Discussion on:

Configuring the Cisco 851W or 871W: Standard IOS

Do you have experience with the Cisco 851 router? If so, what were your impressions? Share your feedback about the information in this article as well as your opinion of the CLI Configuration Worksheet, which you can download from http://downloads.techrepublic.com.com/abstract.aspx?docid=256394.

My Cisco 871W experience?

Well my experience regarding CISCO was? NONE! Never worked with CLI, but I was adviced to select CISCO to replace some old outdated Routers from Symantec (The could?nt handle the bandwith, and they couldn?t handle all the special wishes to VLAN, WiFi ect..)

Our Compnay have a central site connected to the internet though a 8 Mb/s (actually a 10 Mb/s, but the other 2 Mbit are separated into a dedicated 2 Mb/s VoIP MPLS VPN) though the 8 mbit connection a Cisco 1812W maintains connection to 12 Cisco 871W working as Department / ConstructionSite - Routers.

At every Site there is 2 LAN ports Bridged with a Wireless LAN wich are VPN site-2-site conneted to the central LAN. And 2 other Ports on a different Local LAN segment deperated from the ?Corporate LAN? for guest Access ect. The Guest Lan is likewise bridged with at Guest Wifi LAN. ? So customers can revice a WPA PassCode to access the Internet at our sites.

Basically I would say that I?ll take some time for a Cisco-CLI-Virgin, despite the comfort of Cisco SDM (Secure Device Manager ? A GUI to visually configure the router.). Regardless of the SDM, its almost 100% sure that you have to examine the CLI, to locate bugs that the SDM doesn?t catch.

All of my external sites have Static IP delivered by DHCP, and I only jyst recently discovered that the ?reset configuration? could be altered the meet My needs. Wich means that if the router needs to be reset, If I accedenly locks my self out (Router management access restriction) the Local Users can be instructed to insert paperclip in reset hole, and restart Router holding the clip inserted in 10 seconds. It also means that when a worksite changes, and the router goes to another site, I only have to change the IP adresse in my central Router (1812W) and Its up-and running again.

Generaly I like them. But the manuals located on the web and the internal webserver are a bit limited, and are mainly concentrated on the CLI and to explain
?what-am-I-looking-at, not ?how-can-I-use-it?..

The SDM needs to be praised!! ? the SDM v. 2.3.1 have section enabling the ability to cut and paste parts of the configuration directly in-to a window? Pretty Cool when you need to restore a previously saved backup. Just Paste the Backup Config to a window and hit the ?Replace? button, and the Router replaces the Config, and reboots (well ? once every 3 or 4 times you have to make sure I actually does so, and if not: repeat. - Just make a ping for the router and If it disapears, it booting!!

Now I only have one major problem the GuestWiFi authentication is done by inserting a WPA code in the router, (which mean that I have to be contacted to make it happened) but I would really LOVE it, if I had a central Website where my coworkers could click on a button and recive a timelimited code for Wireless Access on specific Routers. Or maybye a local Website running on the ROuter where an account could login an open an guest account for 2 days or 1 week ect...

The access to the Corporate VPN-LAN ssid (VPN-Site2Site) is made in such a way tha the individual Routers makes a RADIUS Authorization request to my AD, and thereby allows users having ?Dial-In? enabled in my AD, access to WiFI. (that took time to make!!)

Im running the IOS : advipservices9-mz.123-8YI2.bin image on the 871W boxes, and the c181x-advipservicesk9-mz.124-2.T2.bin on my 1812..

I would recommend the 871W, but do spend some time to play with router before hooking up the business though it.

For testing I had the 871W running the central site (10 Site-2-Site), with out any problems for 2 days.

Other great tools for Cisco Backups for a lot of boxes at he same time, which are a must-have is Kiwi CatTool: It will perform configuration backups of many devices at the same time, issue commands via Telnet or SSH to many devices at once, change all your network device passwords in one go. And a whole lot more.. go grab a freewarecopy at http://www.kiwisyslog.com/products.php (limited 2 1 thread, the ?Engineer Single install? version have 10 threads, and can only be running in one instance on the local LAN segment (broadcast Range). But it just what you need If you need the roll back the box to an old configuration.

anyone have a good config that will allow port forwarding to lan ip server, std stuff, dns, smtp, http, etc on a Cisco 851W?

haven't seen any that work.

