1. Object tracking - What am i doing wrong?
Hi all,
I have been trying to get an ISDN circuit to dial up and connect 2x 1841
Cisco routers together if the primary adsl interface fails.
Backgroud:
Main site: 192.168.1.x
Remote Site: 192.168.2.x
VPN to each end over aDSL appears to work fine, no reported issues (not sure
its 100% correct, but it works).
Due to an issue with the DSL connection at the remote site, it has been
decided to introduce an ISDN circuit at each end, so if the dsl fails, then
the sites can connect via ISDN.
ISDN calls must be made from the MAIN site to the remote site.
After asking on this group the other day, it was suggested that the
backup-interface doesnt work that well, and some sort of route object
tracking was needed to perform the fuction correctly.
This is what i have tried to do however its not working I'm sure its only an
access list that is stopping the ISDN dialing up, but I'm not seeing my
mistake at the moment! Can you?
------------------------------------------------------------------------------------------------------
Configuration from Main site (any boring stuff edited out)
aaa new-model
aaa authentication login default local
aaa authentication ppp default local
!
ip sla monitor 1
type echo protocol ipIcmpEcho (ADSL outside interface at remote site)
ip sla monitor schedule 1 life forever start-time now
!
isdn switch-type basic-net3
!
crypto pki trustpoint TP-self-signed-30453xxxxxx
!
!
crypto pki certificate chain TP-self-signed-30453xxxxxx
!
username admin privilege 15 secret
username backup password 7
!
!
track 123 rtr 1 reachability
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key xxxxxxxx address (ADSL outside interface at remote site)
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto map SDM_CMAP_1 1 ipsec-isakmp
set peer (ADSL outside interface at remote site)
set transform-set ESP-3DES-SHA
match address 100
!
!
!
interface FastEthernet0/0
ip address 192.168.1.242 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface ATM0/0/0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
!
interface ATM0/0/0.1 point-to-point
pvc 0/38
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface BRI0/1/0
no ip address
encapsulation ppp
dialer pool-member 2
isdn switch-type basic-net3
isdn point-to-point-setup
ppp authentication chap
!
interface Dialer0
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap callin
ppp chap hostname XXXX@XXXXX.COM
ppp chap password 7
crypto map SDM_CMAP_1
!
interface Dialer2
ip address 172.16.200.2 255.255.255.0
encapsulation ppp
dialer pool 2
dialer idle-timeout 180
dialer string (remote site number)
dialer-group 2
ppp chap hostname backup
ppp chap password 7 (same as password defined above)
!
ip local policy route-map MY_Backup_Policy
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0 track 123
ip route 0.0.0.0 0.0.0.0 Dialer2 100
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 101 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 101 permit ip 192.168.1.0 0.0.0.255 any
access-list 105 permit icmp any host 80.229.86.228 echo
dialer-list 1 protocol ip permit
dialer-list 2 protocol ip permit
route-map MY_Backup_Policy permit 10
match ip address 105
set interface Null0
set ip next-hop (outside interface of this router when connected to adsl)
!
route-map SDM_RMAP_1 permit 1
match ip address 101
!
end
------------------------------------------------------------------------------------------------------
Remote site (remember this just needs to answer the isdn calls from main
site)
aaa new-model
aaa authentication login default local
aaa authentication ppp default local
!
isdn switch-type basic-net3
!
crypto pki trustpoint TP-self-signed-214962xxxx
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-214962xxxx
revocation-check none
rsakeypair TP-self-signed-214962xxxx
!
!
crypto pki certificate chain TP-self-signed-214962xxxx
certificate self-signed 01
!
username admin privilege 15 xxxxxxxxxxxx
username backup password 7 xxxxxxxxxx
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key xxxxxxxxxxx address (main site outside interface)
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto map SDM_CMAP_1 1 ipsec-isakmp
description Tunnel to80.229.44.16
set peer (main site outside interface)
set transform-set ESP-3DES-SHA
match address 100
!
interface FastEthernet0/0
ip address 192.168.2.254 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface ATM0/0/0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
!
interface ATM0/0/0.1 point-to-point
pvc 0/38
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface BRI0/1/0
no ip address
isdn switch-type basic-net3
isdn point-to-point-setup
!
interface Dialer0
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap callin
ppp chap hostname XXXX@XXXXX.COM
ppp chap password 7
crypto map SDM_CMAP_1
!
interface Dialer2
ip address 172.16.200.2 255.255.255.0
encapsulation ppp
dialer pool 2
dialer-group 2
ppp chap hostname backup
ppp chap password 7 (same as password defined above)
!
