Cisco WAN :: 1841 Connection Between ISP And Firewall
Apr 2, 2012
I have a Cisco 1841 serving as a connection between my ISP and my Firewall (non Cisco).
I seem to be having performance issues with my traffic going through the Router.HTTP (web browsing) is fine andI get my download rate as I would expect for a 10mbps connection.But anything to do with my VPNs I find a delay when sending via the 1841.(all my VPNs are managed by my Firewall and I have never had problems with those).
I also have a legacy ADSL connection to my firewall, which bypasses the 1841 and I am having no issues on that at all.If anything it is quicker! Which is madness as my Fibre should out-perform it easily.This leads me to believe the issue is not with the Firewall.
My 1841 is very simply setup, 2 fa interfaces with simply a default gateway setup within it.Which leads me to ask if I need more static routes in or a dynamic route protocol setup?
View 4 Replies
ADVERTISEMENT
Nov 11, 2012
The other day I set up a firewall on my Cisco 1841 router, it all seems to work fine except for a few small problems. 2 wireless devices an iPhone and an Android tablet are having some problems with 1 or 2 apps. iPhone 6.0.1 Facebook app and the App store will not load Android tablet ICS BBC iPlayer and Google play app store wont load or play content. Both devices with their issue were working fine until the new firewall was installed. I’ve tried opening ports and adding ACLs but nothing seems to work. I’ve included my start up config. All other PCs, laptops, smartphones and iPads work fine.
Building configuration...
Current configuration : 5551 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
[code].....
View 3 Replies
View Related
Jan 3, 2013
I have a cisco 1841 router , and i want to configure zone based firewall on it. But the document of zone based firewall only said that "after 12.4(6)T" can support zone based firewall. I use the ios " c1841-ipbasek9-mz.124-15.T9.bin ", but it can't support ZFW. What kind of ios support ZFW. for example: ipbase, ent base, ip service ,advent etc.
View 2 Replies
View Related
Feb 13, 2012
What is the best way to deploy the IOS firewall feature?I have a Cisco 1841 router running 12.4.
View 4 Replies
View Related
Feb 12, 2011
i am trying to make site to site VPN on cisco 1841 router using SDM , but I faced a strange problem . I successfully install sdm , internet browser , disabled block pop up , and java . i successfully can run SDM and configure the router using it .
BUT\ when I select VPN>>Site to site VPN >>Create Site to Site VPN tap >> and Press on Lanuch the selected task to start the creation process using the wizard Unfortunately it is not working ,, I don't know why ?
I tried with another PC , another SDM version , another browser .
View 2 Replies
View Related
Jul 3, 2011
I'm trying to backup my primary WAN with secondary backup connection - 3G WAN through Cellular 0/0/0.Point is that I need to track some external IP address on my primary interface, for examle 8.8.8.8. If it is not reacheable, then router brings up backup connection - 3G. This can be done by using dialer-watcher.Simple.But unfortunately my primary WAN interface is an FastEthernet, which is the coonected to a switch, switch to WAN . There is no dialer-watch commands on it. Thats sad .
One more time :
WAN -> SWITCH -> ROUTER(WITH 3G HWIC and Fa 0/0 connected to switch).
View 4 Replies
View Related
Feb 7, 2011
I am facing problem when trying to establish VPN connection between ASA and 1841 router. Peer comes up but traffic is encrypt and decrypt. when assign route (ip route 192.168.x.0 255.255.255.0 fa0/0) to remote local subnet there is a traffic but one reply and one drop
ping from
192.168.y.62
-------------------------------------------------
Reply from 192.168.x.55: bytes=32 time=493ms TTL=127Request timed out.Reply from 192.168.x.55: bytes=32 time=633ms TTL=127Request timed out.Reply from 192.168.x.55: bytes=32 time=375ms TTL=127Request timed out.Reply from 192.168.x.55: bytes=32 time=528ms TTL=127Request timed out.
[code].....
