Salve,
non escludendo di possedere un hardware difettoso vorrei tentare di condividere il problema con qualche altro smanettone/esperto prima di mandarlo in assistenza.
Veloce riepilogo:
Hag fastweb connesso ad un router della serie 1700 con interfaccia ethernet a sua volta connessa ad un catalyst serie 2950.
Risultato, ho un unica porta sul catalyst sulla quale posso collegare uno switch, o un singolo pc ed utilizzare alcuni indirizzi assegnati della classe 10.10.10.0/24-
Per motivi ben noti, ho nattato nuovamente un ip della classe disponibile sul catalyst utilizzando cisco 851.
Dalla porta eth dell'851 ho ha disposizione 254 indirizzi della classe 192.168.0.0/24 con i quali condividere la connessione fastweb.
Naturalmente, ci vuole piu a descriverlo che ha farlo, infatti tutto funziona perfettamente; tutti i pc connessi all'851 (con un altro switch) navigano perfettamente e comunicano fra loro!
Ogni tanto però, l'eth4 dell'851, alla quale è legata la vlan1 va down, oopure l'851 finisce la memoria disponibile... oppure che diavolo ne so cosa succede (perche nei log non c'è nulla) ma non si naviga piu, il router non risponde piu ne sul 192.168.0.1, ne sulla wan dall'indirizzo assegnato.
Avete qualche idea, qualche prova da fare, qualche test??
Grazie
altra precisazione, tanto per far essere chiara la situazione che ho qua in azienda: il cisco 1700 con l'hag fastweb e il catalyst fastweb sono connessi direttamente con il cavo di rete l'uno all'altro (diversamente non andrebbero a causa delle configurazione fastweb)
dall'unica uscita disponibile del catalyst non vado direttamente all'851, ma passo per lo switch, dopodiche dall'851 torno nello switch.
Questo per avere la possibilita dai pc collegati allo switch stesso di decidere di navigare con la Lan dell'azienda o di uscire con uno degli ip fastweb ancora disponibili.
questa cosa, per il problema riscontrato dovrebbe essere ininfluente, ma la segnalo per una buona analisi.
a seguito, in un reply incollo la configruazione attuale dell'851, effettuata dall'sdm abilitanto le varie opzioni consigliate per la sicurezza e la stabilita ecc ecc....
851-k9 crasha improvvisamente
Moderatore: Federico.Lagni
-
pirolisi
- n00b
- Messaggi: 2
- Iscritto il: gio 29 nov , 2007 4:26 pm
Building configuration...
Current configuration : 7459 bytes
!
! Last configuration change at 16:20:07 PCTime Thu Nov 29 2007 by cisco
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname yourname
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 debugging
logging console critical
enable secret 5 *************************
!
aaa new-model
!
!
aaa authentication login local_authen local
aaa authorization exec local_author local
!
aaa session-id common
!
resource policy
!
clock timezone PCTime 1
clock summer-time PCTime date Mar 30 2003 2:00 Oct 26 2003 3:00
ip subnet-zero
no ip source-route
!
!
ip cef
ip inspect name SDM_LOW cuseeme
ip inspect name SDM_LOW dns
ip inspect name SDM_LOW ftp
ip inspect name SDM_LOW h323
ip inspect name SDM_LOW https
ip inspect name SDM_LOW icmp
ip inspect name SDM_LOW imap
ip inspect name SDM_LOW pop3
ip inspect name SDM_LOW rcmd
ip inspect name SDM_LOW realaudio
ip inspect name SDM_LOW rtsp
ip inspect name SDM_LOW esmtp
ip inspect name SDM_LOW sqlnet
ip inspect name SDM_LOW streamworks
ip inspect name SDM_LOW tftp
ip inspect name SDM_LOW tcp
ip inspect name SDM_LOW udp
ip inspect name SDM_LOW vdolive
ip tcp synwait-time 10
no ip bootp server
ip domain name yourdomain.com
ip name-server 213.140.2.43
ip name-server 62.149.128.2
ip name-server 195.210.91.100
ip name-server 213.140.2.12
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
crypto pki trustpoint TP-self-signed-1519274762
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1519274762
revocation-check none
rsakeypair TP-self-signed-1519274762
!
