Announcement

Collapse
No announcement yet.

Cisco 857W router config help

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Cisco 857W router config help

    Hello all,

    long time no post, thought it better not to spam the forums

    anyway to businss.

    I have a cisco 857W SOHO router, configured as a DHCP and DNS router, and quite happily dishing out DHCP addresses to 4 client machines, and allowing connection to the internet. BUT I am trying to configure the wireless module on the router, and this is where I am hitting the snag.

    Radio is up, and broadcasting merrily its SSID <NCC1701E> (yes i know....)
    security is fine, and I can see the router, and connect to the router wirelessly, BUT the wireless is reporting limited or no connectivity, and I cannot browse the web.

    I have set the wireless as bridging mode rather than routing mode.

    I m using the latest SDM to configure the router, as I had an issue with SDM express not allowing me save the config

    help would be appreciated, I don't have much hair, and would like to keep the rest rather than pull it out.

  • #2
    Re: Cisco 857W router config help

    Uncle Bob, hello.

    daft question, but are you actually picking up an IP address? On your wireless workstation, I mean. It sounds like you aren't...you might want to run some debugs on the 857W to see where its failing (haven't one here right now, so couldn't tell you exactly what.)


    When you say you have security set up, what exactly?
    WPA? WEP?

    Let us know...config might be good to see.

    As an aside- I had a very similar thing recently with a WEP config on an Aironet
    AP. Turned out I had to set my client workstation to 'open' WEP mode rather
    than shared. Instantly all was well, and I was joined by my close friends Hunky and Dory.

    theterranaut

    Comment


    • #3
      Re: Cisco 857W router config help

      Hi Uncle Bob,
      Can you post your config with passwords removed please?
      It doesn't sound like your wireless devices are getting DHCP, perhaps.
      I'll see if we can help.
      Thanks
      David
      David Davis - Petri Forums Moderator & Video Training Author
      Train Signal - The Global Leader in IT Video Training
      TrainSignalTraining.com - Free IT Training Products
      Personal Websites: HappyRouter.com & VMwareVideos.com

      Comment


      • #4
        Re: Cisco 857W router config help

        Hi David, and all you other chaps,

        so sorry for the delay in replying, I have been pratting around on stage, and rehearsing for panto, and my wife is getting ready to drop our 3rd. then in my spare time (!) working

        as soon as I get a chance I will post up the config, I just ask you all bear with me.

        cheers

        Alex

        Comment


        • #5
          Re: Cisco 857W router config help

          Originally posted by Uncle_Bob View Post
          Hi David, and all you other chaps,

          so sorry for the delay in replying, I have been pratting around on stage, and rehearsing for panto, and my wife is getting ready to drop our 3rd. then in my spare time (!) working

          as soon as I get a chance I will post up the config, I just ask you all bear with me.

          cheers

          Alex
          No worries. Be there for your wife and family, it's more important than all the technology in the world, IMHO.
          Regards,
          Jeremy

          Network Consultant/Engineer
          Baltimore - Washington area and beyond
          www.gma-cpa.com

          Comment


          • #6
            Re: Cisco 857W router config help

            Absolutely. JeremyW is spot on, thats why we do it, after all. We've just (well, 7 weeks ago) had number 2, and everything else just has to take a back seat for our little network and server admins of the future!

            take care all

            theterranaut

            Comment


            • #7
              Re: Cisco 857W router config help

              Did you ever get this resolved?

              Comment


              • #8
                Re: Cisco 857W router config help

                hi Guys and Gals, Really sorry about not replying for ages, time and children do not mix :P

                to recap, the problem is I cannot get the wireless to route through to the adsl connection and gain wireless connectivity to the internet, yet ethernet connectivity is fine and dandy

                here is my config:

                Building configuration...