View 1 Replies
View Related
Feb 15, 2011
I've to realize a VPN (ipsec) between 2 side that use a Router Cisco 1841, each one with its own public IP.The 2 side can ping each one with Public IP but the VPN are in DOWN's state.The schema is the following:
192.168.1.0/24 (LAN1) <-> Ro1 (X.X.X.X) <- VPN -> (Y.Y.Y.Y) Ro2 <-> 192.168.2.0/24 (LAN2)
the configuration of Ro1 is showed of following, the same configuration is present also in Ro2 but with different IP address
sh runBuilding configuration...Current configuration : 9808 bytes!version 12.4service timestamps debug datetime msecservice timestamps log datetime msecservice password-encryption!hostname TEST!boot-start-markerboot system flash c1841-adventerprisek9-mz.124-24.T.binboot-end-marker!logging message-counter sysloglogging buffered 51200 warnings!no aaa new-modeldot11 syslogno ip source-route!!! !ip cefno ip bootp serverip domain name test.itip name-server x.x.x.xip name-server x.x.x.xip inspect log drop-pktip inspect max-incomplete low 300ip inspect max-incomplete high 400ip inspect one-minute low 300ip inspect hashtable-size 2048ip inspect tcp synwait-time 20ip inspect tcp max-incomplete host 300 block-time 60ip inspect name IDS tcpip inspect name IDS udpip inspect name IDS ftpno ipv6 cef!multilink bundle-name
[code]....
so, of following the screen of the answer of these commands.
Ro1(config)# sh crypto session Crypto session current statusInterface: Serial0/0/0.1Session status: DOWNPeer: 81.21.17.146 port 500 IPSEC FLOW: permit ip 192.168.1.0/255.255.255.0 192.168.2.0/255.255.255.0 Active SAs: 0, origin: crypto mapRo1(config)# sh crypto map interface serial 0/0/0.1Crypto Map "VPN" 1 ipsec-isakmp Peer = Y.Y.Y.Y Extended IP access list 150 access-list 150 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 Current peer: Y.Y.Y.Y Security association lifetime: 4608000 kilobytes/86400 seconds Responder-Only (Y/N): N PFS (Y/N): N Transform sets={ VPN-SET: { esp-3des esp-sha-hmac } , } Interfaces using crypto map VPN: Serial0/0/0.1
View 14 Replies
View Related
Dec 26, 2012
I need some clarification if it is possible to do an IPL connection between Cisco 2801 (T1) to Cisco 1841 (E1) via Ethernet (2801) to Serial (1841).
I am unable to find any documentation about this and I need to connect our network to our overseas office.
Our side uses the 1841 router and our provider has set-up our E1 connection to be via Serial interface while on our overseas office uses the 2801 and will connect via the T1 card, which by the way does not have any serial interface ports just ethernets.
So far checking on how to configure this, I am unsure on how the connection will happen since the info that I got is that T1 does not have the option to hold an IP address (also unsure on this though). With this in mind and that the 2801 does not have serial interfaces, does that mean that IPL connection would be via the available Ethernet ports?
View 11 Replies
View Related
Oct 20, 2012
In my company, we have two Internet connections, one for VPN and the other for emails and browsing. I have Cisco 1841 router with dual ADSL links, and also it's conntected to ASA and the other PIX. through one physical interface (vlan 1and vlan 2). The PIX firewall is connected to users, and the ASA is for VPN only.How can I seperate the traffic is going for emails and browsing and the vpn traffic. I have got to the point, that the router is configured for both ADSL connections, and I also configured the access-list and route-map in the router, the thing is when both ADSL configured together none of them works.
View 1 Replies
View Related
Feb 27, 2012
I am trying to figure out how to use a Cisco 1841 IOS router to take traffic from one interface and source NAT it out towards the Internet on one interface and at the same time NOT perform NAT when sending the traffic towards a different routed interface.
Here the RemoteSite has connectivity back to the MainCampus, but there is no need to NAT traffic from the one site to the other. They share the same umbrella of address space. However, the RemoteSite needs to have its Internet-bound traffic NAT'ed out to the Public Internet via a third interface. I know that I could just NAT everything out from the Remote Site and map the traffic back onto the same address space for intra-campus communication, but I'd rather avoid that and just NAT where I need to NAT it to the Internet.
I do have a caveat here: in the event that either the MainCampus or the Public Internet interfaces go down, I would like to failover traffic from the downed link to other good link. For example, I want to NAT all traffic (including "intra-campus" traffic) out via the Public Internet if the direct link to the MainCampus is down. For the other example, if the Public Internet direct link is down, I would just send out all traffic without NAT towards the MainCampus.
View 1 Replies
View Related
Apr 9, 2013
I tried to connect a 1841 to a Linksys with a static route. I am able to ping from a computer in the 1841 to a computer in the linksys network, but I can't ping from a computer in the Linksys network to a computer in the 1841 network?
View 7 Replies
View Related
Jul 29, 2012
How to configure leased line from the ONT connection on Cisco 1841 router . there have public IPs on the interfaces fa0/0 & fa0/1.
