What's wrong with configuring pptp client on cisco 871?

topbanana2014-03-12 01:19:00

Cisco

topbanana, 2014-03-12 01:19:00

I'm trying to set up a cisco 871 as a home router with internet connection via pptp.
The connection occurs, from the router the ping goes to the Internet and to the internal network of the provider, but from a computer in the local network it only goes to the internal network of the provider. I blinded the configuration from pieces from different sources for setting up a pptp client.
What needs to be changed in the configuration?

running-config

Current configuration : 2149 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service internal
!
hostname my_router
!
boot-start-marker
boot-end-marker
!
enable secret 5 <i>пароль</i>
!
no aaa new-model
!
resource policy
!
ip subnet-zero
no ip gratuitous-arps
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 10.1.1.1 10.1.1.99
!
ip dhcp pool LAN
   network 10.1.1.0 255.255.255.0
   dns-server 10.1.1.1 
   default-router 10.1.1.1 
!
!
ip domain name <i>router.com</i>
ip multicast-routing 
ip ssh version 2
vpdn enable
!
vpdn-group 1
 request-dialin
  protocol pptp
  rotary-group 0
 initiate-to ip 192.168.117.249
!
!
!
!
username <i>user</i> secret 5 <i>password</i>
!
! 
!
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
 mac-address 0050.be05.a00a
 ip address dhcp client-id FastEthernet4
 ip nat outside
 ip nat enable
 ip virtual-reassembly
 duplex auto
 speed auto
 no cdp enable
!
interface Vlan1
 ip address 10.1.1.1 255.255.255.0
 ip nat inside
 ip nat enable
 ip virtual-reassembly
!
interface Dialer0
 mtu 1440
 ip address negotiated
 ip pim dense-mode
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 dialer in-band
 dialer idle-timeout 0
 dialer string internet
 dialer vpdn
 dialer-group 1
 no peer neighbor-route
 no cdp enable
 ppp pfc local request
 ppp pfc remote apply
 ppp chap hostname <i>login</i>
 ppp chap password 0 <i>password</i>
!
ip default-gateway 10.1.1.1
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0
ip route 192.168.0.0 255.255.0.0 FastEthernet4 dhcp
!
ip dns server
!
no ip http server
no ip http secure-server
ip nat inside source list INSIDE_NAT interface FastEthernet4 overload
ip nat inside source route-map map_PPTP interface Dialer0 overload
!
ip access-list standard INSIDE_NAT
 permit 10.1.1.0 0.0.0.255
!
dialer-list 1 protocol ip permit
!
!
control-plane
!
!
line con 0
 logging synchronous
 no modem enable
line aux 0
line vty 0 4
 login local
 transport input ssh
!
scheduler max-task-time 5000
end

Answer the question

In order to leave comments, you need to log in

14 answer(s)

throughtheether, 2014-03-19
@topbanana

Please show the "Timings" tab (on the right) for any 'long' request on the waterfall diagram.
Also try:

interface Dialer0
ip tcp adjust-mss 1400

throughtheether, 2014-03-12
@throughtheether

see below

throughtheether, 2014-03-12
@throughtheether

To start, the line
can be removed:
because it is inactive, and even the corresponding route-map is not set for you.
Further, what is happening now is that traffic from the local network is most likely natted to the address assigned to FastEthernet4 via dhcp. Therefore, you have access to hosts on the provider's local network. You can verify this (send its output, please) using the command
What needs to be achieved - so that traffic from the local network is routed to the address assigned to the Dialer0 interface.
Therefore, please save the current 'working' configuration (write mem), give the command again (you can copy-paste from here in config-mode)

no ip nat inside source list INSIDE_NAT interface FastEthernet4 overload
no ip nat inside source route-map map_PPTP interface Dialer0 overload
interface FastEthernet4
no ip nat outside
no ip nat enable
exit
ip nat inside source list INSIDE_NAT interface Dialer0 overload
clear ip nat translation

generate traffic from the local network to the Internet (check the availability of the Internet) and re-show the output .
The easiest way to go back is by command
or by rebooting the device.
I'll try to recreate your case in GNS3 for now.