                Current configuration : 6496 bytes
                !
                version 12.4
                no service pad
                service timestamps debug datetime msec
                service timestamps log datetime msec
                no service password-encryption
                !
                hostname yourname
                !
                boot-start-marker
                boot system flash:c850-advsecurityk9-mz.124-9.T.bin
                boot-end-marker
                !
                logging buffered 51200 warnings
                enable secret 5 $1$tnyo$4rQLbHD9TroOyUIi6GaPI/
                !
                no aaa new-model
                !
                resource policy
                !
                clock timezone PCTime 0
                clock summer-time PCTime date Mar 30 2003 1:00 Oct 26 2003 2:00
                no ip dhcp use vrf connected
                ip dhcp excluded-address 10.10.10.1
                !
                ip dhcp pool sdm-pool
                import all
                network 10.10.10.0 255.255.255.248
                default-router 10.10.10.1
                lease 0 2
                !
                !
                ip cef
                ip inspect name DEFAULT100 cuseeme
                ip inspect name DEFAULT100 ftp
                ip inspect name DEFAULT100 h323
                ip inspect name DEFAULT100 icmp
                ip inspect name DEFAULT100 rcmd
                ip inspect name DEFAULT100 realaudio
                ip inspect name DEFAULT100 rtsp
                ip inspect name DEFAULT100 esmtp
                ip inspect name DEFAULT100 sqlnet
                ip inspect name DEFAULT100 streamworks
                ip inspect name DEFAULT100 tftp
                ip inspect name DEFAULT100 tcp
                ip inspect name DEFAULT100 udp
                ip inspect name DEFAULT100 vdolive
                no ip domain lookup
                ip domain name yourdomain.com
                !
                !
                crypto pki trustpoint TP-self-signed-2825440685
                enrollment selfsigned
                subject-name cn=IOS-Self-Signed-Certificate-2825440685
                revocation-check none
                rsakeypair TP-self-signed-2825440685
                !
                !
                crypto pki certificate chain TP-self-signed-2825440685
                certificate self-signed 01
                3082024F 308201B8 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
                31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
                69666963 6174652D 32383235 34343036 3835301E 170D3032 30333031 30303232
                32315A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
                4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 38323534
                34303638 3530819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
                8100BE5B 21B0C161 EC38A667 378C9EF3 F8518CBF E6025063 4B5E73FB 0624A55B
                15BE4C09 6ECAF461 FA5B4E14 CD70F47B 6AB7F58A 35C7DC09 C2053FC5 488388B4
                7A1FA9E2 7644459E 55E00839 938D17F4 7D312708 F99D02DB B395ACEA 2B7A1C1A
                441B0B7F F41F3DA6 39E1BAC9 5E0371E7 38E0575B 8B05E3E8 21F3DDC6 E7CB1590
                D6710203 010001A3 77307530 0F060355 1D130101 FF040530 030101FF 30220603
                551D1104 1B301982 17796F75 726E616D 652E796F 7572646F 6D61696E 2E636F6D
                301F0603 551D2304 18301680 14F97229 B752B5B1 C9BADFA7 2C7A1CC4 AA0C9788
                BE301D06 03551D0E 04160414 F97229B7 52B5B1C9 BADFA72C 7A1CC4AA 0C9788BE
                300D0609 2A864886 F70D0101 04050003 81810058 2CD71DEE BAACA454 BEA47AE8
                F4D0F5C9 B89917B2 BAE54CDE D96DB46F 6C68468D 5966EAEC B19512FD 02E85E6F
                9D40C59D 65358193 FC68A6F7 C404E5D2 AE3DEB41 9BDB46B0 94932150 CBB4F43B
                781CFBF7 EE985247 E48A253B F1DF8D1E 00774E33 BEA27155 2E33B186 7E86A38A
                245E465C 3A634545 9814121F 8DD12018 D052BE
                quit
                username admin privilege 15 secret 5 $1$2zkP$r2JvPUptQhOQ9uV96jwWh.
                !
                !
                !
                !
                !
                !
                interface ATM0
                no ip address
                no atm ilmi-keepalive
                dsl operating-mode auto
                !
                interface ATM0.1 point-to-point
                description $ES_WAN$
                no snmp trap link-status
                pvc 0/38
                encapsulation aal5mux ppp dialer
                dialer pool-member 1
                !
                !
                interface FastEthernet0
                !
                interface FastEthernet1
                !
                interface FastEthernet2
                !
                interface FastEthernet3
                !
                interface Dot11Radio0
                ip address 192.168.1.1 255.255.255.0
                !
                encryption key 1 size 40bit 0 0102030405 transmit-key
                encryption mode wep mandatory
                !
                ssid alex
                authentication open
                guest-mode
                !
                speed basic-1.0 basic-2.0 basic-5.5 basic-6.0 basic-9.0 basic-11.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0
                station-role root
                !
                interface Vlan1
                description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$FW_INSIDE$
                ip address 10.10.10.1 255.255.255.248
                ip access-group 100 in
                ip nat inside
                ip virtual-reassembly
                ip tcp adjust-mss 1452
                !
                interface Dialer0
                description $FW_OUTSIDE$
                ip address negotiated
                ip access-group 101 in
                ip inspect DEFAULT100 out
                ip nat outside
                ip virtual-reassembly
                encapsulation ppp
                dialer pool 1
                dialer-group 1
                no cdp enable
                ppp authentication chap pap callin
                ppp chap hostname [removed]
                ppp chap password 0 [removed]
                ppp pap sent-username [removed] password 0 [removed]
                !
                ip route 0.0.0.0 0.0.0.0 Dialer0
                !
                ip http server
                ip http authentication local
                ip http secure-server
                ip http timeout-policy idle 60 life 86400 requests 10000
                ip nat inside source list 102 interface Dialer0 overload
                !
                access-list 100 remark auto generated by Cisco SDM Express firewall configuration
                access-list 100 remark SDM_ACL Category=1
                access-list 100 deny ip host 255.255.255.255 any
                access-list 100 deny ip 127.0.0.0 0.255.255.255 any
                access-list 100 permit ip any any
                access-list 101 remark auto generated by Cisco SDM Express firewall configuration
                access-list 101 remark SDM_ACL Category=1
                access-list 101 deny ip 10.10.10.0 0.0.0.7 any
                access-list 101 permit icmp any any echo-reply
                access-list 101 permit icmp any any time-exceeded
                access-list 101 permit icmp any any unreachable
                access-list 101 deny ip 10.0.0.0 0.255.255.255 any
                access-list 101 deny ip 172.16.0.0 0.15.255.255 any
                access-list 101 deny ip 192.168.0.0 0.0.255.255 any
                access-list 101 deny ip 127.0.0.0 0.255.255.255 any
                access-list 101 deny ip host 255.255.255.255 any
                access-list 101 deny ip host 0.0.0.0 any
                access-list 101 deny ip any any
                access-list 102 remark SDM_ACL Category=2
                access-list 102 permit ip 10.10.10.0 0.0.0.7 any
                dialer-list 1 protocol ip permit
                no cdp run
                !
                control-plane
                !
                banner login ^C
                -----------------------------------------------------------------------
                Cisco Router and Security Device Manager (SDM) is installed on this device.
                This feature requires the one-time use of the username "cisco"
                with the password "cisco". The default username and password have a privilege level of 15.

