 10 usec,
reliability 255/255, txload 238/255, rxload 8/255
Encapsulation ARPA, loopback not set
Full-duplex, 1000Mb/s
input flow-control is off, output flow-control is unsupported
Members in this channel: Gi8/19 Gi8/20
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters 1w0d
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 66043000 bits/sec, 23041 packets/sec
5 minute output rate 1871148000 bits/sec, 186439 packets/sec
15127300343 packets input, 6121405739799 bytes, 0 no buffer
Received 232321316 broadcasts (161670914 multicast)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
118621325538 packets output, 141124879219641 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 PAUSE output
0 output buffer failures, 0 output buffers swapped out
SWITCH01#
Regards
Adriano

This pretty much tells you your port channel is pretty full. How many ports in the channel?
5 minute input rate 66043000 bits/sec, 23041 packets/sec
5 minute output rate 1871148000 bits/sec, 186439 packets/sec

Assigning non-standard subnet mask to local IP address on WRT54GX

I need to configure my WRT54GX V1 as an access point. I know how to accomplish this, but our corporate network uses a subnet mask of 255.255.252.0 How can I assign this net mask? The only options are contained in a drop-down menu and what I need is not there. Is there a different way to assign the subnet mask rather than using the menues?

It is a known limitation of Linksys wireless routers that they only support LAN subnets up to 255.255.255.0. I guess the assumption was that the router only runs LANs for up to 253 LAN devices. The plain access point setup (i.e. uplink through LAN-LAN connection) was never properly considered an option although it is documented in the Linksys easy answers.
Anyway, to set up the WRT as access point the LAN IP address of the WRT and the subnet mask is not important for the wireless connectivity into the LAN. The LAN IP address and subnet mask is only relevant to access the web interface of the WRT to make configuration changes. You have to make sure that the DHCP server on the WRT is turned off and that a LAN port of the WRT is wired to your existing LAN.
For the LAN IP address setup you have three options:
1. Use an available IP address inside your LAN and use subnet mask 255.255.255.0, e.g. if your LAN uses 10.0.0.0/255.255.252.0, assign the WRT an IP address of 10.0.3.200 with subnet mask 255.255.255.0. Of course, in that case you are only able to access the web interface of the WRT http://10.0.3.200/ from a computer in 10.0.3.* because that's the IP subnet which the WRT thinks is connected to its LAN ports. You cannot use a computer with IP address 10.0.{0,1,2}.* because the WRT does not know how to route these IP addresses. If your computer has an IP address outside the configured WRT LAN subnet you must temporarily change the IP address of the computer.
2. If you assign a LAN IP address and subnet mask to your WRT which includes a network router you may be able to get full connectivity by setting up static routes in the WRT. For instance, if you assign 10.0.3.200/255.255.255.0 to your WRT and your main LAN router sits at 10.0.3.254/255.255.252.0 you may be able to set up static routes for destinations 10.0.0.0/255.255.254.0 and 10.0.2.0/255.255.255.0 (or if it works even simply destination 10.0.0.0/255.255.252.0) to gateway IP address 10.0.3.254 on the LAN interface. Traffic from the computer to the router should go directly while the responses from the router to the computer go through the main router. I think this should work although I am not 100% sure.
3. Use any IP address outside your LAN, e.g. the default 192.168.1.1/255.255.255.0. Again, you must temporarily set up a static IP address on your computer to gain access to the web interface. But even with a LAN IP address outside your LAN the WRT will still bridge wireless clients into the LAN as it is supposed to do.

Leopard wifi issue: subnet mask?

I have the common Leopard wifi problem:
4 computers, all linked to new Airport Extreme with 10.4
3 of 4 link with Leopard.
Have tried all suggestions to fix the problem with the IMac G5 that won't link.
Always says that the iMac has self-assigned IP and can not connect
Noted that when the problematic machine does rarely link, Subnet Mask is 255.255.255.0
Same with all linking machines.
When doesn't link, subnet mask is 255.255.0.0.
Does this give any hint as to the problem.

