Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Trouble shooting Cisco 877 and Eircom DSL
Options
-
04-12-2008 8:42pm#1
Comments
-
-
-
Here is the config. Ive omitted some of the irrelevant inspect statements and verbose ACLS.
Its similar in operation to the basic config I posted earlier with the cryto stuff added.
I fully accept I might be doing something really stupid with this config
But its basicaly the same as one of the other remote offices so I dunno.! ! version 12.4 no service pad service timestamps debug datetime service timestamps log datetime service password-encryption ! hostname routername ! boot-start-marker boot-end-marker ! logging buffered 52000 debugging ! no aaa new-model ! resource policy ! ip subnet-zero ip cef ! ! no ip dhcp use vrf connected ip dhcp excluded-address 172.XX.XX.1 172.XX.XX.10 ip dhcp excluded-address 172.XX.XX.101 172.XX.XX.254 ! ip dhcp pool sdm-pool1 network 172.XX.XX.0 255.255.255.0 dns-server 159.134.237.6 159.134.248.17 default-router 172.XX.XX.1 netbios-name-server 172.XX.XX.10 172.XX.XX.16 lease infinite ! ! ip name-server 159.134.237.6 ip name-server 159.134.248.17 ip inspect log drop-pkt ip inspect name SDM_LOW cuseeme ip inspect name SDM_LOW dns !! REMOVED inspect statements!! ip inspect name SDM_HIGH udp ip ips notify SDEE ! ! username usernamejoe privilege 15 password 0 XXXXXXXXXXXX ! ! class-map match-any sdm_p2p_kazaa match protocol fasttrack match protocol kazaa2 class-map match-any sdm_p2p_edonkey match protocol edonkey class-map match-any sdm_p2p_gnutella match protocol gnutella class-map match-any sdm_p2p_bittorrent match protocol bittorrent ! ! policy-map sdmappfwp2p_SDM_HIGH class sdm_p2p_gnutella drop class sdm_p2p_bittorrent drop class sdm_p2p_edonkey drop class sdm_p2p_kazaa drop ! ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! crypto isakmp policy 1 encryption aes 256 authentication pre-share group 5 crypto isakmp key XXXXXXXXXXXXXXXXXXXXX address 62.77.XXX.XXX ! ! crypto ipsec transform-set ESPNAME esp-aes 256 esp-sha-hmac ! crypto map SDM_CMAP_1 1 ipsec-isakmp set peer 62.77.XX.XX set transform-set ESPNAME match address 102 ! ! ! interface ATM0 no ip address no atm ilmi-keepalive dsl operating-mode auto ! interface ATM0.1 point-to-point pvc 8/35 pppoe-client dial-pool-number 1 ! ! interface FastEthernet0 ! interface FastEthernet1 ! interface FastEthernet2 ! interface FastEthernet3 ! ! interface loopback0 ip address 84.47.XX.XX 255.255.255.255 ! interface Vlan1 description $FW_INSIDE$ ip address 172.XX.XX.1 255.255.255.0 ip access-group 100 in ip nat inside ip virtual-reassembly ip tcp adjust-mss 1452 ! interface Dialer0 description $FW_OUTSIDE$ ip unnumbered Loopback0 ip access-group 104 in ip mtu 1452 ip nat outside ip inspect SDM_HIGH out ip virtual-reassembly encapsulation ppp dialer pool 1 dialer-group 1 dialer string "*09#" ppp authentication chap callin ppp chap hostname eircom ppp chap password 0 broadband1 crypto map SDM_CMAP_1 service-policy input sdmappfwp2p_SDM_HIGH service-policy output sdmappfwp2p_SDM_HIGH ! ip classless ip route 0.0.0.0 0.0.0.0 Dialer0 ! ! ip http server ip http authentication local ip http secure-server ip nat inside source route-map SDM_RMAP_1 interface Dialer0 overload ! access-list 1 remark INSIDE_IF=Vlan1 access-list 1 remark SDM_ACL Category=2 access-list 1 permit 172.XX.XX.0 0.0.0.255 access-list 100 remark auto generated by SDM firewall configuration access-list 100 remark SDM_ACL Category=1 access-list 100 deny ip 84.47.XX.XX 0.0.0.3 any access-list 100 deny ip host 255.255.255.255 any access-list 100 deny ip 127.0.0.0 0.255.255.255 any access-list 100 permit ip any any access-list 101 remark auto generated by SDM firewall configuration access-list 101 remark SDM_ACL Category=1 access-list 101 remark IPSec Rule access-list 101 permit ip 172.XX.XX.0 0.0.0.255 172.XX.XX.0 0.0.0.255 access-list 101 permit udp host 62.77.XX.XX host 84.47.XX.XX eq non500-isakmp access-list 101 permit udp host 62.77.XX.XX host 84.47.XX.XX eq isakmp access-list 101 permit esp host 62.77.XX.XX host 84.47.XX.XX access-list 101 permit ahp host 62.77.XX.XX host 84.47.XX.XX access-list 101 deny ip 172.XX.XX.0 0.0.0.255 any access-list 101 permit icmp any host 84.47.XX.XX echo-reply access-list 101 permit icmp any host 84.47.XX.XX time-exceeded access-list 101 permit icmp any host 84.47.XX.XX unreachable access-list 101 deny ip 10.0.0.0 0.255.255.255 any access-list 101 deny ip 172.16.0.0 0.15.255.255 any access-list 101 deny ip 192.168.0.0 0.0.255.255 any access-list 101 deny ip 127.0.0.0 0.255.255.255 any access-list 101 deny ip host 255.255.255.255 any access-list 101 deny ip host 0.0.0.0 any access-list 101 deny ip any any log access-list 102 remark SDM_ACL Category=4 access-list 102 remark IPSec Rule access-list 102 