VLAN behind DMVPN cannot get to Internet

I have a single Spoke (for now) that I’m testing with, I’m running Phase 2 DMVPN and I have two tunnels built on the Spoke router. Tunnel 10 goes to DC1 and Tunnel 20 goes to DC2.
The Spoke router is sitting behind a normal SoHo Linksys routers and the outside interface Gig0 – is set for IP address dhcp. DC1 -- > tunnel prefix is 10.16.1.0/23 DC2 tunnel prefix is 10.8.1.0/23.
The spoke router is a Cisco 892 – the outside interface (tunnel source) is Gig0. The inside interface is a VLAN 1 which has 8 FE ports. If I source pings to 8.8.8.8 for example from the outside interface traffic takes the default route – through the SoHo router. If I source the traffic from the VLAN 1 interface – it also takes the same route – the default route. If I connect a PC behind the router and trace to 8.8.8.8, first Hop is the VLAN interface and then all traffic is dropped. I do NAT configured with an ACL matching the inside subnet and overloading it to the outside interface of Gig0. Both Hub routers and the Spoke router are sunning EIGRP, the Spoke is obviously configured as an EIGRP Stub.
As for routing – besides EIGRP, I have three static routes configured. One – the default route 0.0.0.0 0.0.0.0 192.168.1.1 – towards the SoHo routers. The other two host based statics basically point each HUB routers public external address to the 192.168.1.1 address of the SoHo router.
Ex: IP route 1.1.1.1 255.255.255.255 192.168.1.1
Ex: IP route 2.2.2.2 255.255.255.255 192.168.1.1
Like I said if I source the traffic towards Googles pub DNS server of 8.8.8.8 from VLAN1’s interface – I get replies. If I add a host behind VLAN – I only get he gateway then traffic is dropped. Also the SoHo router is running DHCP for the inside clients (a /29).
Any help is appreciated – banging my head at this point.
Thanks,
Mike