This might not be related, but you could try changing the DNS settings in your Router to use OpenDNS instead of the number automatically set by your ISP. You just need to manually enter the 2 numbers:
208.67.222.222
208.67.220.220
There are good instructions on the OpenDNS website. It's worth trying just to see if it solves your problem:
https://www.opendns.com/start?device=netgear

Defining VPN Subnet Mask?

Howdy,
Ok this problem occurs on Windows Vista, and is, to my knowledge classed as a bug, as it never occured on XP. So when I migrated over to OS X I assumed it would not be there... I was wrong, cos it is!
I connect to several VPNs to access MySQL DB's, and I use these everyday and are very important. Now a few of the VPN's use a subnet mask of 255.255.255.0, like most connections. Now the other VPNs use a subnet mask of 255.255.240.0, and when connecting to these VPN's OS X just assumes the subnet is 255.255.255.0 and therefore, even though it connects fine, I cannot access anything on this server cos of this problem!
Now the only way, to my knowledge, around this is to run the ifconfig command to get my assigned IP Address, then run the command:
sudo route add -net 192.168.16.0 192.168.16.* 255.255.240.0
Where * represents the last 1/2 digits of my assigned IP address. This does work, but is quite frustrating, just as it was running the "route" command on Vista.
Does anyone know of a way around this? So I can tell OS X to add me a subnet mask of 255.255.240.0? Or even a way in OS X to automatically run the above command via terminal when I connect?
Any help will be appreciated!
ta
Steve M

Do you know how I can join my office domain via the PPTP connection? I've triend both the QuickVPN client as well as, Windows built-in VPN connection. I've only been able to successfully connect using Windows VPN connection. I could not get QuickVPN client to work.

Ip address & subnet mask !

I have recently encountered a problem with my system and the assigned IP Address and was not sure why. I have a wireless connection on the iMac with it setup to get the IP address automatically but the system gets the wrong subnet mask every time. It gets (255.255.0.0) the correct subnext mask in the other mac's is (255.255.255.0). Where is it getting the inappropriate address and why does it didn't assign the correct one!!

Are you sure that both these macs are getting IP addresses from the same place? (1 wired, 1 wireless...might mean that mac2 is getting neighbor's wifi)
Are you certain that this trouble mac is configured to be fully Automatic in the NetworkSystemPreferences?
"Conigure IPv4...Using DHCP" ( not manually, not dhcp with manual address, not bootP...)
Have you done a cold start to all your network devices (macs, router, modem, network printers?)
Power-cycle them off. Count 2 minutes. Start up modem, pause. Start up router/BaseStation, pause. Start up mac(s).
You haven't said what kind of router/baseStation you've got. 'Twould help, maybe.
added: Do you have a wireless modem/router AND a wireless airportBS/router/something)?
Message was edited by: Rick Van Vliet
Message was edited by: Rick Van Vliet

The subnet mask on the Extreme isn't the same as on the Express.

Dear Group,
I have my Extreme configured to do PPPoE and DHCP and my DSL modem is setup as bridged. Everything is finally working well. I have an Express extending the Extreme in a WDS.
When I look at the PPPoE tab in the Internet tab of the Extreme in AirPort Utility it shows a subnet mask of 255.255.255.255, but the Internet tab of the Express shows 255.255.255.0.
I don't have any problems at all and wireless clients are connected to the Extreme and the Express.
Is the Extreme's subnet mask part of my DSL connection and therefore a different subnet mask?
Not sure, but I'd like to make sure that I don't have something setup incorrectly.
Thanks,
Frank

This really isn't an issue as long as the AirPort Extreme base station (AEBS) is providing a working Internet connection. Since the AEBS is using PPPoE to connect to your ISP I'm not sure that the subnet mask is even used.
The subnet value of 255.255.255.0 used by the AirPort Express (AX) is typical.