                Please change these publicly known initial credentials using SDM or the IOS CLI.
                Here are the Cisco IOS commands.

                username <myuser> privilege 15 secret 0 <mypassword>
                no username cisco

                Replace <myuser> and <mypassword> with the username and password you want to use.

                For more information about SDM please follow the instructions in the QUICK START
                GUIDE for your router or go to http://www.cisco.com/go/sdm
                -----------------------------------------------------------------------
                ^C
                !
                line con 0
                login local
                no modem enable
                line aux 0
                line vty 0 4

                privilege level 15
                login local
                transport input telnet ssh
                !
                scheduler max-task-time 5000
                end


                now from what i can see, the first change I think needs to put the IP range of the wireless vlan on the same subnet as vlan 1 (i.e. 10.10.10.1/255.255.255.24

                I have done no editing of the router config (bar adsl login info), it is shown as is, but for you clever chaps who can work out passwords from the encrypted ones shown, it will be changed

                currently the router has been taken offline (my client is moving) so it is in my workshop until they are in their new site.

                the biggest bugbear for me is i can build thee required config in SDM express, but it will not allow me to save it to the running config of the router.

                any and all help appreciated!

                and thanks once again for your patience

                UB
                Last edited by Uncle_Bob; 22nd March 2007, 21:11.