Hi Karsten,
1. The client does get a valid IP config - When I traceroute out the first hop is the VLAN 1 IP.
2. The Cisco 892 is running DHCP and is servicing clients behind the router.
3.The Client cant build a connection to the internet - half of my issue - When i do my debugs - then source traffic from the VLAN 1 interface the ACL for NAT get's incremented and I can see the debug output. DNS works correctly on the client but Internet traffic is not routing correctly i believe.
4. I'm looking into the reverse patch for the traffic and I assume that might be the issue - I have not enabled statefull inspection but I can try that.
here is the sanitized spoke config:
no ip source-route
no ip dhcp use vrf connected
ip dhcp excluded-address 10.75.1.9
ip dhcp pool HBE
import all
network 10.75.1.8 255.255.255.248
dns-server 10.2.10.11 10.2.10.13
domain-name iceenterprise.com
netbios-name-server 10.2.10.11 10.2.10.13
netbios-node-type h-node
default-router 10.75.1.9
option 242 ascii MCIPADD=10.2.6.73,MCPORT=1719,HTTPSRVR=10.2.10.61,L2Q=1
lease 0 2
ip cef
no ip domain lookup
ip domain name iceenterprise.com
ip multicast-routing
no ipv6 cef
class-map match-any VOIP
match ip dscp ef
match ip dscp cs5
policy-map VOICE-OUT-POLICY
class VOIP
priority 20
class class-default
fair-queue
random-detect dscp-based
crypto isakmp policy 1
encr aes
authentication pre-share
group 2
crypto isakmp key XXXXXXXXXXXXXX address 0.0.0.0 0.0.0.0
crypto ipsec transform-set trans2 esp-aes esp-sha-hmac
mode transport
crypto ipsec profile icedmvpn
set transform-set trans2
interface Tunnel10
bandwidth 1000
ip address 10.6.1.2 255.255.254.0
no ip redirects
ip mtu 1400
ip nhrp authentication XXXXXXXXXXXXXX
ip nhrp map 10.6.1.1 63.241.163.105
ip nhrp map multicast 63.241.163.105
ip nhrp network-id 50
ip nhrp holdtime 300
ip nhrp nhs 10.6.1.1
ip tcp adjust-mss 1360
delay 1000
tunnel source GigabitEthernet0
tunnel mode gre multipoint
tunnel key 100000
tunnel protection ipsec profile icedmvpn shared
interface Tunnel20
bandwidth 1000
ip address 10.8.1.2 255.255.254.0
no ip redirects
ip mtu 1400
ip nhrp authentication XXXXXXXXXXXXXX
ip nhrp map 10.8.1.1 12.152.67.105
ip nhrp map multicast 12.152.67.105
ip nhrp network-id 100
ip nhrp holdtime 300
ip nhrp nhs 10.8.1.1
ip tcp adjust-mss 1360
delay 1000
tunnel source GigabitEthernet0
tunnel mode gre multipoint
tunnel key 100001
tunnel protection ipsec profile icedmvpn shared
interface BRI0
no ip address
encapsulation hdlc
shutdown
isdn termination multidrop
interface FastEthernet0
no ip address
spanning-tree portfast
interface FastEthernet1
no ip address
spanning-tree portfast
interface FastEthernet2
no ip address
spanning-tree portfast
interface FastEthernet3
no ip address
spanning-tree portfast
interface FastEthernet4
no ip address
spanning-tree portfast
interface FastEthernet5
no ip address
spanning-tree portfast
interface FastEthernet6
no ip address
spanning-tree portfast
interface FastEthernet7
no ip address
spanning-tree portfast
interface FastEthernet8
no ip address
duplex auto
speed auto
interface GigabitEthernet0
description PublicFacing Interface
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
no cdp enable
service-policy output VOICE-OUT-POLICY
interface Vlan1
description Private interface
ip address 10.75.1.9 255.255.255.248
ip pim dense-mode
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
router eigrp XXXX
network 10.6.0.0 0.0.1.255
network 10.8.0.0 0.0.1.255
network 10.75.1.8 0.0.0.7
eigrp stub connected
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 95 interface GigabitEthernet0 overload
ip route 0.0.0.0 0.0.0.0 192.168.1.1
ip route 63.241.163.105 255.255.255.255 192.168.1.1
ip route 12.152.67.105 255.255.255.255 192.168.1.1
access-list 95 permit 10.75.1.8 0.0.0.7 log
no cdp run
control-plane
mgcp profile default
line con 0
login local
line aux 0
line vty 0 4
privilege level 15
login local
transport input telnet ssh
line vty 5 15
privilege level 15
login local
transport input telnet ssh
Thanks for the assist - i'm sure it's something simple that I'm missing.
Mike

Similar Messages

HT1695 I cannot get the internet to work on my ipod

I have been using my ipod to access the internet for years. i have been using a netgear router for a while. one day i came home and i could not access the internet. i have signal bars indicating internet. i can go to my router ip address with my ipod and change settings but i cannot get any internet apps to work. my ipod works fine at other places hinting that my router is to blame. all my other wireless devices work in my house so what is causing my ipod to not work. i have unplugged and reset my modem and my router. i have restarted, reset, restored with a backup and finally completely restored my ipod back to the original condition with no luck. there is something i am missing here. p[lease help me

Did you already try to reset the phone by holding the sleep and home button for about 10sec, until the Apple logo comes back again? You will not lose data, but a reset can cure some glitches.
If this does not work, try to set it up as new device, explained in this article:
How to back up your data and set up as a new device
Don't use the backup afterwards, to rule out a software problem. If the camera is working again, restore from the backup.

I installed the new 7.0 on my ipad and now I cannot get my internet connection to work. Any ideas, I have already tried rebooting but no luck. Another useless apple update that doesnt work?

I installed the new 7.0 on my ipad and now I cannot get my internet connection to work. Any ideas, I have already tried rebooting but no luck. Another useless apple update that doesnt work?

1. Turn router off for 30 seconds and on again.
2. Settings>General>Reset>Reset Network Settings.

Since upgrading my iPhone 5 to ios 7, I cannot get the internet, email to work on 3g. I get the message ""could not activate mobile data network. You are not subscribed to a mobile data service". How do I fix it?

Since upgrading my iPhone 5 to ios 7, I cannot get the internet, email to work on 3g. I get the message ""could not activate mobile data network. You are not subscribed to a mobile data service". How do I fix it?
I've contacted o2, tried all of their suggested updates and changes, reset my phone 3 times and still no luck.
Any help appreciated.
Thanks,
Louisa

Hi, l have the same problem, were you able to resolve?

