损坏的 PPPoE 配置

网络工程 思科 pppoe
2021-07-05 21:36:51

我们已经为此苦苦挣扎了几个星期。CISCO 3825 (15.1 IOS) 具有正确建立的 PPPoE(即可以从 cli 内部 ping 网络)。

我们遇到的问题是客户端无法 ping 外部世界。我将客户端直接连接到路由器,但无法上网。配置:

更新配置

interface GigabitEthernet0/0
 no ip address
 duplex auto
 speed auto
 media-type rj45
 pppoe enable group global
 pppoe-client dial-pool-number 1
 no cdp enable
!
interface GigabitEthernet0/1
 ip address 192.168.2.1 255.255.255.0
 ip broadcast-address 192.168.2.255
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto
 media-type rj45
 no cdp enable
!
interface Dialer0
 ip address negotiated
 ip mtu 1492
 ip flow ingress
 ip nat outside
 ip virtual-reassembly in
 encapsulation ppp
 ip route-cache policy
 dialer pool 1
 ppp authentication pap callin
 ppp pap sent-username nonya@domain.local password 0 foobarme
 ppp ipcp dns request accept
 ppp ipcp route default
 ppp ipcp address accept
 no cdp enable
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!         
ip nat inside source list 1 interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 Dialer0
!
no cdp run

ppoe 建立完美。然而,两个接口都已启动/启动,只是无法使用直接连接的客户端 ping 互联网。没有 dhcp,客户端有静态 IP 地址

我确信这个问题已经得到回答,但我读过的任何内容都无法让我起床。

需要注意的一件事是 f0/1 的 bcast 为 255.255.255.255。客户端接口设置为 192.168.2.255。这可能是问题吗?我需要尽可能减少停机时间,非常感谢您的帮助。

简短的

Interface                  IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0         unassigned      YES NVRAM  up                    up      
GigabitEthernet0/1         192.168.2.1     YES NVRAM  up                    up      
Dialer0                    <public ip>     YES IPCP   up                    up      
NVI0                       unassigned      YES unset  administratively down down    
Virtual-Access1            unassigned      YES unset  up                    up      
Virtual-Access2            unassigned      YES unset  up                    up 

满的

do show ip interface      
GigabitEthernet0/0 is up, line protocol is up
  Internet protocol processing disabled
GigabitEthernet0/1 is up, line protocol is up
  Internet address is 192.168.2.1/24
  Broadcast address is 192.168.2.255
  Address determined by non-volatile memory
  MTU is 1500 bytes
  Helper address is not set
  Directed broadcast forwarding is disabled
  Outgoing access list is not set
  Inbound  access list is not set
  Proxy ARP is enabled
  Local Proxy ARP is disabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is enabled
  IP fast switching on the same interface is disabled
  IP Flow switching is disabled
  IP CEF switching is enabled
  IP CEF switching turbo vector
  IP multicast fast switching is enabled
  IP multicast distributed fast switching is disabled
  IP route-cache flags are Fast, CEF
  Router Discovery is disabled
  IP output packet accounting is disabled
  IP access violation accounting is disabled
  TCP/IP header compression is disabled
  RTP/IP header compression is disabled
  Policy routing is disabled
  Network address translation is enabled, interface in domain inside
  BGP Policy Mapping is disabled
  Input features: Stateful Inspection, Virtual Fragment Reassembly, Virtual Fragment Reassembly After IPSec Decryption, MCIk
  Output features: NAT Inside, Stateful Inspection, NAT ALG proxy, Post-Ingress-NetFlow
  WCCP Redirect outbound is disabled
  WCCP Redirect inbound is disabled
  WCCP Redirect exclude is disabled
Dialer0 is up, line protocol is up
  Internet address is <public ip>/32
  Broadcast address is 255.255.255.255
  Address determined by IPCP
  MTU is 1492 bytes
  Helper address is not set
  Directed broadcast forwarding is disabled
  Outgoing access list is not set
  Inbound  access list is not set
  Proxy ARP is enabled
  Local Proxy ARP is disabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is enabled
  IP fast switching on the same interface is enabled
  IP Flow switching is disabled
  IP CEF switching is enabled
  IP CEF switching turbo vector
  IP Null turbo vector
  IP multicast fast switching is enabled
  IP multicast distributed fast switching is disabled
  IP route-cache flags are Fast, Policy, CEF
  Router Discovery is disabled
  IP output packet accounting is disabled
  IP access violation accounting is disabled
  TCP/IP header compression is disabled
  RTP/IP header compression is disabled
  Policy routing is disabled
  Network address translation is enabled, interface in domain outside
  BGP Policy Mapping is disabled
  Input features: Stateful Inspection, Dialer i/f override, Ingress-NetFlow, Virtual Fragment Reassembly, Virtual Fragment k
  Output features: Post-routing NAT Outside, Stateful Inspection, NAT ALG proxy, Post-Ingress-NetFlow, Dialer idle reset, Dt
  WCCP Redirect outbound is disabled
  WCCP Redirect inbound is disabled
  WCCP Redirect exclude is disabled
NVI0 is administratively down, line protocol is down
  Internet protocol processing disabled
Virtual-Access1 is up, line protocol is up
  Internet protocol processing disabled
Virtual-Access2 is up, line protocol is up
  Peer address is 64.230.11.5
  Dialer interface is Dialer0

与往常一样,可以在 cli 内 ping 但不能从直接连接的客户端。客户端上的 DNS 设置为 8.8.8.8,可以 ping 路由器等。这看起来像是 dia0 的网关路由问题?

更新 - Cisco Bell Canada ip mtu 1492 ip tcp adjust-mss 1452 的工作 mtu mss

现在一切都很完美!

提前致谢,

缺口。

3个回答

*咳嗽*

interface Dialer0
  ip nat outside

您缺少一个关键的 NAT 命令。

尝试ip nat outside在出站拨号界面下添加interface Dialer 0

使用您当前的配置,您已将接口 Gig 0/1 标识为“内部”接口,因此路由器知道何时将 NAT 规则应用于该接口上的传入流量。

然而,由于 Dialer 0 接口没有 NAT 语句,路由器不知道它需要转换寻址,然后尝试路由它。

现在,您从互联网到 NAT 主机的返回流量可能正在到达您的路由器并在那里消失。


我强烈建议在 INE查看这篇文章该文章详细介绍了 Cisco NATing 中的“内部”与“外部”接口。

添加到其他答案...您现在缺少的是一个访问列表,用于将 NAT 限制为您的内部地址...如果您应用此配置,我认为只要没有其他子网,这应该可以帮助您由该路由器路由。

!
interface GigabitEthernet0/1
 ip address 192.168.2.1 255.255.255.0
 ip nat inside

interface Dialer0
 ip nat outside
!
!! You might not need to do this, but just in case...
do clear ip nat trans *
no ip nat inside source list 1 interface Dialer0 overload
!
access-list 1 permit 192.168.2.0 0.0.0.255
!
ip nat inside source list 1 interface Dialer0 overload

我包括了 Ricky 和 ​​Brett 的答案中的部分,这当然也是必需的。