mikem2te wrote: » So to clarify you have an 851 connected to an ASUS ADSL router for the internet connection which all works fine, are you removing the 851 and replacing it with the 2621XM or connecting them up some other way? I have a voice with vlans etc config but it is pretty big, any chance you can put your config up?
essclub wrote: » Yes, correct I am removing the 851. I have been using the tech republic spreadsheet for the 851W.I have tried to use this sheet to generate various configs with no success but I have not saved any of them.I am trying to create the attached network. My 2621XM ix the CME router with FA0/1 connecting to my ASUS ADSL router, fa 0/0.10 172.16.1.1 VOICE VLAN10 and fa 0/0.50 172.16.2.1.Any assistance you can provide would be greatly appreciated as I think I am at the stage where I can’t see the woods for the trees now .my basic 851 cfg is:851W#sh runBuilding configuration...Current configuration : 2474 bytes!version 12.4no service padservice timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname 851W!boot-start-markerboot-end-marker!!no aaa new-model!!dot11 syslog!dot11 ssid WLAN1vlan 1authentication openauthentication key-management wpaguest-modewpa-psk ascii 0 Kurhaus46183a!no ip dhcp use vrf connectedip dhcp excluded-address 192.168.1.1 192.168.1.99!ip dhcp pool internal-netimport allnetwork 192.168.1.0 255.255.255.0default-router 192.168.1.1domain-name nuggetlab.comlease 4!!ip cefno ip domain lookup!!!!!archivelog confighidekeys!!!bridge irb!!interface FastEthernet0spanning-tree portfast!interface FastEthernet1spanning-tree portfast!interface FastEthernet2spanning-tree portfast!interface FastEthernet3spanning-tree portfast!interface FastEthernet4ip address dhcpduplex autospeed autopppoe enable group globalpppoe-client dial-pool-number 1!interface Dot11Radio0no ip addressno dot11 extension aironet!encryption vlan 1 mode ciphers tkip!ssid WLAN1!speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0channel 2462station-role rootno cdp enable!interface Dot11Radio0.1encapsulation dot1Q 1 nativebridge-group 1bridge-group 1 subscriber-loop-controlbridge-group 1 spanning-disabledbridge-group 1 block-unknown-sourceno bridge-group 1 source-learningno bridge-group 1 unicast-flooding!interface Vlan1description INTERNAL_NETWORKno ip addressip nat insideip virtual-reassemblybridge-group 1bridge-group 1 spanning-disabled!interface Dialer1ip address negotiatedip mtu 1492ip nat outsideip virtual-reassemblyencapsulation pppdialer pool 1ppp authentication pap callinppp pap sent-username XXXXXX password XXXXppp ipcp dns request!interface BVI1description BRIDGE_TO_INTERNAL_NETWORKip address 192.168.1.1 255.255.255.0ip nat insideip virtual-reassembly!ip forward-protocol ndip route 0.0.0.0 0.0.0.0 Dialer1!no ip http serverno ip http secure-serverip nat inside source list NAT_ADDRESSES interface Dialer1 overload!ip access-list extended NAT_ADDRESSESpermit ip 192.168.1.0 0.0.0.255 any!!control-plane!bridge 1 route ip!line con 0exec-timeout 0 0logging synchronousno modem enableline aux 0line vty 0 4login!scheduler max-task-time 5000end
mikem2te wrote: » Ah, I just realised my voice and data lan is connected to a HWIC-D-9ESW switch card in my router so it has a switch configuration (trunk and vlans) rather than router on a stick type config. I'll try and get a 2621 fired up later once I've sorted out my vpn issues
essclub wrote: » Great, thanks for that. I have been looking at this too long today anyway my eyes ache and it's late here so I'm going to open a beer and grab the remote control... good luck with the visible panty net.... no that's not it.... Cheers
essclub wrote: » OK, I had some time to try again this morning and saved my config. Where I am at with this config is I am getting an IP on subnet 172.16.2.0, I can ping 4.2.2.2 from the CME router but I cannot get on the web so looks like I have a DNS issue somewhere. ! no ip domain lookup ip name-server 4.2.2.2
laidbackfreak wrote: » you need to enable the "ip domain lookup" command the ip name-server command just specifies the DNS server, without the domain lookup command enabled the router wont even look at this address.
mikem2te wrote: » That might explaing yout NTP server issue as well as I believe IOS looks up the ntp server domain name and then puts the IP address in the config rather than the domain name.