I have a MacBook Pro and all of a sudden I cannot get wireless internet connectivity to my router or any other router, I get connectivity through the ethernet port but not wireless. This was working well till this morning

I have a MacBook Pro and all of a sudden I cannot get wireless internet connectivity to my router or any other router, I get connectivity through the ethernet port but not wireless. This was working well till this morning

BXB1905 wrote:
I tried the Apple diagnostics it did not work.
What do you mean it did not work! What were the results of the diagnostic tests?
Have you contacted your ISP to determine if the problem is on their end?
Have you changed your router channel? Sometimes this resolves wireless problems.
Your profile confirms you are using Lion. Check out the following:
Troubleshooting Wi-Fi issues in OS X Lion and Mac OS X v10.6
Configuring 802.1X in Mac OS X Lion and Later

HT201415 i have just updated my 3gs iphone to ios 6 and now cannot get the internet on, any sugestions

i have just updated my 3gs iphone and now i cannot get any internet ,any sugestions ..

Are you unable to access the Internet via wifi, or cellular? What troubleshooting have you done. Check the manual for the troubleshooting proceedures, power off/on, reset, restore. http://manuals.info.apple.com/en_US/iphone_user_guide.pdf

My safari has stopped working and cannot get into internet

On my Imac (mountain lion v 10.8.5) will not open my Safari browser any more. And I cannot get into the internet. I was told to do "recovery" but they want a registration which I don't have because I bought the computer used. Any ideas?

Giving away / Selling your Mac / Resetting the computer to the factory condition
http://support.apple.com/kb/HT5189
http://www.thesafemac.com/how-to-prepare-your-mac-for-sale/

Cannot get to Internet

The AppleTV menu has completely changed in last few weeks. I can no longer see the Internet button/link. I do see icons for Netflick and other specific Internet sites and they are working, but I cannot get to the Internet itself to enter a URL of my choice? Iam trying to connect to a site that is streaming live content.

The Apple TV does not have a web browser. It never has. You would need to use airplay or mirror with a compatible device.

Cannot get to internet via wireless wrt54gc

If I try to get from wired computer, all ok. from wireless laptop I can get only router's administration pages, but cannot pass to internet.
both computers connected simultaneously
pls help!

check if you have your ip address comfigured manually on the wireless laptop..
use your wireless computer
go to control panel and go to network connections
right-click on the wireless network connection icon and click properties..
look for internet protocol(tcp/ip) - highlight that and click on the properties button
set it to obtain IP address automatically and obtain DNS servers automatically..

I'm setting up my Time Capsule for the first time and cannot get an internet connection throughWAN connection

I'm setting up my Time Capsule for the first time and can't get an internet connection via ethernet cord

So new AC model TC??
What modem is it? Pure cable modem .. did you power cycle the modem ( OFF for at least 30min..)??
This is essential to lose the old setup and start afresh.
How have you setup the TC?
Did you try just bridge to existing router? If it doesn't get an IP and you just bought it, possible it is faulty.
Lots more details.. really important things like did the ethernet connectivity leds go on.. both the TC port and the modem port - front ethernet indicator should light up..

New iPad cannot get Wifi internet

I am trying to help a friend with her new iPad. She is logged into my wireless network, the same router that I am accessing this forum with, and her iPad cannot see the internet. Error messages state "You are not connected to the internet." My Mac Pro is all over the internet via the same router. What gives? The iPad sees the net just fine via LTE.

Hello Gary,
It sounds like you're not able to access the Internet on your friend's iPad using Wi-Fi. I found a couple of resources that will help troubleshoot Wi-Fi issues on the iPhone:
Joining and troubleshooting Wi-Fi networks
https://www.apple.com/support/ipad/assistant/wifi/
iOS: Troubleshooting Wi-Fi networks and connections
http://support.apple.com/kb/ts1398
Thank you for posting in the Apple Support Communities.
Best,
Sheila M.