!
crypto pki certificate chain TP-self-signed-1519274762
certificate self-signed 01
**********************
quit
username cisco851 privilege 15 secret 5 *********************************
!
!
!
!
!
interface Null0
no ip unreachables
!
interface FastEthernet0
!
interface FastEthernet1
shutdown
!
interface FastEthernet2
shutdown
!
interface FastEthernet3
shutdown
!
interface FastEthernet4
description $FW_OUTSIDE$$ETH-WAN$
ip address 10.10.10.10 255.255.255.248
ip access-group 101 in
ip verify unicast reverse-path
ip mask-reply
ip directed-broadcast
ip inspect SDM_LOW out
ip nat outside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$FW_INSIDE$
ip address 192.168.0.1 255.255.255.0
ip access-group 100 in
ip mask-reply
ip directed-broadcast
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1452
!
ip classless
ip route 0.0.0.0 0.0.0.0 FastEthernet4
!
ip http server
ip http access-class 2
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 1 interface FastEthernet4 overload
!
logging trap debugging
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 2 remark HTTP Access-class list
access-list 2 remark SDM_ACL Category=1
access-list 2 permit 192.168.0.0 0.0.0.255
access-list 2 deny any
access-list 100 remark auto generated by SDM firewall configuration
access-list 100 remark SDM_ACL Category=1
access-list 100 deny ip 10.10.10.0 0.0.0.255 any
access-list 100 deny ip host 255.255.255.255 any
access-list 100 deny ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
access-list 101 remark auto generated by SDM firewall configuration
access-list 101 remark SDM_ACL Category=1
access-list 101 permit udp host 213.140.2.12 eq domain any
access-list 101 permit udp host 195.210.91.100 eq domain any
access-list 101 permit udp host 62.149.128.2 eq domain any
access-list 101 permit udp host 213.140.2.43 eq domain any
access-list 101 remark Auto generated by SDM for NTP (123) 193.204.114.232
access-list 101 permit udp host 193.204.114.232 eq ntp host 10.10.10.10 eq ntp
access-list 101 deny ip 192.168.0.0 0.0.0.255 any
access-list 101 permit icmp any host 10.10.10.10 echo-reply
access-list 101 permit icmp any host 10.10.10.10 time-exceeded
access-list 101 permit icmp any host 10.10.10.10 unreachable
access-list 101 deny ip 10.0.0.0 0.255.255.255 any
access-list 101 deny ip 172.16.0.0 0.15.255.255 any
access-list 101 deny ip 192.168.0.0 0.0.255.255 any
access-list 101 deny ip 127.0.0.0 0.255.255.255 any
access-list 101 deny ip host 255.255.255.255 any
access-list 101 deny ip host 0.0.0.0 any
access-list 101 deny ip any any log
access-list 102 remark VTY Access-class list
access-list 102 remark SDM_ACL Category=1
access-list 102 permit ip 192.168.0.0 0.0.0.255 any
access-list 102 deny ip any any
no cdp run
!
control-plane
!
banner login ^C
-----------------------------------------------------------------------
-----------------------------------------------------------------------
^C
!
line con 0
login authentication local_authen
no modem enable
transport output telnet
line aux 0
login authentication local_authen
transport output telnet
line vty 0 4
access-class 102 in
authorization exec local_author
login authentication local_authen
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
ntp clock-period 17177861
ntp server 193.204.114.232 prefer
end
Current configuration : 7459 bytes
!
! Last configuration change at 16:20:07 PCTime Thu Nov 29 2007 by cisco
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname yourname
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 debugging
logging console critical
enable secret 5 *************************
!
aaa new-model
!
!
aaa authentication login local_authen local
aaa authorization exec local_author local
!
aaa session-id common
!
resource policy
!
clock timezone PCTime 1
clock summer-time PCTime date Mar 30 2003 2:00 Oct 26 2003 3:00
ip subnet-zero
no ip source-route
!
