Cisco 1921 子接口接入互联网

网络工程 思科 路由 局域网 纳特 子网
2022-02-19 22:47:23

我在 Gi0/1 上设置了一个子接口,我想为 VLAN 上路由到 Gi0/1.200 的设备提供对 Internet 的访问。设备可以正常使用 DHCP 寻址,但无法访问互联网,也看不到路由到 0.0.0.0/0

任何人都可以帮我解决我所缺少的吗?这是我的运行配置

    Current configuration : 6283 bytes
!
! Last configuration change at 13:03:45 gmt Thu Nov 2 2017 by admin
!
version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname EASI-FW1
!
boot-start-marker
boot-end-marker
!
!
logging buffered 51200 warnings
enable secret 5 $1$Wdss$ruUuTeVDT/yXXHu17XZ5n.
!
no aaa new-model
ethernet lmi ce
clock timezone gmt -8 0
!
!
!
!
!
!
!
!
!
!
!
!
ip domain name easi.local
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
crypto pki trustpoint TP-self-signed-1664236970
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-1664236970
 revocation-check none
 rsakeypair TP-self-signed-1664236970
!
!
crypto pki certificate chain TP-self-signed-1664236970
 certificate self-signed 01

        quit
license udi pid CISCO1921/K9 sn 
!
!
username admin privilege 15 secret 5 
!
redundancy
!
!
!
!
lldp run
!
!
class-map match-any Voice
 match protocol sip
 match protocol rtp audio
class-map match-any QoS-Bulk
 match protocol secure-nntp
 match protocol smtp
 match protocol tftp
 match protocol ftp
class-map match-any QoS-Management
 match protocol snmp
 match protocol dns
 match protocol secure-imap
class-map match-any QoS-Inter-Video
 match protocol rtp video
class-map match-any QoS-Voice-Control
 match access-group name Voice-Control
!
policy-map QOS
 class Voice
  priority percent 25
  set dscp ef
 class QoS-Inter-Video
  bandwidth remaining percent 10
  set dscp af41
 class QoS-Bulk
  bandwidth remaining percent 5
  random-detect dscp-based
  set dscp af11
 class QoS-Management
  bandwidth remaining percent 1
  set dscp cs2
 class QoS-Voice-Control
  priority percent 5
  set dscp ef
 class class-default
  fair-queue
!
!
!
!
!
!
!
!
!
!
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 no ip address
 duplex auto
 speed auto
!
interface GigabitEthernet0/0.1
 description LAN
 encapsulation dot1Q 1 native
 ip address 10.20.75.1 255.255.255.0
 ip access-group Local in
 ip access-group Local out
 ip flow ingress
 ip flow egress
 ip nat inside
 ip virtual-reassembly in
 ip policy route-map LAN
!
interface GigabitEthernet0/0.76
 description SteelNet76
 encapsulation dot1Q 76
 ip address 10.20.76.1 255.255.255.0
 ip access-group Local in
 ip access-group Local out
 ip flow ingress
 ip flow egress
 ip nat inside
 ip virtual-reassembly in
 ip policy route-map WLAN76
!
interface GigabitEthernet0/0.200
 description Voice
 encapsulation dot1Q 200
 ip address 10.20.77.1 255.255.255.0
 ip access-group Local in
 ip access-group Local out
 ip helper-address 10.20.75.11
 ip flow ingress
 ip nat inside
 ip virtual-reassembly in
 ip policy route-map SIP200
!
interface GigabitEthernet0/1
 description WAN
 ip address dhcp
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
 service-policy output QOS
!
ip forward-protocol nd
!
no ip http server
ip http access-class 23
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat inside source static tcp 10.20.75.11 443 interface GigabitEthernet0/1 443
ip nat inside source static tcp 10.20.75.11 987 interface GigabitEthernet0/1 987
ip nat inside source static tcp 10.20.75.11 1723 interface GigabitEthernet0/1 1723
ip nat inside source route-map LAN interface GigabitEthernet0/1 overload
ip nat inside source route-map SIP200 interface GigabitEthernet0/1 overload
ip nat inside source route-map WLAN76 interface GigabitEthernet0/1 overload
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 track 1
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 2
!
ip access-list extended LAN
 permit ip 10.20.75.0 0.0.0.255 any
 deny   ip any any
ip access-list extended SIP200
 permit ip 10.20.77.0 0.0.0.255 any
 deny   ip any any
ip access-list extended WLAN76
 permit ip 10.20.76.0 0.0.0.255 any
 deny   ip any any
!
!
route-map WLAN76 permit 20
 match ip address WLAN76
 set interface GigabitEthernet0/1
 set default interface GigabitEthernet0/1
!
route-map LAN permit 10
 match ip address LAN
 set interface GigabitEthernet0/1
 set default interface GigabitEthernet0/1
!
route-map SIP200 permit 30
 match ip address SIP200
 set interface GigabitEthernet0/1
 set default interface GigabitEthernet0/1
!
!
access-list 23 permit XXX.XXX.XXX.XXX
access-list 23 permit 10.20.75.0 0.0.0.255
access-list 23 permit 10.20.77.0 0.0.0.255
access-list 24 permit 10.20.77.0 0.0.0.255
access-list 120 permit ip 0.0.0.11 255.255.255.0 any
!
control-plane
!
!
!
line con 0
 login local
line aux 0
line 2
 no activation-character
 no exec
 transport preferred none
 transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
 stopbits 1
line vty 0 4
 access-class 23 in
 privilege level 15
 login local
 transport input ssh
line vty 5 15
 access-class 23 in
 privilege level 15
 login local
 transport input telnet ssh
!
scheduler allocate 20000 1000
!
end
3个回答

此路由器不是您的 DHCP 服务器。如果 VLAN 200 中的所有东西都获得了地址,那么路由器已经完成了它的工作。您需要转到您的 DHCP 服务器来修复 VLAN 200 的范围。(即定义默认路由)

关于这个配置的一切——你现在已经发布了不止一次——完全是一场噩梦。" ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1" 足以触发 " erase nvram" 并重新开始 - 并解雇任何造成这种混乱的坚果。

如果我想这样做,它看起来像这样:

service password-encryption
!
no lldp run
!
interface GigabitEthernet0/0.1
 no ip access-group Local in
 no ip access-group Local out
 no ip flow ingress
 no ip flow egress
 no ip policy route-map LAN
!
interface GigabitEthernet0/0.76
 no ip access-group Local in
 no ip access-group Local out
 no ip flow ingress
 no ip flow egress
 no ip policy route-map WLAN76
!
interface GigabitEthernet0/0.200
 no ip access-group Local in
 no ip access-group Local out
 no ip flow ingress
 no ip policy route-map SIP200
!
no ip nat inside source route-map LAN interface GigabitEthernet0/1 overload
no ip nat inside source route-map SIP200 interface GigabitEthernet0/1 overload
no ip nat inside source route-map WLAN76 interface GigabitEthernet0/1 overload
ip nat inside source list 10 interface GigabitEthernet0/1 overload
no ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 track 1
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1
!
ip access-list 10 permit 10.20.75.0 0.0.0.255
ip access-list 10 permit 10.20.76.0 0.0.0.255
ip access-list 10 permit 10.20.77.0 0.0.0.255
!

在路由器中

请配置指向 ISP 网关的默认路由

Router(config)#iP route 0.0.0.0 0.0.0.0 pointing towards ISP gateway