# Solved: Server 2k8 - Gateway / Internet Connectivity Issue



## JSharmaable (Sep 19, 2011)

Hey Guys,

Hope you can assist me with my problem;
Issue:
Cannot access internet from server or clients on domain. 

Quick Overview:
I have a cisco switch (2950), cisco router (877w) which is managing 3 different networks in three separate VLANs. I have been able to setup the switch and router in a way which all 3 networks can all communicate (ping) each other, access resources etc.

Server2008 NIC Setup:
On my Microsoft server 2008 R2 (production environment (VLAN 300)) my NIC settings are:
IP - 10.3.1.10
SUB - 255.255.0.0
GATEWAY - 10.2.1.1 (ADSL Modem on another VLAN 200)
DNS - 10.3.1.10

I can ping my ADSL Modem which is in VLAN 200, from my production environment VLAN 300. Should i not be able to browse the internet? When i try to ping google.com, it says pinging and resolves googles IP, but my replies fails. What am i doing wrong please?

If you require more information about the environment, i will be happy to explain it in further details.

Thanks in advance 

Regards
Jaysen


----------



## zx10guy (Mar 30, 2008)

A few things.

1) Do you have NAT configured on the 877 router?
2) Why are you using such a large IP space?
3) Why is your default gateway for VLAN 300 on a different subnet?
4) Have you tested the ability to ping say 4.2.2.2?


----------



## JSharmaable (Sep 19, 2011)

Firstly, I would like to apologies as this is a networking issue. I thought it would be a server problem, hence why i posted in here.

@zx10guy
1) I don't have NAT configured on the 877 router, i thought the ADSL modems would handle this. It this not the case?
2) The reason for the IP structure is, I am mimicking business i look after. 
3) My default gateway for VLAN 300 was 10.3.1.1 - which is the cisco router. That didn't work, so i thought let me point it directly to the modem and change it to 10.2.1.1..
4) On VLAN 300 i can ping all other network device on all other VLANand access shared folders, print etc and vice verse.

I have attached a image i quickly drew in paint to give you a better overview. 
http://img15.imageshack.us/img15/8454/1bam.jpg


----------



## JSharmaable (Sep 19, 2011)

I tried to configure NAT on the cisco 877, 
I did the following:
R1# *configure terminal*
R1(config)# *interface vlan 300*
R1(config-if)# *ip nat inside*

R1(config-if)# *interface vlan 200
* R1(config-if)# *ip nat outside *
R1(config-if)# *exit*

R1(config)# access-list 100 remark == [Control NAT Service]==
R1(config)# access-list 100 permit ip 10.3.0.0 255.255.0.0 any

Is this correct?


----------



## JSharmaable (Sep 19, 2011)

Router 877 config:
Router#show running-config
Building configuration...

Current configuration : 3025 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$Wrvo$ICO.V1PvPb5Nac1B870ut.
!
no aaa new-model
ip cef
!
!
!
!
!
multilink bundle-name authenticated
!
crypto pki trustpoint TP-self-signed-2617460735
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2617460735
revocation-check none
rsakeypair TP-self-signed-2617460735
!
!
crypto pki certificate chain TP-self-signed-2617460735
certificate self-signed 01
3082023E 308201A7 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32363137 34363037 3335301E 170D3131 30363131 31313131
34375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 36313734
36303733 3530819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100E979 D99BF3A9 00D15293 A245165A 8A47CDF4 81010BFB 281D3C9C 262FDB7D
88EBE51E CABD1DA7 91664D8B 8A093EB1 959EB7B6 D71D2CEA 4B04368F 1DA86962
4B5F7330 8EFA754F 42EDAC7B 82E0DE54 892383BE D755D6A3 AD1AE144 F83D232D
C499E698 A1158C44 41EB1217 868E2A9F B38E6126 C0A7F752 41042317 FB75165E
29630203 010001A3 66306430 0F060355 1D130101 FF040530 030101FF 30110603
551D1104 0A300882 06526F75 74657230 1F060355 1D230418 30168014 11D27112
A08900BE 9ED7EF02 96BFFC19 C8A08439 301D0603 551D0E04 16041411 D27112A0
8900BE9E D7EF0296 BFFC19C8 A0843930 0D06092A 864886F7 0D010104 05000381
8100E1A2 ED36F243 B963E471 C0A43AB4 A57F365C B7BBAB25 680329D4 22027DF3
FCD3F600 77990932 41ADFDAF FB52A43F DC990661 B6F58EC4 9E5A3FFD 4B2BF298
2A16AB65 3771C82A 26AB63A5 2E98668F E52F7ACA 4AF9AE8F 5834AFFA 5A54B8CB
40096AB9 C4A718D3 FD9489F0 D168495D 468E26DC 6CF76E05 65B2E4C7 CE2B014B 780B
quit
!
!
username root privilege 15 secret 5 $1$5FuQ$CmNfnI9hRW81wtIa8fqsn.
!
!
!
!
!
!
interface ATM0
no ip address
shutdown
no atm ilmi-keepalive
dsl operating-mode auto
!
interface FastEthernet0
switchport mode trunk
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Dot11Radio0
no ip address
shutdown
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
!
interface Vlan1
no ip address
!
interface Vlan200
ip address 10.2.1.2 255.255.0.0
ip nat outside
ip virtual-reassembly
!
interface Vlan100
ip address 10.1.1.2 255.255.0.0
!
interface Vlan300
ip address 10.3.1.1 255.255.0.0
ip nat inside
ip virtual-reassembly
!
!
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 600 life 86400 requests 1000
!
access-list 100 remark ==[Control NAT Services]==
access-list 100 permit ip 0.0.0.0 255.255.0.0 any
!
!
!
!
control-plane
!
!
line con 0
no modem enable
line aux 0
line vty 0 4
login
!
scheduler max-task-time 5000
end