Thanks

Hope this is in an acceptable forum, this is my current experience with the router.

Admin, if this is in the wrong place could you move it please?

Router is a 871w purchased a while back. Calling Cisco for help is akin to pulling your own teeth with rusty pliers. They are almost Microsoft! >:-(

The reason this all started is that I had had the box sitting around for a while without using it, mainly because I had had headaches with the pervious SDM and couldn't get the box to ping or much of anything else. I couldn't load the sdm because it didn't have enough memory (so the error message said). I got a memory stick to try and alleviate this problem and I decided to work on it again since there was a newer SDM out there. I booted the box and it said that there was no bootable image in flash:/ like I have read about here. I have tried to deal with this with the memory installed and removed with the same results.

With the stick installed it shows 196608 for the memory.
I have tried two different IOS levels:
c870-advsecurityk9-mz.123-14.YT1.bin
and
c870-advsecurityk9-mz.124-11.T1.bin

On each I have gone through the configuration template. On each I have tried to save at Router# using copy run start and also write and write memory. It thinks for a second then shows OK. No error messages. if I do a reload it seems to hold the configuration. If I do a power down restart the system is back to the starting point with nothing that I configured saved.

the and... part

Do I need to upgrade the ROMmon from the 12.3(8)YI to get this to work or would it matter?
Which IOS should I be using? I'm pretty sure I can get one from the guys I bought the box from.
How do I get back to being able to use the SDM since I can't get an IP configured on the switch because it is a L2? I do want to try using the SDM first so I can determine that it was my ignorance and not something physically wrong with the box.

Anybody else had this happen?

I didn't post the configuration because until I can get it to save it doesn't matter.

I have been reading these articles and pouding on this box for 3 or 4 days with no results except frustration with Cisco (the Microsoft of the router hardware world).

If there is an answer here I have not found it. I apologize if this ends up being redundant in some manner.


And one more thing. When I look at the nvram directory I get this:

Directory of nvram:/

120 -rw- 3956 startup-config
121 ---- 1920 private-config
122 -rw- 3956 underlying-config
1 ---- 34 persistent-data
2 -rw- 580 IOS-Self-Sig#3701.cer
3 -rw- 0 ifIndex-table
4 -rw- 580 IOS-Self-Sig#3702.cer
5 -rw- 580 IOS-Self-Sig#3703.cer
6 -rw- 590 IOS-Self-Sig#3704.cer
7 -rw- 580 IOS-Self-Sig#3705.cer
8 -rw- 580 IOS-Self-Sig#3706.cer
9 -rw- 580 IOS-Self-Sig#3707.cer
10 -rw- 579 IOS-Self-Sig#1.cer
11 -rw- 579 IOS-Self-Sig#2.cer
12 -rw- 579 IOS-Self-Sig#3.cer
13 -rw- 579 IOS-Self-Sig#4.cer

131072 bytes total (111832 bytes free)

Shouldn't the startup-config be marked as executable? as in rwx?

I'm losing hair fast here.

TIA for your help,

rlj

I deleted the nvram contents and it let me in. Go figure.

still not saving to nvram. >:-(

it was indeed waving to nvram, however, in rommon it was set to boot to image 2 (default)and for what ever reason that didn't work. I changed it to 3 and it worked.

Now back the configuration battle.

Thanks for your help.

I have teh non wireless version 871. I should be able to simple delete the wireless portions and use the rest of the configs correct?

secondly do you have one of these templates for an aironet 1200's?

Yes, you can just strip the radio interface portion.

Read this guide. Aironet 1200 template included.
http://blogs.techrepublic.com.com/Ou/?p=404

Can point me in the right direction to setup 857w with pppoe ?

I have followed your tutorial to the letter, I believe, and my Wireless Client is dropping 50% of all packets. The Router can ping externally w/o packet loss. I am using the Guest Vlan, but dhcp is assigning address from the Internal Vlan..? Any ideas? Any Help... anyone.

Thanks in advance

Scott B.

Is there a way to configure the Cisco 851W as an access point
only. I have 1 sitting around, and I want to create a small
wireless LAN at our site. My thought was to set up the 851W
as an access point and connect to one of our switches.

Thanks,

Greg

how would this be configured to run on ipv6? i think Cisco specks the 871 to operate with it.