topbanana, 2014-03-12
@topbanana

After trying to access provider nodes with current configuration

#show ip nat translations 
Pro Inside global         Inside local          Outside local         Outside global
icmp 192.168.138.152:4764 10.1.1.100:4764       192.168.117.249:4764  192.168.117.249:4764

After changing and trying to ping to 8.8.8.8, show ip nat translations shows empty output.

running-config with changes

Current configuration : 1908 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service internal
!
hostname router
!
boot-start-marker
boot-end-marker
!
enable secret 5 пароль
!
no aaa new-model
!
resource policy
!
ip subnet-zero
no ip gratuitous-arps
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 10.1.1.1 10.1.1.99
!
ip dhcp pool LAN
network 10.1.1.0 255.255.255.0
dns-server 10.1.1.1
default-router 10.1.1.1
!
!
ip domain name domain.com
ip multicast-routing
ip ssh version 2
vpdn enable
!
vpdn-group 1
request-dialin
protocol pptp
rotary-group 0
initiate-to ip 192.168.117.249
!
!
!
!
username user secret 5 pwd
!
!
!
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
mac-address 0050.bfb5.b00a
ip address dhcp client-id FastEthernet4
ip virtual-reassembly
duplex auto
speed auto
!
interface Vlan1
ip address 10.1.1.1 255.255.255.0
ip nat inside
ip nat enable
ip virtual-reassembly
!
interface Dialer0
mtu 1440
ip address negotiated
ip pim dense-mode
encapsulation ppp
dialer in-band
dialer idle-timeout 0
dialer string internet
dialer vpdn
dialer-group 1
no cdp enable
ppp chap hostname login
ppp chap password 0 pwd
!
ip default-gateway 10.1.1.1
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0
ip route 192.168.0.0 255.255.0.0 FastEthernet4 dhcp
!
!
no ip http server
no ip http secure-server
ip nat inside source list INSIDE_NAT interface Dialer0 overload
!
ip access-list standard INSIDE_NAT
permit 10.1.1.0 0.0.0.255
!
dialer-list 1 protocol ip permit
!
!
control-plane
!
!
line con 0
logging synchronous
no modem enable
line aux 0
line vty 0 4
login local
transport input ssh
!
scheduler max-task-time 5000
end

topbanana, 2014-03-13
@topbanana

Added ip nat outside for dialer0, now the Internet works on the computer and the internal network does not work.

router#show ip nat translations 
Pro Inside global         Inside local          Outside local         Outside global
udp 93.190.177.42:33159   10.1.1.100:33159      208.67.220.220:53     208.67.220.220:53
udp 93.190.177.42:34346   10.1.1.100:34346      208.67.220.220:53     208.67.220.220:53
udp 93.190.177.42:34371   10.1.1.100:34371      208.67.222.222:53     208.67.222.222:53
udp 93.190.177.42:35332   10.1.1.100:35332      208.67.220.220:53     208.67.220.220:53
udp 93.190.177.42:35643   10.1.1.100:35643      208.67.222.222:53     208.67.222.222:53
udp 93.190.177.42:35882   10.1.1.100:35882      208.67.220.220:53     208.67.220.220:53

The truth is that it works somehow wrong, ping domain.com takes a long time to resolve ip for the domain, although sites seem to open normally.
Here:

[email protected] ~/Рабочий стол $ ping -Dn ya.ru
PING ya.ru (93.158.134.3) 56(84) bytes of data.
[1394702353.482536] 64 bytes from 93.158.134.3: icmp_req=1 ttl=57 time=36.1 ms
[1394702354.483436] 64 bytes from 93.158.134.3: icmp_req=2 ttl=56 time=35.8 ms
[1394702355.485298] 64 bytes from 93.158.134.3: icmp_req=3 ttl=56 time=35.7 ms
[1394702356.487838] 64 bytes from 93.158.134.3: icmp_req=4 ttl=57 time=36.3 ms
[1394702357.489522] 64 bytes from 93.158.134.3: icmp_req=5 ttl=56 time=36.6 ms
[1394702358.490895] 64 bytes from 93.158.134.3: icmp_req=6 ttl=57 time=36.2 ms
[1394702359.492631] 64 bytes from 93.158.134.3: icmp_req=7 ttl=57 time=36.5 ms
^C
--- ya.ru ping statistics ---
7 packets transmitted, 7 received, 0% packet loss, time 6009ms
rtt min/avg/max/mdev = 35.735/36.234/36.619/0.353 ms
[email protected] ~/Рабочий стол $ ping -D ya.ru
PING ya.ru (93.158.134.3) 56(84) bytes of data.
[1394702373.908500] 64 bytes from www.yandex.ru (93.158.134.3): icmp_req=1 ttl=57 time=37.0 ms
[1394702378.996749] 64 bytes from www.yandex.ru (93.158.134.3): icmp_req=2 ttl=57 time=36.0 ms
[1394702384.081748] 64 bytes from www.yandex.ru (93.158.134.3): icmp_req=3 ttl=57 time=35.7 ms
^C[1394702389.168423] 64 bytes from www.yandex.ru (93.158.134.3): icmp_req=4 ttl=56 time=36.2 ms