permit ip 172.XX.XX.0 0.0.0.255 172.XX.XX.0 0.0.0.255 access-list 102 permit ip 172.XX.XX.0 0.0.0.255 172.XX.XX.0 0.0.0.255 access-list 102 permit ip 172.XX.XX.0 0.0.0.255 192.XX.XX.0 0.0.0.255 access-list 103 remark SDM_ACL Category=2 access-list 103 remark IPSec Rule access-list 103 deny ip 172.XX.XX.0 0.0.0.255 172.XX.XX.0 0.0.0.255 access-list 103 deny ip 172.XX.XX.0 0.0.0.255 172.XX.XX.0 0.0.0.255 access-list 103 deny ip 172.XX.XX.0 0.0.0.255 192.XX.XX.0 0.0.0.255 access-list 103 permit ip 172.XX.XX.0 0.0.0.255 any access-list 104 remark auto generated by SDM firewall configuration access-list 104 remark SDM_ACL Category=1 access-list 104 permit udp host 159.134.248.17 eq domain host 84.47.XX.XX access-list 104 permit udp host 159.134.237.6 eq domain host 84.47.XX.XX access-list 104 permit ahp host 62.77.XX.XX host 84.47.XX.XX access-list 104 permit esp host 62.77.XX.XX host 84.47.XX.XX access-list 104 permit udp host 62.77.XX.XX host 84.47.XX.XX eq isakmp access-list 104 permit udp host 62.77.XX.XX host 84.47.XX.XX eq non500-isakmp access-list 104 remark IPSec Rule access-list 104 permit ip 172.XX.XX.0 0.0.0.255 172.XX.XX.0 0.0.0.255 access-list 104 permit ip 172.XX.XX.0 0.0.0.255 172.XX.XX.0 0.0.0.255 access-list 104 permit ip 192.XX.XX.0 0.0.0.255 172.XX.XX.0 0.0.0.255 access-list 104 deny ip 172.XX.XX.0 0.0.0.255 any access-list 104 permit icmp any host 84.47.XX.XX echo-reply access-list 104 permit icmp any host 84.47.XX.XX time-exceeded access-list 104 permit icmp any host 84.47.XX.XX unreachable access-list 104 deny ip 10.0.0.0 0.255.255.255 any access-list 104 deny ip 172.16.0.0 0.15.255.255 any access-list 104 deny ip 192.168.0.0 0.0.255.255 any access-list 104 deny ip 127.0.0.0 0.255.255.255 any access-list 104 deny ip host 255.255.255.255 any access-list 104 deny ip host 0.0.0.0 any access-list 104 deny ip any any log dialer-list 1 protocol ip permit ! route-map SDM_RMAP_1 permit 1 match ip address 103 ! ! control-plane ! ! line con 0 login local no modem enable line aux 0 line vty 0 4 login local transport input all ! scheduler max-task-time 5000 end
0 -
-
-
Advertisement
-
-
-
-
-
-
Advertisement
-
-
Great!All running tickedy boo now.
Bloody ACL's ... bane of my life! BTW have you tried this at all?Some slight issues with broken ACLs blocking IKE (my f*ck up) fixed easy enough.
http://www.winagents.com/en/products/routertweak/
A handy little FREE tool for managing Cisco configs. The real bonus for me is that it allows you to edit/add/delete individual entries in ACL's on the fly without all the tedious cutting and pasting you normally have to go through, unless you use that horrible, nasty SDM abomination Cisco provide.0 -
Great!
Bloody ACL's ... bane of my life! BTW have you tried this at all?
http://www.winagents.com/en/products/routertweak/
A handy little FREE tool for managing Cisco configs. The real bonus for me is that it allows you to edit/add/delete individual entries in ACL's on the fly without all the tedious cutting and pasting you normally have to go through, unless you use that horrible, nasty SDM abomination Cisco provide.
Downloading it now for a look. Cheers.
Yeah ACLs are a pain in the ass. I was doing most of the config through the console cable as I was using it to see the debug messages which doesn't help when pasting stuff in.
Turns out copying the config to the router via tftp didn't wipe the existing ACLs. I'm not sure why this happened. It meant I had to "erase start" reload then copy over the config via tftp to be sure it was right
0 -
-
-
It's a bit difficult to explain, but what you effectively do when you do a "copy tftp: running-config" isn't to overwrite the running config, but to create a kind of "merge" of the two, in the same way as if you'd copied and pasted the complete config to the command line in a terminal session. Some commands will be the same in both configs and have no effect, some will overrule existing ones, but some are cumulative like ACL's and IP addresses on interfaces, so you need to edit the file you're copying and put "no ..." statements in wherever you need to. A bit messy, but apart from copying to the startup-config and issuing a reload, there's not much else you can do.Turns out copying the config to the router via tftp didn't wipe the existing ACLs. I'm not sure why this happened. It meant I had to "erase start" reload then copy over the config via tftp to be sure it was right
Another approach to the ACL problem is to maintain them all offline in separate files. For every ACL, put an equivalent "no access-list xxx" command at the top, and then either tftp them across, or copy and paste the contents to the command line.0 -
-
-
-
-
Advertisement
-
-
![[Deleted User]](/applications/dashboard/design/images/defaulticon.png)
Advertisement