Hi, I have a stub network I’m trying to have talk to the outside world, – simple, simple configuration on an 851, and it all looks correct to me, but it does not succeed in routing to the outside world. It can not trace from its own 10 interface to the 132 network…. gets ICMP timeouts…
Here’s the config:
Current configuration : 5457 bytes
!
! Last configuration change at 12:15:34 PCTime Mon Sep 24 2007 by root
! NVRAM config last updated at 13:59:36 PCTime Thu Sep 13 2007 by cisco
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname mezz-gw
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 debugging
logging console critical
enable secret 5 $1$ZhKr$ZFOIy9JkjdA7DhXwVPkdH/
!
no aaa new-model
!
resource policy
!
clock timezone PCTime -8
clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
no ip subnet-zero
no ip source-route
no ip gratuitous-arps
no ip dhcp use vrf connected
ip dhcp excluded-address 10.0.0.1 10.0.0.9
ip dhcp excluded-address 10.0.0.31 10.255.255.254
!
ip dhcp pool sdm-pool1
import all
network 10.0.0.0 255.0.0.0
dns-server 132.239.1.52 128.54.16.2
default-router 10.0.0.1
!
!
ip cef
ip inspect name DEFAULT100 cuseeme
ip inspect name DEFAULT100 ftp
ip inspect name DEFAULT100 h323
ip inspect name DEFAULT100 icmp
ip inspect name DEFAULT100 rcmd
ip inspect name DEFAULT100 realaudio
ip inspect name DEFAULT100 rtsp
ip inspect name DEFAULT100 esmtp
ip inspect name DEFAULT100 sqlnet
ip inspect name DEFAULT100 streamworks
ip inspect name DEFAULT100 tftp
ip inspect name DEFAULT100 tcp
ip inspect name DEFAULT100 udp
ip inspect name DEFAULT100 vdolive
ip tcp synwait-time 10
no ip bootp server
no ip domain lookup
ip domain name ucsd.edu
ip name-server 132.239.1.52
ip name-server 128.54.16.2
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
crypto pki trustpoint TP-self-signed-1513273716
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1513273716
revocation-check none
rsakeypair TP-self-signed-1513273716
!
!
crypto pki certificate chain TP-self-signed-1513273716
certificate self-signed 01
[bunch of hex deleted here]
quit
username root privilege 15 secret 5 $1$oLgw$jviuwuKVifUf6pbLgFG89/
!
!
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description $FW_OUTSIDE$$ES_WAN$
ip address 132.239.4.50 255.255.255.0
duplex auto
speed auto
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
ip address 10.0.0.1 255.0.0.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 132.239.4.1
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip access-list standard DEFAULT100
!
logging trap debugging
access-list 100 remark auto generated by Cisco SDM Express firewall configuratio
n
access-list 100 remark SDM_ACL Category=1
access-list 100 deny ip 132.0.0.0 0.255.255.255 any
access-list 100 deny ip host 255.255.255.255 any
access-list 100 deny ip 127.0.0.0 0.255.255.255 any
access-list 101 deny ip host 255.255.255.255 any
access-list 101 deny ip host 0.0.0.0 any
access-list 101 deny ip any any
no cdp run
!
control-plane
!
banner login ^CAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!^C
!
line con 0
login local
no modem enable
transport output telnet
line aux 0
login local
transport output telnet
line vty 0 4
privilege level 15
login local
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end