--- ya.ru ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 15261ms
rtt min/avg/max/mdev = 35.750/36.268/37.048/0.480 ms

In the first case, everything is as it should be - pang once per second. In the second case, when the names are resolved, the ping goes every 5 seconds.
How to fix it? And after connecting to the Internet, access to the internal network will not be possible?

throughtheether, 2014-03-13
@throughtheether

How to fix it?

It is necessary to look towards DNS servers. Show output
and
Most likely, it is possible if you complicate the NAT rules a bit by adding a route-map. Now I'll sketch.

throughtheether, 2014-03-13
@throughtheether

Setting up NAT for access to the local network and the Internet will most likely look like this (you can copy-paste from here to the console in configure mode, saving the working configuration before that):

interface FastEthernet4
 ip nat outside
 exit
no ip nat inside source list INSIDE_NAT interface Dialer0 overload
ip nat inside source route-map INTERNET interface Dialer0 overload
ip nat inside source route-map LOCAL interface FastEthernet4 overload
route-map INTERNET permit 10
 match ip address INSIDE_NAT
 match interface Dialer0
route-map LOCAL permit 10
 match ip address INSIDE_NAT
 match interface FastEthernet4

Checked in GNS3, the following results:

Router#sh ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
icmp 93.190.178.73:18  10.1.1.100:18      8.8.8.8:18         8.8.8.8:18
icmp 192.168.138.152:19 10.1.1.100:19     192.168.117.249:19 192.168.117.249:19

topbanana, 2014-03-13
@topbanana

Hooray! Both networks are up and running! =)
Now about DNS, here is the output you were asking:

$ time dig ya.ru

; <<>> DiG 9.9.2-P1 <<>> ya.ru
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43348
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;ya.ru.				IN	A

;; ANSWER SECTION:
ya.ru.			1077	IN	A	213.180.204.3
ya.ru.			1077	IN	A	93.158.134.3
ya.ru.			1077	IN	A	213.180.193.3

;; Query time: 46 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Thu Mar 13 19:13:33 2014
;; MSG SIZE  rcvd: 82


real	0m1.070s
user	0m0.004s
sys	0m0.016s

and

$ time dig @8.8.8.8 ya.ru

; <<>> DiG 9.9.2-P1 <<>> @8.8.8.8 ya.ru
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27283
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;ya.ru.				IN	A

;; ANSWER SECTION:
ya.ru.			3475	IN	A	213.180.193.3
ya.ru.			3475	IN	A	213.180.204.3
ya.ru.			3475	IN	A	93.158.134.3

;; Query time: 50 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Mar 13 19:15:59 2014
;; MSG SIZE  rcvd: 82


real	0m0.069s
user	0m0.008s
sys	0m0.008s

throughtheether, 2014-03-13
@throughtheether

Here you can see that for some reason (multi-level forwarding, probably) the default DNS server (208.67.222.222) responds much slower than Google's DNS (8.8.8.8). Try to register 8.8.8.8 as a DNS server - either in the operating system settings, or (I think it is preferable) in the dhcp server settings on the router:

