Need help with CISCO 877 and Cable Modem

[tjcooper72]

My ISP is a Charter, and I am using DHCP. The route is a CISCO 877. The cable modem is plugged in to Fastethernet4 (WAN). I can ping

http://www.google.com

from the router, but I can get to

http://www.google.com

from the LAN (using ping or browser). I can get to the router from the LAN.

Please take a look and tell me what I am doing wrong.

---------

sh run
Building configuration...

Current configuration : 4057 bytes
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname URSI90RTR
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 debugging
logging console critical
enable secret 5 $1$LFeA$iR5f0yx2ahpkfmUsWLxP11
!
no aaa new-model
!
resource policy
!
clock timezone PCTime -8
clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
ip subnet-zero
no ip source-route
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.0.1
!
ip dhcp pool sdm-pool1
import all
network 192.168.0.0 255.255.255.0
default-router 192.168.0.1
dns-server 68.185.32.10 68.185.34.67
!
!
ip tcp synwait-time 10
no ip bootp server
ip name-server 68.185.32.10
ip name-server 68.185.34.67
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
crypto pki trustpoint TP-self-signed-2535400162
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2535400162
revocation-check none
rsakeypair TP-self-signed-2535400162
!
!
crypto pki certificate chain TP-self-signed-2535400162
certificate self-signed 01
30820242 308201AB A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32353335 34303031 3632301E 170D3032 30333031 30303133
33365A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 35333534
30303136 3230819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100DF7C 6A798BD1 CBC85030 5932EF76 5BD8F854 A227ACFE BA27F5D4 FABD7336
7BDBD52D 60AB26D5 BAB4E5CB DDD81C7F AA145FD1 F6E5D76B 57C43B3E 4A6160DF
E71D6EAE AFAAD933 1F5E7073 654BC9FB 0F5D55F5 5EB88BFD A73D12E2 4E4EC369
A6AFC55E D80E611E 78F2F201 26E53B90 E5C9AF75 8630A3A3 9D5424F2 26DD8FFE
5E6B0203 010001A3 6A306830 0F060355 1D130101 FF040530 030101FF 30150603
551D1104 0E300C82 0A555253 49393052 54522E30 1F060355 1D230418 30168014
4B9B9F77 812300EB 4A57682E FA8B3906 EF68139B 301D0603 551D0E04 1604144B
9B9F7781 2300EB4A 57682EFA 8B3906EF 68139B30 0D06092A 864886F7 0D010104
05000381 81003002 AD380ED7 46E79FD5 4BE38820 827453A4 94FEDF40 3D39D664
2EBEFC90 55ECBF6D BC6A8158 FF9BDA69 0C553D50 08A75F24 87A67A82 8F52C846
E3B2B451 2B0CE940 B5CB5C49 FA85DAA6 769155CE BB814984 0C27D414 36AA1CCF
A738FDA1 71100188 7B97EA4F E07BD35E 183E1C62 659286CF E8695FCD 7C797858
55898CFF 79C2
quit
username admin privilege 15 secret 5 $1$qHlH$E338oqxRwT9XicS6FcPgd/
!
!
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description WAN_Link_Charter_DHCP
ip address dhcp client-id FastEthernet4
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
duplex auto
speed auto
!
interface Dot11Radio0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
shutdown
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
ip address 192.168.0.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
ip tcp adjust-mss 1452
!
ip classless
ip route 0.0.0.0 0.0.0.0 FastEthernet4
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
logging trap debugging
no cdp run
!
control-plane
!
banner login ^CAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!^C
!
line con 0
login local
no modem enable
transport output telnet
line aux 0
login local
transport output telnet
line vty 0 4
privilege level 15
login local
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end

----

Thank you,

tjcooper

 

[burtsbees]

router>en
router#conf t
router(config)#access-list 101 permit ip 192.168.0.0 0.0.0.255 any
router(config)#ip nat inside source list 101 int fa4 over
router(config)#int vlan1
router(config-if)#ip nat inside
router(config-if)#no ip tcp adjust-mss 1452
router(config-if)#exit
router(config)#int fa4
router(config-if)#ip nat out
router(config)#ip tcp adjust-mss
router(config-if)#end
router#wr

Burt

 

[burtsbees]

Also, you will need a password on line vty 0 4 in order to ssh to it, and these commands...

router(config)#ip domain-name local
router(config)#crypto key generate rsa

I would pick 1024 bit encryption---it's all you need. 2048 would take longer, but it's super duper very strong!

Burt

 

[tjcooper72]

Thanks!!!

So, by using fa4 we can use DHCP, because it refers to an interface not an ip, right?

Just so I have this down:

We define fa4 as outside and vlan1 as inside.

What does this do:

router(config)#access-list 101 permit ip 192.168.0.0 0.0.0.255 any
router(config)#ip nat inside source list 101 int fa4 over

I understand the access-list. Does it limit the IP that use NAT, and overload means more than one inside IP can be translated to the same outside IP?

Thank you very much for your help and quick response.
tjcooper

 

[burtsbees]

The acl defines which subnet(s) to NAT, and the overload keyword makes it PAT (the same outside IP address can be used to translate many inside IP addresses by assigning a random tcp port to it).

Burt

 

[tjcooper72]

I cant find any info on "Bridge LAN and Wireless Interface" in SDM Express.

I think thats what I want to do, just have a stand-alone AP with WPA PSK. I dont have a radius server, and this connection doesnt need to be very secure.

How do I setup a stand-alone AP with WPA PSK?

 

[burtsbees]

That I could not tell you. Someone else will chime in here, I'm sure...

Burt

 

[tjcooper72]

I think I figured it all out.

It creates BVi1 or something like that which is the bridge "interface".

I then had to make some additional changes.

 

[burtsbees]

That much I knew...lol

Burt