Cisco 1721 config for new ISP

[monkeyman444]

Hey all,

We just switched ISPs and had to reconfigure our Cisco 1721 router. Everything is up and running again but I'm having trouble with the access lists. As soon as I add anything to the access groups my entire connection no longer works.

I've tried adding the following lines but all traffic stops once they're put in:
access-list 101 permit tcp 192.168.10.0 0.0.0.255 any eq www
-and-
access-list 102 permit tcp any 192.168.10.0 0.0.0.255 established

The below configuration is the current running configuration that works just fine. Although there are no restrictions on traffic. I used Cisco's ConfigMaker to set it up.

Any help would be appreciated.

MM


Current configuration : 1352 bytes
!
version 12.1
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname Cisco1720
!
enable password 7 00030103005F1
!
!
!
!
!
memory-size iomem 20
ip subnet-zero
no ip finger
no ip domain-lookup
!
ip audit notify log
ip audit po max-events 100
ip audit po max-events 100
!
!
!
interface Serial0
no ip address
encapsulation frame-relay
frame-relay lmi-type ansi
!
interface Serial0.1 point-to-point
description connected to Internet
ip address 216.64.1.xxx 255.255.255.252
ip access-group 101 in
ip access-group 102 out
ip nat outside
frame-relay interface-dlci 176 IETF
!
interface FastEthernet0
description connected to EthernetLAN
ip address 192.168.10.254 255.255.255.0
ip nat inside
speed auto
!
router rip
version 2
passive-interface Serial0.1
network 192.168.10.0
no auto-summary
!
ip nat inside source list 1 interface Serial0.1 overload
ip nat inside source static 192.168.10.4 216.64.2.xxx
! the above line is for an excahange server
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0.1
no ip http server
!
logging 192.168.10.3
access-list 1 permit 192.168.10.0 0.0.0.255
snmp-server community public RO
!
line con 0
exec-timeout 0 0
password 7 121E1712160F15
login
!
end

 

[monkeyman444]

argh, my post contained a slight error. It should've read:

access-list 102 permit tcp 192.168.10.0 0.0.0.255 any eq www
-and-
access-list 101 permit tcp any 192.168.10.0 0.0.0.255 established

 

[ChrisAC]

If you only allow port 80 through your router then of course you will not be able to access web sites (presuming that this is your problem). You are not allowing DNS out and so you will not be able to resolve anything.

Chris.


**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[monkeyman444]

Thanks Chris! I added the rest of my required access-list lines and it's working fine now.

 

[lui3]

by default nat will let everything out and nothing in. it is only really necessary to configure ACL when you have ports open with static nat or wish to limit inside users from accessing outside resources.

Lui3
CCNP,CCDA,A+/Net+
Cisco Wireless Specialization

 

[lui3]

let me add to that. it will let in what ever translations are present in the nat table. ie established connections from the inside. it will not allow in new sessions from the outside unless they are setup via static nat statements and allowed via ACLs.

Lui3
CCNP,CCDA,A+/Net+
Cisco Wireless Specialization

 

[lui3]

ok. lets get the actual ip address of the default gateway from the cable modem provider. then instead of

ip route 0.0.0.0 0.0.0.0 ethernet 0

lets try

ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx with x being the ip address of the gateway from dhcp

i think that will work since just sending it out the interface will send it into a point to mulitpoint network and it won't necessarily know who its default gateway should be so its getting lost. if it was a point to point connection that statement would work. my bad. lets try that and see what happens. try pinging a host name and an ip address on the outside instead of checking with internet explorer.

also if you could do a traceroute from a pc and post

as well as a ping from the router using the source address as ethernet 0 source address. that will verify connectivity.

thanks. sorry for the many posts. just working through the problem without being in front of the box is more difficult. we'll get it figured out

try the default route thing first.

Lui3
CCNP,CCDA,A+/Net+
Cisco Wireless Specialization

 

[lui3]

oops wrong thread. disregard

Lui3
CCNP,CCDA,A+/Net+
Cisco Wireless Specialization