View 4 Replies
View Related
Apr 28, 2009
This is only a small portion of our network but my question is, can these 1841 routers handle a 45Meg connection? I thought these routers were designed for T1/E1 type speeds. I know I saw a router performance document somewhere that showed 1841's could handle 38.4MB of traffic and that is only with routing turned on. If anything else is enabled, like access lists, NetFlow or whatever, that number will decrease because of the capacity of the router. Am I correct in these statements? Any document or anything else that shows performance of these routers?
View 14 Replies
View Related
Jul 2, 2012
We have an ADSL2+ line from a WIC in a 1841, everything has been fine for the last few years and then the last few months the connection going down. When checking the interfaces the ATM0/0/0 is up up and the same for the dialer interface we are using, they are both up/up, but this still needs a reload of the router to be functional again, shutting the interfaces does not bring the connection back up.
I am not an expert on ADSL lines, I have never really had a problem with anything previously. The router was running Netflow to a network monitor wondering if this or logging was causing an issue with entries in the buffer??
Here is an output of show dsl int, would change the firmware, it has been fine all this time before though we are running IOS 12.4(24)T1 advseck9-m, as far as I can seen from our ISP the config for ADSL is all correct. [Code]
View 4 Replies
View Related
May 21, 2012
I have two 1841's connect to the Internet via DSL;
fa0/0 --- 1841-R1 --- DSL1 ---------------------[INTERNET]--------------------- DSL1 --- 1841-R2 --- fa0/0
I am on the LAN attached to fa0/0 on R1 and I need layer 2 connectivity to a device on fa0/0 on R2. I'm not sure if this is possible with 1841's or not? I made a GRE tunnel between the two and was going to add a BVI and bridge the tunnel at each end with fa0/0 at eah end, but the 1841's don't support BVIs so I'm a bit stumped here! Would L2TP work here?
R2 is a remote router running C1841-SPSERVICESK9-M. R1 is local running C1841-ADVENTERPRISEK9-M. I can't change the remote router so if the answer is not support in C1841-SPSERVICESK9-M I won't be able to do this.
View 3 Replies
View Related
Feb 11, 2013
Configuring Cisco 1841 router and firewall.My provider has put their equipment and given me 2 subnets with public ip address. I am used to getting just one Subnet and connecting my firewall straight to the hand off. But in this case I am a bit confused. I assume I will need to put a router and configure it with before I connect my firewall. [code] I also have a firewall that I would like to be on the subnet 2 at 200.xxx.97.130 and have my private network 192.168.xxx.xxx behind it.
View 2 Replies
View Related
Apr 6, 2011
I have configured a Cisco router. I am able to ping google from rotuer. I can ping my local IP from router and router local IP to my machine. But I can not access internet on machine. I can not ping google and any other IP out of network.
View 11 Replies
View Related
Nov 27, 2011
I have a Cisco 1841 router with an HWIC-ADSL module installed. My ADSL connection is PPPoA with a dialer interface and I have been provided 6 ip's from my provider to use on this service. Previously I have connected Fa0/0 on the 1841 straight onto my network and used NAT and ACL's on the 1841, I would now like to change this and have Fa0/0 connected to a Palo Alto firewall and use the Palo Alto to provide NAT, Firewall & site to site VPN functions. What config would I require on the 1841 to allow me to use one of my ISP IP addresses on the Palo Alto to allow it to be a VPN endpoint? Do I need to configure the 1841 in bridge mode?
View 3 Replies
View Related
Aug 26, 2012
Our company has a Cisco 1841 router which provides our connection to the outside world. We also have a windows server which provides our DHCP and DNS services. Our workstations which also get their lease from the server (using DHCP) do have a connection to the outside world.
when we connect a new computer or other device to the network we can only ping as far as the inside interface of the router. But when we assign the ip settings staticly we do get a connection, even if we configure it with the exact same ip as a lease it got a few seconds ago.
[code]...
View 21 Replies
View Related
Apr 21, 2013
I am trying to figure out how this works. I have an ISP device that connects to my 1841. ISP and fa0/0 hold the /30 WAN addresses. Fa0/1 hold one of the public IPs, lets say 1.1.1.1/29. Then the outside interface of the ASA holds 1.1.1.2/29. Now I have two routes in the 1841, one for default route going back to the ISP device, and a route for the 1.1.1.0/29 network going to the ASA.Now I have 4 more publics I can use 1.1.1.3 - 6. I do not want to assign these IPs to the servers, but yet just NAT them. I know this is possible, but cant figureI took an internal host and did a one to one static NAT from private to public. Packet tracer says my NAT rules are ok. Allowed all IP traffic for testing and still can't ping the server.