Linksys WRT54GL - illegal subnet mask message

Hello everybody,
I just changed the ISP and the new one is on optic fiber, and they arrived with theirs equipment, wich is a Huawey EchoLife HG856 and I connected it to my Linksys WRT54GL.
When I tried to configure the router with the settings gived by the provider i received the following message:
"illegal subnet mask".
The setting given to me by the provider are: (i replaced some numbers with *, for privacy)
Where is the problem?
adresa de IP: 1**.27.1*4.6
netmask: 255.255.255.128
gateway: 1**.27.1*4.1
DNS1: 1**.2*1.2*2.1
DNS2: 2**.1*4.1*4.1

Try to hard-reset the router for 1 minute,power cycle the router and check again.

Why OSPF use wildcard mask? Not subnet mask?

Why OSPF use wildcard mask? Not subnet mask? Any advantage of using wildcard in OSPF? How wildcard in OSPF work? I saw some OSPF configuration for class b network use 0.0.0.255 as an OSPF wildcard mask. What does it mean? Is that mean to exchange only route information for the subnetwork?

hello,
with the use of a wild-card mask we can gain control over route update propagation.So we can define which networks should receive updates and which networks should not receive routing updates.Its just like wildcard masks used in ACLs.this is my view
cheers,

Help with a Subnet mask solution?

This is probably obvious to many of your network guys/gals - but I'm stumped - I'm looking for an easy solution to this.
I have a Linksys wireless router WRT54GS - Comcast cable broadband - my MacBook wasn't staying connected to it so I plugged in my Airport Express to one of the Linksys ports via Ethernet and disabled the wireless on the Linksys.
Bingo - no more connection problem - the Linksys handles the wired users and the Airport Express handles the wireless - except - I have a network drive connected to the Linksys via Ethernet that my wireless users can't "see" - I believe - because it's on a different subnet mask.
Is there an easy way to "link" the two so my wireless users can see the wired network drive?
THANKS!

As both the Linksys and the AE act as normal switches with no routing functionality, you have one single subnet. So all you have to do is to make sure that all devices connected to the Linksys and the AE have an IP-address of that subnet and the same subnet mask.
Most routers have a class C private network configured by default. Let's assume, you have 192.168.0.0/255.255.255.0. If so, pick an IP-address out of the address range 192.168.0.1 to 192.168.0.254 for each device and use 255.255.255.0 as a subnet mask. For other class C private networks use the according range.
If you need to mix different class C networks (e.g. 192.168.0.x for your wired deviced and 192.168.1.x for your wireless devices) use a subnet mask of 255.255.0.0 on all devices.
Just for your understanding: when a machine A connects to a machine B, machine A takes it's own IP-address (e.g. 192.168.1.1) and ANDs it bitwise with it's subnet address (e.g. 255.255.255.0 would result in 192.168.1.0). Next it does the same again, with machines B IP address and it's own subnet mask. If both results are the same, both machines are on the same subnet, so machine A tries to connect machine B directly. If not, the machines are on different subnet, so machine A tries to connect to machine B using it's configured default gateway.
Hope this information helps at least a bit.

Why would Airport change subnet mask?

Hello all.. kinda new to this stuff and was looking around for an answer, but couldn't find my exact situation. So, forgive me if I ask some stupid questions... Ok, I have MacBook Pro, and recently had to do a reset on my modem/router, and now this particular computer won't connect wirelessly. I also have a macbook air, and connects fine wirelessly. It seems I have narrowed it down to the subnet mask... maybe, but not completely sure. Just to be clear, I don't have the Airport express, I am just simply talking about the airport function built in to connect to a wireless network (not sure if it's called something different, or is the one on the actual computer just called airport?). So, going into the airport utility does nothing for me. It can't find any wireless devices. And everything I have read has been talking about going into that program and changing things. Anyways, I tried connecting automatically (using DHCP) and manually, but nothing helps. My macbook air gets a subnet mask of 255.255.255.0, while it has now started giving my macbook pro a 255.255.0.0. And I'm assuming my router is still configured for 255.255.255.0, but now my computer isn't.. How is that possible? Just wondering if anyone knew why this was happening and/or how I can fix it. Like I said, I'm not a genius with this stuff, but any help would be appreciated. Thanks for your help! And if I have missed any important information, let me know..