                Comment


                • #9
                  Re: Cisco 857W router config help

                  well I think I may have cracked it.

                  here is my new shiny config what I wrote:

                  no service pad
                  service tcp-keepalives-in
                  service tcp-keepalives-out
                  service timestamps debug uptime
                  service timestamps log uptime
                  service password-encryption
                  service sequence-numbers
                  !
                  hostname Routing error
                  !
                  logging buffered 10240 debugging
                  logging console critical
                  !
                  clock timezone PCTime 0
                  clock summer-time PCTime date Mar 30 2003 1:00 Oct 26 2003 2:00
                  !
                  !
                  ip subnet-zero
                  no ip source-route
                  ip domain-name local
                  ip dhcp excluded-address 192.168.1.1 192.168.1.99
                  ip dhcp excluded-address 192.168.1.254
                  !
                  ip dhcp pool dhcppool
                  import all
                  network 192.168.1.0 255.255.255.0
                  default-router 192.168.1.254
                  update arp
                  exit
                  !
                  !
                  ip tcp selective-ack
                  ip tcp timestamp
                  no ip bootp server
                  no ip domain lookup
                  ip inspect name firewall tcp
                  ip inspect name firewall udp
                  ip inspect name firewall cuseeme
                  ip inspect name firewall h323
                  ip inspect name firewall rcmd
                  ip inspect name firewall realaudio
                  ip inspect name firewall streamworks
                  ip inspect name firewall vdolive
                  ip inspect name firewall sqlnet
                  ip inspect name firewall tftp
                  ip inspect name firewall ftp
                  ip inspect name firewall icmp
                  ip inspect name firewall sip
                  ip inspect name firewall esmtp max-data 52428800
                  ip inspect name firewall fragment maximum 256 timeout 1
                  ip inspect name firewall netshow
                  ip inspect name firewall pptp
                  ip inspect name firewall rtsp
                  ip inspect name firewall skinny
                  file verify auto
                  !
                  username [username] privilege 15 secret 5 [Das Password is secret!]
                  !
                  bridge irb
                  !
                  !
                  interface Dot11Radio0
                  no ip address
                  !
                  encryption mode ciphers tkip
                  !
                  ssid Cisco 857W
                  authentication open
                  authentication key-management wpa
                  guest-mode
                  wpa-psk ascii 0102030405
                  !
                  speed basic-1.0 basic-2.0 basic-5.5 basic-6.0 basic-9.0 basic-11.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0
                  no cdp enable
                  bridge-group 1
                  bridge-group 1 subscriber-loop-control
                  bridge-group 1 spanning-disabled
                  bridge-group 1 block-unknown-source
                  no bridge-group 1 source-learning
                  no bridge-group 1 unicast-flooding
                  !
                  interface Vlan1
                  no ip address
                  bridge-group 1
                  bridge-group 1 spanning-disabled
                  !
                  interface bvi1
                  ip address 192.168.1.254 255.255.255.0
                  ip access-group 102 in
                  ip nat inside
                  no ip directed-broadcast
                  exit
                  !
                  interface ATM0
                  dsl operating-mode auto
                  exit
                  !
                  interface ATM0.1 point-to-point
                  pvc 0/100
                  encapsulation aal5mux ppp dialer
                  dialer pool-member 1
                  !
                  exit
                  !
                  interface Dialer0
                  ip address negotiated
                  ip inspect firewall out
                  ip access-group 101 in
                  no ip redirects
                  no ip unreachables
                  ip nat outside
                  encapsulation ppp
                  dialer pool 1
                  dialer-group 1
                  ppp authentication chap pap callin
                  ppp chap hostname [removed]
                  ppp chap password 0 [removed]
                  ppp pap sent-username [removed] password 0 [removed]
                  no cdp enable
                  exit
                  !
                  ip nat inside source list 1 interface Dialer0 overload
                  ip classless
                  ip route 0.0.0.0 0.0.0.0 Dialer0
                  no ip http server
                  !
                  !
                  line vty 0 4
                  access-class 2 in
                  exit
                  !
                  access-list 1 remark The local LAN.
                  access-list 1 permit 192.168.1.0 0.0.0.255
                  !
                  access-list 2 remark Where management can be done from.
                  access-list 2 permit 192.168.1.0 0.0.0.255
                  !
                  access-list 101 remark Traffic allowed to enter the router from the Internet
                  access-list 101 deny ip 0.0.0.0 0.255.255.255 any
                  access-list 101 deny ip 10.0.0.0 0.255.255.255 any
                  access-list 101 deny ip 127.0.0.0 0.255.255.255 any
                  access-list 101 deny ip 169.254.0.0 0.0.255.255 any
                  access-list 101 deny ip 172.16.0.0 0.15.255.255 any
                  access-list 101 deny ip 192.0.2.0 0.0.0.255 any
                  access-list 101 deny ip 192.168.0.0 0.0.255.255 any
                  access-list 101 deny ip 198.18.0.0 0.1.255.255 any
                  access-list 101 deny ip 224.0.0.0 0.15.255.255 any
                  access-list 101 deny ip any host 255.255.255.255
                  access-list 101 permit tcp any any eq 1723
                  access-list 101 permit gre any any
                  access-list 101 deny icmp any any echo
                  access-list 101 deny ip any any log
                  !
                  access-list 102 remark Traffic allowed to enter the router from the Ethernet
                  access-list 102 permit ip any host 192.168.1.254
                  access-list 102 deny ip any host 192.168.1.255
                  access-list 102 deny udp any any eq tftp log
                  access-list 102 deny ip any 0.0.0.0 0.255.255.255 log
                  access-list 102 deny ip any 10.0.0.0 0.255.255.255 log
                  access-list 102 deny ip any 127.0.0.0 0.255.255.255 log
                  access-list 102 deny ip any 169.254.0.0 0.0.255.255 log
                  access-list 102 deny ip any 172.16.0.0 0.15.255.255 log
                  access-list 102 deny ip any 192.0.2.0 0.0.0.255 log
                  access-list 102 deny ip any 192.168.0.0 0.0.255.255 log
                  access-list 102 deny ip any 198.18.0.0 0.1.255.255 log
                  access-list 102 deny udp any any eq 135 log
                  access-list 102 deny tcp any any eq 135 log
                  access-list 102 deny udp any any eq 137 log
                  access-list 102 deny udp any any eq 138 log
                  access-list 102 deny tcp any any eq 445 log
                  access-list 102 permit ip 192.168.1.0 0.0.0.255 any
                  access-list 102 permit ip any host 255.255.255.255
                  access-list 102 deny ip any any log
                  !
                  bridge 1 route ip
                  dialer-list 1 protocol ip permit
                  !
                  banner login ^C
                  -----------------------------------------------------------------------
                  Cisco Router and Security Device Manager (SDM) is installed on this device.
                  This feature requires the one-time use of the username "cisco"
                  with the password "cisco". The default username and password have a privilege level of 15.

