Configuring 857 Router

[MarkHollings]

We currently connect to the internet using a draytek 2600 router and its starting to become quite unreliable. I am not entirely sure how it is currently configured as our ISP password protects the router.

I am off on my hols in a week or so and have purchased a Cisco 857 adsl router which I would like to configure to replace the draytek prior to my departure but I am struggling. I have managed to get the SDM software installed to the 857 and have got some way in getting it configured but I am now getting stuck.

On the network here all internet traffic passes through a Watchguard Firebox X700 and then to/from the draytek router.

I have the IP address and password from my ISP and it seems that the router connects to the ISP ok but cannot then browse the internet etc or even access the 857 when it is swapped out for the draytek.

The internal i/f on the Firebox is 192.168.1.1/24 and the external is xxx.xxx.xxx.42/29. Now this then brings in another problem. Currently the Draytek has the same xxx.xxx.xxx.41 ip address assigned to both internal and external interfaces, can I do the same on the 857 ad if so how? Currently I have set the ip 192.168.1.50 so that I can access it. I had also added a copuple of rules to allow all ip traffic, but I don't know if they are actually neccessary.

Below is the current config from the 857.

Building configuration...

Current configuration : 4051 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname wha
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
enable secret 5 $1$QJEL$BFpnSLR2/XNNe7ZTzEN6R.
!
no aaa new-model
!
resource policy
!
no ip dhcp use vrf connected
ip dhcp excluded-address 10.10.10.1
ip dhcp pool sdm-pool
import all
network 10.10.10.0 255.255.255.248
default-router 10.10.10.1
lease 0 2
!
!
ip cef
no ip domain lookup
ip domain name welmede.org.uk
!
!
crypto pki trustpoint TP-self-signed-1117807241
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1117807241
revocation-check none
rsakeypair TP-self-signed-1117807241
!
!
crypto pki certificate chain TP-self-signed-1117807241
certificate self-signed 01
username admin privilege 15 secret 5 $1$J5ZT$U08sIDLXyh7QvxgdCh2j3.
!
!
interface ATM0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
!
interface ATM0.1 point-to-point
description $ES_WAN$
no snmp trap link-status
pvc 0/38
pppoe-client dial-pool-number 1
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$
ip address 192.168.1.50 255.255.255.0
ip access-group sdm_vlan1_in in
ip access-group sdm_vlan1_out out
ip tcp adjust-mss 1412
!
interface Dialer0
ip address xxx.xxx.xxx.41 255.255.255.248
ip access-group sdm_dialer0_in in
ip access-group sdm_dialer0_out out
ip mtu 1452
encapsulation ppp
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication chap pap callin
ppp chap hostname xxxxxxx@adsl-1.sysonline.net
ppp chap password 0 xxxxxxxxxx
ppp pap sent-username xxxxxxx@adsl-1.sysonline.net password 0 xxxxxxxxx
!
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip access-list extended sdm_dialer0_in
remark SDM_ACL Category=1
permit ip any any
ip access-list extended sdm_dialer0_out
remark SDM_ACL Category=1
permit ip any any
ip access-list extended sdm_vlan1_in
remark SDM_ACL Category=1
permit ip any any
ip access-list extended sdm_vlan1_out
remark SDM_ACL Category=1
permit ip any any
!
dialer-list 1 protocol ip permit
no cdp run
!
control-plane
!
banner login ^CAuthorized access only! Disconnect IMMEDIATELY if you are not an authorized user!^C
!
line con 0
login local
no modem enable
line aux 0
line vty 0 4
privilege level 15
login local
transport input telnet ssh
!
scheduler max-task-time 5000
end

Can anybody advise me how to get this up and running?

Regards

Mark

 

[burtsbees]

Is the ISP router on your premises? I can guide you through a password recovery process that does NOT mess the current config up...that way, you can compare configs.

Burt

 

[MarkHollings]

Yes the isp router is sitting upstairs in my comms cab. It would be very helpful to have the current config.