Unless you have an Apple-brand Wi-Fi base station, AirPort Utility is of no use to you.
It might help to reset the connection settings on your MacBook Pro using these steps one at a time until the problem is resolved, recognizing that, depending on your problem, not all of these steps will make sense:
1) Use the AirPort menu bar item to turn AirPort off, then on again.
2) Try to select your Wi-Fi network from the AirPort menu.
3) In the Network panel of System Preferences delete the AirPort item from the left column, then add it back.
4) In the same panel as (3), define a new location and see if you can make that work.
5) In the same panel, select the AirPort connection item, click the "Advanced" button, select the "TCP/IP" tab, then click "Renew DHCP Lease". Note that the fix this step implements may be temporary.
6) In the folder /Library/Preferences ( _not_ <yourhomefolder>/Library/Preferences), move the folder SystemConfiguration onto the Desktop, then restart your computer. See if you can now make your AirPort connection work.
These steps may not help, but they'll only take a couple of minutes to try. Before you try these, if you have any special network settings on your Mac for things like DSL credentials, note all your network settings, because the latter steps will destroy them. If you got all the way to the last step, if things don't work any worse than before, you can trash the saved SystemConfiguration folder.

RFC for subnet mask

Which RFC describes the illegal subnet masks (255.255.255.254, 255.255.255.255)?

Hi,
RFC 4632 would probably make useful reading. To quote section 3.1 :
"In CIDR notation, a prefix is shown as a 4-octet quantity, just like a traditional IPv4 address or network number, followed by the "/" (slash) character, followed by a decimal value between 0 and 32 that describes the number of significant bits."
So, this basically says your subnet mask can be any value from 0 (i.e. a default route) to 32 (i.e. a "host"). In your example 255.255.255.254 is 31 bits and 255.255.255.255 is 32 bits so both are valid.
There's a nice table that illustrates this in the RFC as well.
HTH
Andrew.

Wlc 5508 webauth subnet mask change issue

Recenly l changed the network subnet for a particular wlc interface and scope and also an upstream router and for some reason it would only allow me to use a /24 Host mask as my plan was to go to a /22 mask to allow for over 1000 hosts within this scope.
The Upstream Router which is a ( RV042 ) had the following original config :
     192.168.1.1
     255.255.255.0
I have noticed this device will not let me change the mask from a /24 to a /22 as you can only change from a pre-defined list of masks and you cannot manually add any either..
New Config
     10.10.0.10
     255.255.255.0
WLC 5508 Controller Interface
     Original Config
      192.168.1.25
     255.255.255.0
     192.168.1.1
     New Config
     10.10.0.25
     255.255.252.0
     Scope
     Range : 10.10.1.10 - 10.10.3.254
     Mask : 255.255.252.0
     Network : 10.0.0.0
     Router : 10.10.0.10
When l reconfigure to this addressing the wireless clients connect and get the new dhcp scope details but following this the webauth screen doesn't appear not allowing them to connect meaning there is no routing of traffic / internet access.
If l modify the above interface and scope masks back to a /24 - 255.255.255.0 the the wireless clients connect and webauth appears to prompt them to accept the terms and conditions and connect thus giving them internet access.
It looks like an issue with the mask ? The main reason l am trying to change the subnet addressing is because the standard /24 mask is not providing enough dhcp addresses and we have had times were the scope has been exhausted due to the public connecting and disconnecting as the lease perod of 2 hours holds onto the address before expiring meaning there is not enough available addresses for people to connect.
I would of thought that the upstream router ( RV042 ) even though it is only a /24 mask would still route the traffic coming from a WLC Controller interface with a /22 mask ?
Hopefully someone can suggest a solution ?
Thanks Simon

Hey Scott just getting back to this issue..   If for instance l can modify the wlc interface and Scope to have a /22 mask ( 1022 Hosts ) and my upstream Router ( Cisco RV042 ) can only provide a /24 or higher mask then does that mean l am still limited to a range of 254 hosts ( /24 Mask ) ? Would this mean l need to look into replacing my upstream Cisco RV042 VPN Router ?

Subnet mask 255.255.255.255 assigned to VPN client - can't ping LAN

Similar Messages

Maybe you are looking for