!
ip cef
ip inspect name SDM_LOW cuseeme
ip inspect name SDM_LOW dns
ip inspect name SDM_LOW ftp
ip inspect name SDM_LOW h323
ip inspect name SDM_LOW https
ip inspect name SDM_LOW icmp
ip inspect name SDM_LOW imap
ip inspect name SDM_LOW pop3
ip inspect name SDM_LOW rcmd
ip inspect name SDM_LOW realaudio
ip inspect name SDM_LOW rtsp
ip inspect name SDM_LOW esmtp
ip inspect name SDM_LOW sqlnet
ip inspect name SDM_LOW streamworks
ip inspect name SDM_LOW tftp
ip inspect name SDM_LOW tcp
ip inspect name SDM_LOW udp
ip inspect name SDM_LOW vdolive
ip tcp synwait-time 10
no ip bootp server
ip domain name yourdomain.com
ip name-server 213.140.2.43
ip name-server 62.149.128.2
ip name-server 195.210.91.100
ip name-server 213.140.2.12
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
crypto pki trustpoint TP-self-signed-1519274762
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1519274762
revocation-check none
rsakeypair TP-self-signed-1519274762
!
!
crypto pki certificate chain TP-self-signed-1519274762
certificate self-signed 01
**********************
quit
username cisco851 privilege 15 secret 5 *********************************
!
!
!
!
!
interface Null0
no ip unreachables
!
interface FastEthernet0
!
interface FastEthernet1
shutdown
!
interface FastEthernet2
shutdown
!
interface FastEthernet3
shutdown
!
interface FastEthernet4
description $FW_OUTSIDE$$ETH-WAN$
ip address 10.10.10.10 255.255.255.248
ip access-group 101 in
ip verify unicast reverse-path
ip mask-reply
ip directed-broadcast
ip inspect SDM_LOW out
ip nat outside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$FW_INSIDE$
ip address 192.168.0.1 255.255.255.0
ip access-group 100 in
ip mask-reply
ip directed-broadcast
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1452
!
ip classless
ip route 0.0.0.0 0.0.0.0 FastEthernet4
!
ip http server
ip http access-class 2
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 1 interface FastEthernet4 overload
!
logging trap debugging
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 2 remark HTTP Access-class list
access-list 2 remark SDM_ACL Category=1
access-list 2 permit 192.168.0.0 0.0.0.255
access-list 2 deny any
access-list 100 remark auto generated by SDM firewall configuration
access-list 100 remark SDM_ACL Category=1
access-list 100 deny ip 10.10.10.0 0.0.0.255 any
access-list 100 deny ip host 255.255.255.255 any
access-list 100 deny ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
access-list 101 remark auto generated by SDM firewall configuration
access-list 101 remark SDM_ACL Category=1
access-list 101 permit udp host 213.140.2.12 eq domain any
access-list 101 permit udp host 195.210.91.100 eq domain any
access-list 101 permit udp host 62.149.128.2 eq domain any
access-list 101 permit udp host 213.140.2.43 eq domain any
access-list 101 remark Auto generated by SDM for NTP (123) 193.204.114.232
access-list 101 permit udp host 193.204.114.232 eq ntp host 10.10.10.10 eq ntp
access-list 101 deny ip 192.168.0.0 0.0.0.255 any
access-list 101 permit icmp any host 10.10.10.10 echo-reply
access-list 101 permit icmp any host 10.10.10.10 time-exceeded
access-list 101 permit icmp any host 10.10.10.10 unreachable
access-list 101 deny ip 10.0.0.0 0.255.255.255 any
access-list 101 deny ip 172.16.0.0 0.15.255.255 any
access-list 101 deny ip 192.168.0.0 0.0.255.255 any
access-list 101 deny ip 127.0.0.0 0.255.255.255 any
access-list 101 deny ip host 255.255.255.255 any
access-list 101 deny ip host 0.0.0.0 any
access-list 101 deny ip any any log
access-list 102 remark VTY Access-class list
access-list 102 remark SDM_ACL Category=1
access-list 102 permit ip 192.168.0.0 0.0.0.255 any
access-list 102 deny ip any any
no cdp run
!
control-plane
!
banner login ^C
-----------------------------------------------------------------------
-----------------------------------------------------------------------
^C
!
line con 0
login authentication local_authen
no modem enable
transport output telnet
line aux 0
login authentication local_authen
transport output telnet
line vty 0 4
access-class 102 in
authorization exec local_author
login authentication local_authen
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
ntp clock-period 17177861
ntp server 193.204.114.232 prefer
end
