FN-GM Posted September 18, 2015 Posted September 18, 2015 Do you have an upstream firewall or router that you manage?
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 Boo, Done that still nothing, so at the moment I get DHCP no issue so it is communicating there, the WAN connection has the range setup, something is just blocking the traffic between his ip range and the wan
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 (edited) This is our link into the KCN router interface GigabitEthernet1/0/24 description Link to KCC WAN switchport access vlan 999 So you think there would be an issue with the IPs to this port at all? EDIT In Fact I can see a 2 ACL lists to this port and VLAN, which I cannot see how to add to it. As where this IP range is different it may sit outside the rules already there Edited September 18, 2015 by BKGarry
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 OK I am quite sure it is those ACLs assigned to the specific port that connects to the external WAN connection. The question is do I remove them, or would guys suggest adding the IP ranges from the new network for it? They are the extended lists called INBOUND-WAN and OUTBAND-WAN
FN-GM Posted September 18, 2015 Posted September 18, 2015 If you remove those ACL's from the WAN interface and see if it works. If it does we know its that. This is just as a very quick test, after that put them back on
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 (edited) Stupid question @FN-GM but how (hangs his head in shame) Edited September 18, 2015 by BKGarry
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 OK I have removed them and still no luck :-(
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 OK, I took a last stab in the dark and removed ACL 100 from VLAN 40 and the internet has started working for those clients
FN-GM Posted September 18, 2015 Posted September 18, 2015 How do these devices connect to the internet? Do you use a proxy or something?
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 From use it goes over our WAN to centrally hosted Lightspeed Rocket servers. It then prompts for username and password there, so although there is a proxy, it is not on our LAN. Removing the ACL made it work, so it may be looking at that later on to find out what would stop internet traffic
FN-GM Posted September 20, 2015 Posted September 20, 2015 I see, can you run Show IP Route on your core please? Do you know the IP of the lightspeed?
BKGarry Posted September 21, 2015 Author Posted September 21, 2015 Here you go @FN-GM NTC_Core_3750#show IP route Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route Gateway of last resort is 10.73.1.213 to network 0.0.0.0 192.168.250.0/32 is subnetted, 1 subnets D 192.168.250.255 [90/13055744] via 10.73.208.9, 2d15h, Vlan100 10.0.0.0/8 is variably subnetted, 19 subnets, 6 masks C 10.73.208.128/25 is directly connected, Vlan600 C 10.73.214.128/25 is directly connected, Vlan43 C 10.73.213.128/26 is directly connected, Vlan800 C 10.73.212.128/25 is directly connected, Vlan500 C 10.73.52.0/22 is directly connected, Vlan40 C 10.73.211.0/24 is directly connected, Vlan900 C 10.73.210.0/26 is directly connected, Vlan309 C 10.73.208.0/26 is directly connected, Vlan100 S 10.73.208.0/20 is directly connected, Null0 C 10.73.214.0/25 is directly connected, Vlan42 C 10.73.213.0/25 is directly connected, Vlan200 C 10.73.1.212/30 is directly connected, Vlan999 C 10.73.212.0/25 is directly connected, Vlan400 C 10.73.219.0/24 is directly connected, Vlan304 C 10.73.218.0/24 is directly connected, Vlan303 C 10.73.217.0/24 is directly connected, Vlan302 C 10.73.216.0/24 is directly connected, Vlan301 C 10.73.220.0/22 is directly connected, Vlan41 C 10.73.208.64/26 is directly connected, Vlan99 S* 0.0.0.0/0 [1/0] via 10.73.1.213 I am afraid that I do not know the IP address of lightspeed, it just kinda works upstreem from us on the WAN connection
FN-GM Posted September 21, 2015 Posted September 21, 2015 Try this ACL access-list 100 permit udp any any eq bootpc access-list 100 permit udp any any eq bootps access-list 100 permit udp 10.73.52.0 0.0.3.255 host 172.31.81.46 eq domain access-list 100 permit udp 10.73.52.0 0.0.3.255 host 172.31.49.46 eq domain access-list 100 permit udp 10.73.52.0 0.0.3.255 host 10.5.17.21 eq domain access-list 100 permit udp 10.73.52.0 0.0.3.255 host 10.5.9.21 eq domain access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.20.0 0.0.3.255 eq www access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.12.0 0.0.3.255 eq www access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.20.0 0.0.3.255 eq 443 access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.12.0 0.0.3.255 eq 443 access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.20.0 0.0.3.255 eq 8080 access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.12.0 0.0.3.255 eq 8080 access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.73.213.0 0.0.0.127 log access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.73.212.128 0.0.0.7 eq www access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.73.212.128 0.0.0.7 eq 443 access-list 100 permit tcp 10.73.52.0 0.0.3.255 host 10.73.1.213 eq www access-list 100 permit tcp 10.73.52.0 0.0.3.255 host 10.73.1.213 eq 443 access-list 100 deny ip 10.73.52.0 0.0.3.255 10.0.0.0 0.255.255.255 access-list 100 deny ip 10.73.52.0 0.0.3.255 192.168.0.0 0.0.255.255 access-list 100 deny ip 10.73.52.0 0.0.3.255 172.16.0.0 0.0.15.255
BKGarry Posted September 21, 2015 Author Posted September 21, 2015 Weird I put in ip access-group 100 in for VLAN 40 and it kills it off, take it out and it all works
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now