----------



## zx10guy (Mar 30, 2008)

From your network diagram and what you've said, it appears the ADSL modem is a router also. What puzzles me is what you indicated in the diagram which looks like two different ADSL modems connected to your 2960 switch on two different VLANs. You need to clarify what is going on with the modem(s). Also, what is the reference to the modem as a neighbor's?


----------



## JSharmaable (Sep 19, 2011)

I have two different networks. 
- My own with my fritzbox which looks after my house hold which servers as my router, dhcp and & voip etc. 
- My sister who is my neighbor uses the boblite modem router. which looks after her house and she has her own internet connection which she has dhcp and voip running as well.
- third network is my server stuff, which i learn, fix and break stuff etc. All i want on this network is to get internet access. I thought i be able to share it from my own network.


----------



## JSharmaable (Sep 19, 2011)

on both modems i have static routes pointing to each other 
FRITZ - my network
10.1.0.0 255.255.0.0 10.2.1.2
10.3.0.0 255.255.0.0 10.2.1.2
Sister - Neighbour
10.2.0.0 255.255.0.0 10.1.1.2
10.3.0.0 255.255.0.0 10.1.1.2


----------



## zx10guy (Mar 30, 2008)

So you don't need to use your sister's ISP to get out to the Internet?


----------



## JSharmaable (Sep 19, 2011)

no, happy to just use mine.


----------



## JSharmaable (Sep 19, 2011)

Will it be possible, or would i need to redesign my network, if so how should things be structured. Will i still be able to achieve what i want?


----------



## zx10guy (Mar 30, 2008)

You don't need to add the NAT statements on the 877. You do need to add a default gateway statement. The following should fix the issues:

ip route 0.0.0.0 0.0.0.0 10.1.1.1


----------



## JSharmaable (Sep 19, 2011)

omg thank you so much that fixed it.
It funny because before i added the following route
10.3.0.0 255.255.0.0 10.1.1.1
but that never worked. Should it?

Lastly, how i have my network setup is it ideal or would u recommend a better setup?


----------



## zx10guy (Mar 30, 2008)

No problem. Glad to help. The route statement says this. To get to the 10.3.0.0 network, forward packets to this gateway, 10.1.1.1 as the next hop. Since this is on the 877 which has the 10.3.0.0 as a locally connected network, this route statement makes no sense. There isn't any issues with adding this route statement as in the hierarchy of how Cisco routers work, locally attached network routes take precedence over statically set routes. Even if the route statement were used, the routing would work because the packet will forward to the ADSL modem/router which has a static route which points back to the 877 router. Even through the routing works, this is extremely poor routing design because you want to minimize the number of route hops a packet takes. Each hop adds latency to the time it takes to move a packet from source to destination. Plus convoluted routes increases the chance of issues with your routed network in terms of troubleshooting and management.

How you have your network is fine.


----------