ip dhcp pool LAN
   dns-server 8.8.8.8

topbanana, 2014-03-14
@topbanana

Again we need your help. Still, something is not working right. And I don't even know how to describe it. Some sites are loaded either not the first time, or loaded partially. It is noticeable in the pictures. For example, a picture does not load, or it loads only halfway, and if you refresh the page a couple of times, it may load normally.
Here is a screenshot. The site 500px.com is very indicative, where a dynamic address is generated for pictures. On the left - a browser opened in a terminal session from another computer that is not connected to a custom router, on the right - the same page through a router. The provider is the same.
clickable The config has changed a little (but the problem was before the new changes were made), here it is:

running-config

version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service internal
!
hostname router
!
boot-start-marker
boot-end-marker
!
enable secret 5 key
!
no aaa new-model
!
resource policy
!
clock timezone Ukraine 2
clock summer-time Ukraine recurring last Sun Mar 2:00 last Sun Oct 2:00
ip subnet-zero
no ip gratuitous-arps
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 10.1.1.1 10.1.1.99
!
ip dhcp pool LAN
network 10.1.1.0 255.255.255.0
dns-server 10.1.1.1
default-router 10.1.1.1
!
!
ip domain name domain.com
ip name-server 8.8.8.8
ip name-server 4.2.2.2
ip name-server 208.67.222.222
ip name-server 208.67.220.220
ip multicast-routing
ip ssh version 2
vpdn enable
!
vpdn-group 1
request-dialin
protocol pptp
rotary-group 0
initiate-to ip 192.168.117.249
!
!
!
!
username user secret 5 key
archive
log config
logging enable
hidekeys
!
!
!
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
mac-address 0050.bfb5.b00a
ip address dhcp client-id FastEthernet4
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface Vlan1
ip address 10.1.1.1 255.255.255.0
ip nat inside
ip nat enable
ip virtual-reassembly
!
interface Dialer0
mtu 1440
ip address negotiated
ip pim dense-mode
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer in-band
dialer idle-timeout 0
dialer string inter.net
dialer vpdn
dialer-group 1
no cdp enable
ppp chap hostname login
ppp chap password 0 key
!
ip default-gateway 10.1.1.1
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0
ip route 192.168.0.0 255.255.0.0 FastEthernet4 dhcp
!
ip dns server
!
no ip http server
no ip http secure-server
ip nat inside source route-map INTERNET interface Dialer0 overload
ip nat inside source route-map LOCAL interface FastEthernet4 overload
!
ip access-list standard INSIDE_NAT
permit 10.1.1.0 0.0.0.255
!
dialer-list 1 protocol ip permit
!
route-map INTERNET permit 10
match ip address INSIDE_NAT
match interface Dialer0
!
route-map LOCAL permit 10
match ip address INSIDE_NAT
match interface FastEthernet4
!
!
control-plane
!
!
line con 0
logging synchronous
no modem enable
line aux 0
line vty 0 4
login local
transport input ssh
!
scheduler max-task-time 5000
ntp clock-period 17179378
ntp server 67.215.65.132
ntp server 91.236.251.12
end

throughtheether, 2014-03-18
@throughtheether

I'm sorry, I read your last question just now. See where exactly the slowdown occurs with the help of a waterfall diagram (waterfall diagram, in firefox - F12-Network). Show diagrams for the same site and different connections. Send the output show process cpu sortedwith and without traffic.

topbanana, 2014-03-19
@topbanana

Better late)
I did, the first link is a connection via home tp-link
https://dl.dropboxusercontent.com/u/4242495/1.png
The second one is connected via cisco, I try to load the page. The page address is different, because
FF cached the pictures and showed them as it should https://dl.dropboxusercontent.com/u/4242495/2.png
Then I got tired of waiting and stopped the download via esc
https://dl.dropboxusercontent.com/u/4242495/3. png
is show process cpu sorted after stop loading
https://dl.dropboxusercontent.com/u/4242495/4.png
this is almost immediately after trying to refresh the page
https://dl.dropboxusercontent.com/u/4242495/5.png
It's a few seconds after trying to update
https://dl.dropboxusercontent.com/u/4242495/6.png

topbanana, 2014-03-19
@topbanana

Probably it makes no sense to show, your advice helped, everything began to open up. Thanks again!

throughtheether, 2014-03-19
@throughtheether

You're welcome.