View 3 Replies
View Related
Jul 15, 2011
I am going to design one network. I had queries with this design.Let me explain scenario first( it was attached below).I have two sites, Site-A and Site-B, repectively.
In site-A i have one Cisco 1841 router, one Cisco ASA 5510 firewall and One cisco 3560 layer 3 switch.
in site-B i have one Cisco 1841 router, one Cisco ASA 5505 firewall and One Cisco 3560 layer 3 switch.
From ISP side
I have point-to-point leased line between sites A and B. And both sites have internet connectivity from another ISP.
I planned to terminate leased line in cisco 1841 router in both branches for branch to branch connectivity.
I will configure site to site VPN between two sites, A and B.
Here my query was i want make VPN as failover connectivity if leased line fails. In both the cases, i need internet to the inside users in both sides.
Summary requirement:Leased line is Primary and VPN is Back-up, if leased line fails. In both cases internet is needed to inside users.
View 3 Replies
View Related
May 9, 2013
my 1841 router can't resolve dns after enable ios firewall, I try to ping google.com from router's console fail, but dns resolution is fine from lan side.
my partial config---------------------------------
!
ip name-server 8.8.8.8
[Code].....
View 10 Replies
View Related
Jul 11, 2012
I have a big problem with my Cisco 1841 and the WIC-1AM-V2 in Slot 0.I got the task, to test if it is possible, to build up a connection (Dial on Demand Routing) to a remote modem, which is connected to a console port of another Cisco 1841, with the integrated modem card over POTS from the CLI of the router. My router will only dial out to the remote modems and only if its needed.I am connected to the router with the integrated modem card over a console cable on the console port. The remote modem is also connected to the console port of the remote Cisco 1841.
I found out, with my Dialer Profile configuration, it is possible to build up a connection. I configured a dialer list, that specifies that all ip traffic is permitted an interesting for my dialer interface. So a telnet or ping brings up my dialer, which brings up my Async interface. With the "show line" command, I can see that the TTY line, connected with the Async0/0/0 Interface is in use for 5 minutes, because of the "exec-timeout 5 0", which is configured on the remote router. Now the problem is, in this 5 minutes, I can not use a remote telnet on this line with my loopback interface, because the line is already in use and I get a "connection refused". The first telnet I use runs in a timeout, because the remote host is not responding. When I dial out directly from the modem card and not from the CLI with the AT-commands, I get also the connection and with a return i get the login prompt. I will post my actual config, so that you can see maybe a mistake I did or which command I must use, to get a working connection. [code]
View 6 Replies
View Related
Jun 17, 2012
I would like to set up a POTS Dial connection between 2 Cisco routers, using the modem card WIC-1AM-V2. I'd like to use this as an out-of-band connection to a remote site, if the primary internet connection fails. So, this setup will only be used in one direction, 1 router placing calls, the other one receiving calls.Here's my config of the receiving router:
chat-script dial "" ATZ AT OK "ATX3D T" ATS0=8 TIMEOUT 120 CONNECT C
interface Async0/2/0 description out of band for network no ip address encapsulation slip async mode interactive
line 0/2/0 session-timeout 5 absolute-timeout 10 script connection dial login local modem InOut transport input all escape-character BREAK autoselect ppp stopbits 1 speed 115200 flowcontrol hardware
[code]....
This config is working fine, when dialing in via a Windows Hyperterminal Dial connection. After a while of dialing I get the login prompt of the router.Now I want to have a router placing calls instead of a Windows Server. I can't figure out how to tell a router to place calls to a POTS phone number.
Receiving router: 2811, WIC-1AM-V2, IOS c2800nm-ipbasek9-mz.124-25a
Calling router: 1841, WIC-1AM-V2, IOS c1841-advsecurityk9-mz.124-25a
View 5 Replies
View Related
May 6, 2011
I can't find any specific information on the implementation of packet inspection in a zone based policy firewall. In other words, is there a specification or even just a set of values that define the default inspection parameters for all protocols? With DPI I can manage 'some' of the inspection capabilities but I have some fairly rigorous and specific requirements to meet and I need to validate that the IOS ZBFW will meet those requirements. Specifically, I'm interested in HTTP, DNS, and ICMP but all other protocols would be useful as well.I'm working with basic routers; 871's, 2811's, 1841's, etc. The IOS in use in most cases is adventerprisek9-mz.151-3.T.