                  Please change these publicly known initial credentials using SDM or the IOS CLI.
                  Here are the Cisco IOS commands.

                  username <myuser> privilege 15 secret 0 <mypassword>
                  no username cisco

                  Replace <myuser> and <mypassword> with the username and password you want to use.

                  For more information about SDM please follow the instructions in the QUICK START
                  GUIDE for your router or go to http://www.cisco.com/go/sdm
                  -----------------------------------------------------------------------
                  ^C
                  !
                  interface FastEthernet0
                  no shutdown
                  exit
                  interface FastEthernet1
                  no shutdown
                  exit
                  interface FastEthernet2
                  no shutdown
                  exit
                  interface FastEthernet3
                  no shutdown
                  exit
                  interface vlan1
                  no shutdown
                  exit
                  interface ATM0
                  no shutdown
                  exit
                  interface Dot11Radio0
                  no shutdown
                  exit
                  interface bvi1
                  no shutdown
                  exit
                  crypto key generate rsa general-keys modulus 2048

                  now as I understand it from the differences in this one and the old one for cisco routers to work you need to create 2 separate vlans (e.g. vlan1 and vlan2 (wireless)) you then need to create a BVI (bridging virtual interface) to bridge the 2 together and then route all traffic through the BVI to the Dialler interface

                  i think

                  I have tried this on my test router and it appears to work, insofar as I can browse the web via ethernet (vlan1) and wireless (vlan2) which I think is as good as it needs to get to start with, VPN tunnels and the like will be configured later, but for now...

                  as a side note to this, purely for comedy purposes, this config is verion 1.2 yours truly did forget to add the line user [admin] password [admin] into version 1.1, and whilst it did work, I could not log into the router via telnet (vista does not include hyperterminal ) and playing with rommon mode to reset the config!

                  much thanks for your assistance, and case closed.

                  Uncle Bob / Alex

                  Comment


                  • #10
                    Re: Cisco 857W router config help

                    Hi Bob

                    Just wanted say thanks, your post really saved me tearing my hair out too! You think the SDM would be up to this extremely common task wouldn't you?!

                    Anyway, many thanks.

                    Comment

                    Working...
                    X