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0
ip route 0.0.0.0 0.0.0.0 Dialer2 100
!
ip nat inside source route-map SDM_RMAP_1 interface Dialer0 overload
!
access-list 1 permit 192.168.2.0 0.0.0.255
access-list 100 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 101 deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 101 permit ip 192.168.2.0 0.0.0.255 any
dialer-list 1 protocol ip permit
dialer-list 2 protocol ip permit
route-map SDM_RMAP_1 permit 1
match ip address 101
!
end
------------------------------------------------------------------------------------------------------
To show that tracking is working correctly on the MAIN unit, you can see the
following:
#sho track
Track 123
Response Time Reporter 1 reachability
Reachability is Up
1 change, last change 00:00:26
Latest operation return code: OK
Latest RTT (millisecs) 52
Tracked by:
STATIC-IP-ROUTING 0
#sho ip rout
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static
route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 0.0.0.0 to network 0.0.0.0
80.0.0.0/32 is subnetted, 1 subnets
C (outside interface of this router) is directly connected, Dialer0
172.16.0.0/24 is subnetted, 1 subnets
C 172.16.200.0 is directly connected, Dialer2
195.166.128.0/32 is subnetted, 1 subnets <-ISP kit
C 195.166.128.123 is directly connected, Dialer0 <-ISP kit
C 192.168.1.0/24 is directly connected, FastEthernet0/0
S* 0.0.0.0/0 is directly connected, Dialer0
#show ip route track-table
ip route 0.0.0.0 0.0.0.0 Dialer0 track 123 state is [up]
------------------------------------------------------------------------------------------------------
Congtratulations if you have got this far, thanks for taking the time to
read and a triple thanks! if you are able to point out the errors in my way.
Kindest regards
Bob
p.s.
I hope I haven't scared anyone of, I ideally would like to keep this here
(google groups will cache it) so that others can gain information from it
(i'm sure dsl with isdn backup is required by a few people at least! so a
working soultion i'm sure would be welcome)
2. inter vlan routing - What am I doing wrong?
3. Connection SOOO much slower w/ 2KPro vs 98SE - What Am I Doing Wrong???
Well I have just gone thru an arduous 2 day process of adding a HD to my system and setting up Windows 2K Pro. I've pretty much got things up and running except for somewhat of a showstopper (I still have my 98 HD and just put it back in to get online again) Under Win2K my 'same' H/W is pretty pathetic for online connectivity. A) It's VERY SLOW - lots of pauses in the modem 'lights' and definately slower on any of a myriad of speed test sites. Lots of browser 'time-outs' w/ 'not available messages' B) The connection just GOES DEAD and I have to re-dial to start getting anything thru again. This seems to occur pretty randomly - I'm still online but many sites just won't come up at all. C) Can't open up too many windows or it 'dies' (see above) - this is one way to get to 'B' above but by no means the only. (I installed a specific tweak to the registry to help this session limit) D) Even though I connect at the same speeds (mid-40s kbps) as 98 the performance, w/ the pauses etc, is akin to about 20 to 28kbps vs 38 to 45kbps under 98. I found some tweaks and some software to address optimizing MTUs and allowing for multiple browers to be open and such specifically for Windows 2K. Plus lots of good writeups and such - all from speedguide.net. I pretty much followed their tweak and tips to the letter to try and duplicate my current 98SE. But it appears to have at best made modest if any improvement. I also installed the Win2k specific driver from the modem makers site (creative) along w/ a Win2K firmware flash. The HW is 550mhz w/ 256 RAM and a Creative De5621 external serial V.92 modem. Worked great in 98 - now it's dogging online in 2K Pro. I've got SP3 installed so far along w/ DirectX9. It is just soooooo sloooow for downloading SPs and such though! AT this rate it will take a couple weeks! I'm better off downloading the raw updates under 98 and applying them! Well out of desperation I'm back in good ol' 98 at the moment and once again, things are popping crisply w/ 5 IE windows open. I may just have to mark this effort up to a big waste of time as I need much better/consistent online performance and am willing to live w/ the less than stable 98SE if it comes to that. Sorry for the long winded rant here - I'm looking for some info regarding Win2K and modems - what could be some possible culprits or options to pursue here? Maybe this is just typical of 2K Pro? thanks!