Thanks

 

[burtsbees]

Console into the router, then power cycle it. Within 30 seconds of it coming back on, initiate a break through the console, and you get to the
rommon1>
prompt.Then...
rommon1>confreg 2142
rommon2>reset
The router comes back on as if it were new---answer no to the first question, and sometimes it asks a second question (do you want to terminate autoinstall, or something...)---answer yes to the second question if it asks. Then hit enter and you get
router>
in a few seconds. Then
router>en
router#copy start run
Then it loads the config. From there you can see it. You can choose to leave the passwords the way they are, but to see the config...
router#sh run
and post that. If you want to leave all passwords intact, you should at least put the config register back to where it was...
router#conf t
router(config)#confreg 0x2102
router(config)#exit
router#wr

Basically, you tell the router to load the default config, like when the router was new, bia changing the config register. Then you change it back to tell it to load the configuration that has been saved by changing the config register back.
Let me know if you want to change the passwords.

Burt

 

[burtsbees]

The entire process should be about 5 minutes or less downtime.

Burt

 

[MarkHollings]

Hi

The current ISP router is the Draytek, can I console on to it?

 

[burtsbees]

Oh crap---I saw 2600, and I thought Cisco. Sorry---don't know password recovery procedures for Draytek...
Does the Watchguard do the NAT then? If not, the 857 needs to NAT...
access-list 101 permit 192.168.1.0.0.0.0.255 any
int Vlan1
ip nat inside
int Di0
ip nat outside
ip nat inside source list 101 int di0 overload

Like that.

Burt

 

[MarkHollings]

Yes the watchguard NATs from 192.168.1.1.24 to static ip XXX.XXX.XXX.42/29 with the default gateway being XXX.XXX.XXX.41

 

[burtsbees]

How do you have the 857 connected to the firewall?

Burt

 

[MarkHollings]

The external interface x.x.x.41/29 on the watchguard is patched into fe0 interface on the 857.

The 857 external interface is then patched onto the adsl microfilter.



Network Firebox X700 857
192.168.0.1 <-> 192.168.1.1 <-> x.x.x.42/29 <-> x.x.x.41/29
NAT

Hope this helps.

 

[burtsbees]

You need the external on the watchguard be 192.168.1.1, and the internal be a different subnet, an internal route between the subnets in the firewall, no NAT config, and let the 857 do the NAT. Right now, you have fa0 configured in VLAN1, which is 192.168.1.0/24, so the firewall does not know how exactly to communicate with the router, much less NAT. Since it cannot NAT this way, your users cannot connect to the internet.

Burt

 

[MarkHollings]

Hi Burt

I got the diagram slightly wrong, but I think I get the jist.

The office network is 192.168.1.0 and the internal ip of the watchguard is 192.168.1.1. The external ip is currently x.x.x.42/29.

What I think you are suggesting is:-
Turn off the NAT on the watchguard, change it's external ip to, say 192.168.8.1, and add a route on the watchguard between the internal and external.

Change the internal ip of the 857 to something like 192.168.8.2, and keep the external x.x.x.41/29 and turn on the NAT.

Cor, all I wanted was to configure up the 857 as a drop-in replacement for the Draytek without having to adjust the entire network configuration! This is getting a wee bit more complicated.

 

[MarkHollings]

Also the WatchGuard acts as the VPN server for the network too and the external ip has to remain set at x.x.x.42 for the remote clients to access it.

 

[burtsbees]

I see...let me rethink this then...

Burt

 

[olbs]

Leave NAT off on the 857, assign an external address in the /29 space to the 857's ethernet interface, make sure there is a default route on the 857 to the DSL interface (Dialer1).

As long as your dialer has the correct PPP details it should work a treat.

 

[MarkHollings]

I wish I could assign assign an external address in the /29 space to the 857's ethernet interface but it says it overlaps with the external interface.

 

[olbs]

Whats your current external IP address's on the Draytek? I would have assumed it would get an IP from the ISP for its Dialer interface as well as having an IP in your /29 range on its ethernet.

Unless the draytek is just a bridge, with the Firebox doing PPP?

 

[MarkHollings]

The external ip on the draytek is the xxx.xxx.xx.41/29 - The Draytek does the PPP.