mikem2te wrote: » so some debugging is required yes is your computer picking up a correct ip address from the dhcp router? Yes is the default gateway being set correctly on the computer and can you ping the default gateway? Yes can you tracert 4.2.2.2 from your computer? If it gets stuck ot the first hop then it is a routing/nat issue. I didn't try today.iwill try a trace route first thing tomorrow. I would be inclined to out the ip nat inside sttements under the subinterfaces rather than the top level interface
mikem2te wrote: » So some debugging is required Is your computer picking up a correct IP address from the DHCP router? Is the default gateway being set correctly on the computer and can you ping the default gateway? Can you tracert 4.2.2.2 from your computer? If it gets stuck ot the first hop then it is a routing/NAT issue. I would be inclined to out the IP NAT INSIDE sttements under the subinterfaces rather than the top level interface
hermeszdata wrote: » If you are using a Windows Host, open a command prompt and ipconfig /all this will tell you if your DHCP info is initializing properly. Set your host with static IP, mask, gateway and DNS settings. Try to ping. This will let you know up front if you have DHCP issues. One other thing I would do is set up one of your switch interfaces for dot1q trunking and use that as your router interface. this should not make any real difference, but it is generally good practice as it limits some of the problems associated with static access ports. John EDIT: After looking more closely at your config, I think part of the problem is with your access list. Try adding: permit ip 172.16.1.0 0.0.0.255 any right now, it looks like your are blocking everything except network 172.16.2.0. I am not sure about how the IP Helper address works of if having it overcomes the access-list issue.
essclub wrote: » As soon as I switched the Nat Inside commands from fa0/0 to the subinterfaces everything was tickety boo. Interesting point and one which I will remember for the future!I have pasted the working config below should anyone need it.
mikem2te wrote: » Awesome. Next thing to do is get some security setup on the router-Setup an enable password. Create an ACL and apply it to you VTY lines. Create a firewall.
essclub wrote: » Hi Mike, Yes, I'm not too worried about the aesthetics right now I will tidy things up when i get everything operational. I run in to another problem today when I tried to get my phones to register with CME but no luck It looks like they are not getting DHCP info . My CIPC was fine on the 172.16.2.0 Data Vlan but no joy on the 7912 or 7940. I have wiped the lot and will start afresh tomorrow step by step and see how i get on. I am not sure if I need to factory default my phones as evertyhing has come from Ebay and not proven operational yet. Cheers C
mikem2te wrote: » You could try setting an unused port on your switch to an access port but set the vlan to the voice vlan 'switchport access vlan 10' rather than the data vlan. You could then plug a computer into this port and see if it gets an IP from the voice range, this will kinda test the dhcp process and rule out the phone configs.
essclub wrote: » When I look at the port interfaces individually, it shows that the ports are allocated to voice vlans. Jeremy uses a 3550 in the video for SwitchB so maybe this is due to the difference in hardware? Cheers C
essclub wrote: » Hi Mike, That sounds like a good plan. Thanks for the suggestion. I will try that if after configuring everything again from the top I still have issues. On a side(ish) note, one thing I did wonder about today; in the CBT nuggets voice video, when Jeremy adds the voice vlans a "show vlan brief" shows the ports allocated to each vlan i.e ports 1-4 are in Vlan 10-Voice and also in vlan data-50. On my 2950T switch I only see the ports allocated to the Data vlan-50. When I look at the port interfaces individually, it shows that the ports are allocated to voice vlans. Jeremy uses a 3550 in the video for SwitchB so maybe this is due to the difference in hardware? Cheers C
hermeszdata wrote: » what phones are you using? I know the issues i had when frist setting up my voip lab here. I bought 5 7910s off evilbay and i had a difficult time getting then to aquire ip addresses (vlan issues on my switch and dhcp server config on the router.) generally, if the phones are trying to get an ip address from the network, it is not a phone issue. Hi john, as per my diagram i am using a 7940 and a 7912 and a cipc two things i noticed in the latest config you posted: 1.) you do not have configs for your dhcp servers 2.) telephony-service is not active. Dhcp router config is pasted above the cme voice config above was pasted after my ppoe issue and before i tried to config the phones regarding your switch, sh vlan br will list the ports active on every vlan in the database. As my previous post sh vlan brief oes not show ports allocated to voice vlan but they are shown at interface leve. I am using a combination of 2950, 2950t, and 3550 switches. The config you posted earlier should be good (with the exception of security, it is the same config i am using without issue.) i would look to points 1 & 2 above. In the original config you posted, the dhcp config was there and looked ok. I have atttached the config file for one of the voice routers on my network. Hope this helps. No attachement john
mikem2te wrote: » There doesn't appear to be an 'ip route' on your dhcp router to the voice network. I think it needs this to issue dhcp addressess.