4. PIX setting up multiple static routes what am I doing wrong?
5. Cisco 837 NAT not working, what am I doing wrong?
Hi, I have been trying to get my 837 onto the Internet and opening a few ports so that the webserver can be reached from the outside world, but for some reason no traffic will pass the NAT... I can get onto the Internet fine, but no machine can reach the webserver on the inside... Can someone please take a look at my config and tell me what goes wrong here? Thanks, Arnoud PS: I know, it will need some more tuning and closing down, but I want to get it running first... version 12.3 no service pad service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname cisco837 ! enable password XXXXXXXX ! username XXXXXXXX privilege 15 secret 5 XXXXXXXX username XXXXXXXX privilege 15 password 0 XXXXXXXX clock timezone Eindhvn 1 no aaa new-model ip subnet-zero ! no ip domain lookup ip ips po max-events 100 no ftp-server write-enable ! bridge irb ! interface Ethernet0 ip address 10.210.6.249 255.255.255.0 ip nat inside ip virtual-reassembly no ip route-cache no keepalive hold-queue 100 out ! interface ATM0 no ip address no ip route-cache no atm ilmi-keepalive dsl operating-mode auto pvc 0 8/48 encapsulation aal5mux ppp dialer dialer pool-member 1 ! ! interface FastEthernet1 no ip address duplex auto speed auto ! interface FastEthernet2 no ip address duplex auto speed auto ! interface FastEthernet3 no ip address duplex auto speed auto ! interface FastEthernet4 no ip address duplex auto speed auto ! interface Dialer0 ip address negotiated ip nat outside ip virtual-reassembly encapsulation ppp dialer pool 1 dialer-group 1 ppp authentication pap callin ppp pap sent-username XXXXXXXX password 0 XXXXXXXX ! ip classless ip route 0.0.0.0 0.0.0.0 Dialer0 permanent ip route 212.206.95.0 255.255.255.0 10.210.6.254 ! ip http server ip http secure-server ! ip nat inside source list 101 interface Dialer0 overload ip nat inside source static tcp 10.210.6.1 22 [ext-ip] 22 extendable no-alias ip nat inside source static tcp 10.210.6.1 80 [ext-ip] 80 extendable no-alias ! access-list 101 permit ip any any dialer-list 1 protocol ip permit ! ! control-plane ! ! line con 0 exec-timeout 120 0 no modem enable transport preferred all transport output all stopbits 1 line aux 0 transport preferred all transport output all line vty 0 4 exec-timeout 120 0 login local transport preferred all transport input telnet ssh transport output none ! scheduler max-task-time 5000 sntp server 17.254.0.28 end -- Please use my first and last name in the address & remove '.invalid' Mijn voor- en achternaam gebruiken in het adres zonder '.invalid'
6. lengthening CAT5 cable- its done!
7. Cisco 3640 Config NM-16sw Internal Lan Ethernet to Cable Router doing NAT
I have always had my 3640 doing NAT. Now I want to let the ISP's routers that I am connected to do it. My internal network is 192.168.144.96/27 is my 3640 VLAN1 My external networks are: 192.168.1.0/29 ISP1 192.168.1.1 is a router doing nat or it can be configured with Public IPs. 192.168.0.0/29 ISP2 192.168.0.1 is a modem doing nat or it can be configured with Public IPs. What I need to know is how do I get the VLAN traffic to the ISP's routers without doing NAT on th 3640? I have read a little on bridging and it seems like that may be what I need, but I am not sure. The reason I am doing this is because it is my understanding that NAT is completely process switrched and with the current bandwidth that I have available the 3640 can't process switch that many packets. If I am in error and NAT does not have to be processed switched, I would be interested in hearing any input on how to no process switch NAT. Thanks in advance for any help or advice.