Just hooked up wrt160n, Cannot get to internet settings

I cannot seem to get to settings, Iam blocked from most sites, any advice

Are you trying to setup up the router...?
If your Internet Service Provider is Cable follow this link
If your Internet Service Provider is DSL follow this link

Cannot get an internet connection yet I still have 4G. How do I resolve this?

CCannot get internet connection to use my apps. Yet I still have a 4G connection. What so I do to resolve this.
Thanks

Talk to your service provider. There may be a problem either with your service plan, or their data service.
Other than that, you can reboot the iPhone and see if that clears it.
Hold down on the home and power/sleep buttons together until the Apple logo shows up. may take 10 to 15 seconds.
No data should be lost.

Wireless clients cannot get to internet

Hi All,
I'm fairly new to networking and have been trying to troubleshoot an issue with my home lab.
I have a Cisco 2800 router with 2 interfaces, gig0/0 that is the "external" interface and gets an IP via DHCP, and gig0/1 that is the internal interface with IP 10.10.10.1 and a DHCP pool of 10.10.10.100 - 10.10.10.254. A nat pool containing the external interface IP (192.168.1.110) exists.
Current configuration : 3229 bytes
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname Router
boot-start-marker
boot-end-marker
no aaa new-model
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 10.10.10.1 10.10.10.99
ip dhcp pool dpool1
import all
network 10.10.10.0 255.255.255.0
dns-server 8.8.8.8 8.8.4.4
default-router 10.10.10.1
ip domain name home.local
ip name-server 8.8.8.8
ip name-server 8.8.4.4
multilink bundle-name authenticated
interface GigabitEthernet0/0
ip address dhcp
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
interface GigabitEthernet0/1
ip address 10.10.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
no mop enabled
interface FastEthernet0/3/0
shutdown
interface FastEthernet0/3/1
shutdown
interface FastEthernet0/3/2
shutdown
interface FastEthernet0/3/3
shutdown
interface Vlan1
no ip address
shutdown
ip http server
ip http authentication local
ip http secure-server
ip nat pool ovrld 192.168.1.110 192.168.1.110 prefix-length 30
ip nat inside source list 1 pool ovrld
access-list 1 permit 10.10.10.0 0.0.0.255
snmp-server community public RO
control-plane
scheduler allocate 20000 1000
end
Coming off the internal interface is a 3750, and attached to that 3750 is a 4400 Wireless Lan Controller.
I'm able to create a wireless network that uses the router for DHCP and clients can connect to this wireless network and obtain an IP from that DHCP pool. The wireless clients can ping the default gateway (10.10.10.1) as well as every other device on that network, including hard-wired devices on the 3750. The arp table on the router also shows the wireless clients.
However, only clients connected via ethernet can access the outside (internet), wireless clients, who appear to get the exact same network config, are unable to access the internet they can only access other devices on that 10.10.10.0 network.
So I'm confused as to why with what appears to be the proper default gateway (10.10.10.1) and a valid IP from the router, what could be broken so hard-wired clients can NAT to the outside while wireless clients can't? I can't find any setting on the WLC 4400 that would be restricting wireless clients from leaving the local network.
Any clarification on my issue/my understanding of the problem would be greatly appreciated. Cheers!

Hello smorrissey,
May I ask, how many end devices do you have connected to the switch? And if you tried to connect wireless clients simultaneously with wired devices?
Because from your config it seems you're using only dynamic NAT:
ip nat inside source list 1 pool ovrld // this command will translate IP picked by ACL 1 to address in pool named ovrld. Because you have only 1 address in this pool, only 1 inside device will be able to communicate with outside world (Internet) at a time.
I would suggest to add keyword "overload" at the end of this command (ip nat inside source list 1 pool ovrld overload) to enable PAT, which will allow multiple LAN devices to use 1 outside address at the same time thanks to port address translation.
Hope this will help.
Michal

Cannot get my internet connection to work

I connected my IPad to our wireless internet and it was working, now it will not work. I don't know what to do to get it working again. It says it is connected and shows a full signal, but when I try to access the internet it says I'm not connected
Twyla

If you can't surf the web with Safari, tap Settings / General / Reset / Reset Network Settings. Restart the iPad.
If that doesn't help, try here: Apple - Support - iPad - Wi-Fi

VLAN behind DMVPN cannot get to Internet

Similar Messages

Maybe you are looking for