View 4 Replies
View Related
Dec 11, 2012
i am using a Cisco 1841 with subinterfaces instead (NAT on a stick).From the internet i can access services on public IP being hosted in LAN2. But when i try to access the same services on the same public IPs but sitting on LAN1, it does not work.
View 1 Replies
View Related
May 26, 2013
We have a setup of a firewall in between my Cisco 1841 router and Switch.
Cisco Router --> Meraki Firewall--> Switch
Client VPN is configured on the Meraki Firewall but then for the outside users to client vpn in to the network, I have to port forward or open the ports 500 and 4500 to the IP address of the Meraki Firewall 192.168.1.90. [code]
View 4 Replies
View Related
Dec 11, 2012
i am using a Cisco 1841 with subinterfaces instead (NAT on a stick).From the internet i can access services on public IP being hosted in LAN2. But when i try to access the same services on the same public IPs but sitting on LAN1, it does not work.
View 3 Replies
View Related
Jan 28, 2013
The problem I am having is very strange and I have tried to upgrade the IOS on the 1841 to solve the problem but no luck. The issue is when I enable Zone Based firewall security on of the 1841 routers two VPN site-to-site tunnels stops working. If I turn off CEF (no ip cef) then the traffic for both tunnels works. Someone told me that the Zone Based firewall must have a match for the VPN traffic and I created that with ACL 160 and 161 but it did not solve the problem.
Current IOS is below.
Cisco IOS Software, 1841 Software (C1841-ADVSECURITYK9-M), Version 15.0(1)M9, RELEASE SOFTWARE (fc1)
Technical Support: [URL]
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Tue 11-Sep-12 23:58 by prod_rel_team
[code]....
View 2 Replies
View Related
Dec 18, 2011
We're getting "Connaction Timeout / Connection Failure" error messages several time per day. Here is our setup:
Verizon FiOS Internet (ONT Box) --> Cisco ASA 5505 --> EdgeMarc 4500 Router --> Cisco 300-24G Switch --> Dell PE1950 Servers
From past few months, we keep getting Connection Timeout and Connection Failure error messages in our vendor application which connects to SQL Server 2005. Also Terminal Server 2003 keep disconnecting for every few hours.After several days of troubleshooting, we come to know that this Cisco ASA 5500 is not working properly. When I access the ASDM, it shows several warning messages.I know there is a setting option to configure TimeOut, but is there anyway to test and track the ASA 5500 regarding this Timeout issues?
View 3 Replies
View Related
Jul 4, 2011
how simultaneous connections is supported on the ISR G2? I need a router with the 60,000 concurrent connections.
View 1 Replies
View Related
Mar 21, 2012
I'm working on a problem at the moment where I have 2 Internet connections each with their own Interface on an ASA running 8.2(5). What I want to be able to do is host different web sites on each ISP's ranges but I'm banging my head against a wall at the moment trying to either get the routing or NATing to work in a satisfactory way.
The default route is via one of these Internet connections and obviously the website hosted on this Interface is working fine.
To get another website hosted on the other ISP or interface - traffic is getting blackholed as it is being routed in the 2nd ISP interface and then trying to be routed back out the 1st ISP interface.
I thoguht I could overcome this using Policy Based Routing but ASA does not support this. I'm also aware that I can overcome this problem by upgrading the ASA code to 8.3 or 8.4 where the NAT will overide the Routing table
I'm vaguely thinking that there might be a way to overcome this using clever NAT but not been able to figure it out yet. A lot of other Forum posts have sugested that you can use Policy NAT (either Static or Dynamic) or a Dynamic NAT to get the second NAT working and overcome this routing problem but all of these options seem to define a specific source where I need to allow ANY Source on either connection. (Connections inbound to the webservers originating from anywhere on the Internet).
I toyed with the idea of Source NAT'ing traffic coming in on the 2nd ISP connection so that it would appear to originate from an IP in the same network. This would overcome the routing problem but not ideal as WebServer logs would see all connections originating from this IP as opposed to the real IP on the Internet.
My current (relevant) congfiguration looks something like this:
static (DMZ, EXTERNAL_ISP1) 192.168.1.1 10.0.0.1 netmask 255.255.255.255
static (DMZ, EXTERNAL_ISP2) 172.16.100.2 10.0.0.2 netmask 255.255.255.255
!
route EXTERNAL_ISP1 0.0.0.0 0.0.0.0 192.168.1.254 1
I would have thought that this is a fairly simple task to achieve but it seems not (at least not on ASA 8.2). I have attached a rough VSD to illustrate what I mean.
View 3 Replies
View Related