I work for a value added reseller and most of the routers I have been involved with are the older 800 series and the SOHO routers. With those I just needed to work with physical interfaces, or, with the SOHOs interface E0 which was the virtual interface for the physical interfaces on the back.

I just got in my first 857W last week and it is a whole new world. I had your 871 article which was a great help, but, as you mentioned, things do not quite work the same. It took me the better part of three days working out how to get the wired and wireless lans to talk to each other and to the dialer. I would probably would not have made it without the help of your template or a call to Cisco. I was only comfortable using one wireless lan; had I read this article the open and private wireless lans might have been a better solution. To late now the router is at a customer across the state.

I like the new virtual interface setups, but they are very different from the old SOHOs.

So if I'm a total Cisco newb, and want a router for my home to interface with the cable modem, would I benefit at all from the 871W versus the 851W?

Thanks,

B

This is a great article, however, it doesn't explain how to do a setup for any type of broadband connection except for PPPoE. I have a cable modem. How would I configure that?

DHCP and Static IP template due next week. I have the templates but I haven't tested them in the field yet. If you send me a private message, I can email you the template if you want to beta test it.

I don't know what I am doing wrong but when I press the relace button I can't find the info I entered in the variables sheet. So if I can not see it how can I copy/paste it.

I have had my router for over a year and the support with Cisco has expired. I just picked up a new laptop for my wife for Xmas and now I need to enable the wireless on the router. I entered almost all the commands pertaining to the Dot11Radio from the excel work sheet. I can connect to the SSID but I do not get an IP address assigned to me and then Windows XP says I have limited connectivity to the network and I have internet access.

Here is a copy of my config (minus the passwords) I couldn't get it all to copy into notepad, but I think all the important stuff is there. Also if there are any other reccomendations you would make please let me know I will be happy to consider implementing them.

Building configuration...

Current configuration : 5356 bytes
!
version 12.3
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname $A\/aGe_|)r@G0/\/
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
enable secret 5 $1$S/
!
username Moonspell privilege 15 secret 5 $1$a.n/
clock timezone NewYork -5
clock summer-time NewYork date Apr 6 2003 2:00 Oct 26 2003 2:00
aaa new-model
!
!
aaa authentication login local_authen local
aaa authorization exec local_author local
aaa session-id common
ip subnet-zero
no ip source-route
ip dhcp excluded-address 10.10.0.1 10.10.2.0
ip dhcp excluded-address 10.10.3.101 10.10.255.254
!
ip dhcp pool sdm-pool
import all
network 10.10.0.0 255.255.0.0
default-router 10.10.1.1
lease 10 2
!
!
ip cef
ip inspect name SDM_LOW cuseeme
ip inspect name SDM_LOW ftp
ip inspect name SDM_LOW h323
ip inspect name SDM_LOW icmp
ip inspect name SDM_LOW rcmd
ip inspect name SDM_LOW realaudio
ip inspect name SDM_LOW rtsp
ip inspect name SDM_LOW esmtp
ip inspect name SDM_LOW sqlnet
ip inspect name SDM_LOW streamworks
ip inspect name SDM_LOW tftp
ip inspect name SDM_LOW tcp
ip inspect name SDM_LOW udp
ip inspect name SDM_LOW vdolive
ip tcp synwait-time 10
no ip bootp server
no ip domain lookup
ip domain name darksun.wrld
no ftp-server write-enable
!
crypto pki trustpoint tti
revocation-check crl
rsakeypair tti
!
interface Null0
no ip unreachables
!
interface FastEthernet0
no ip address
no cdp enable
!
interface FastEthernet1
no ip address
no cdp enable
!
interface FastEthernet2
no ip address
no cdp enable
!
interface FastEthernet3
no ip address
no cdp enable
!
interface FastEthernet4
description $ES_WAN$$FW_OUTSIDE$
ip address dhcp
ip access-group 101 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip inspect SDM_LOW out
ip nat outside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
no cdp enable
!
interface Dot11Radio0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
!
encryption vlan 1 mode ciphers tkip
speed basic-1.0 basic-2.0 basic-5.5 basic-6.0 basic-9.0 basic-11.0 basic-12.0 b
asic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0
station-role root
no cdp enable
!
interface Dot11Radio0.1
encapsulation dot1Q 1 native
no cdp enable
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
ip address 10.10.1.1 255.255.0.0