Cisco 887 VA webseiten werden nicht aufgebaut

[yast]

Hallo,

ich habe seit kurzem einen Cisco 887 VA. Betreibe das ganze an einem Anschluss der Telekom VDSL.
Wenn ich mich per ssh auf der Konsole einlogge kann ich ping's und lookups absetzen. Mache ich das ganze von einem Clienten-PC bekomme ich:

PING google.de (173.194.44.56): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1

D.H. DNS lookup schein zu funktionieren aber danach ist der "Wurm" drin.

wäre nett wenn jemand mal über meine config schauen könnte an was es liegen könnte.

Vielen Dank.

-------

Current configuration : 5761 bytes
!
! Last configuration change at 16:02:18 Berlin Fri Mar 1 2013 by yast
version 15.1
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname xxx
!
boot-start-marker
boot-end-marker
!
!
no logging buffered
no logging console
enable secret xxx
!
no aaa new-model
memory-size iomem 10
clock timezone Berlin 1 0
clock summer-time Berlin date Mar 30 2003 2:00 Oct 26 2003 3:00
crypto pki token default removal timeout 0
!
crypto pki trustpoint test_trustpoint_config_created_for_sdm
subject-name [email protected]
revocation-check crl
!
!
ip source-route
!
!
!
ip dhcp excluded-address 192.168.1.1
ip dhcp excluded-address 192.168.2.1
!
ip dhcp pool xxx
import all
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
!
ip dhcp pool xxx
import all
network 192.168.2.0 255.255.255.0
default-router 192.168.2.1
dns-server 217.0.43.113 217.0.43.97
!
!
no ip cef
ip domain name xxx.xxx
ip name-server 4.2.2.5
ip name-server 4.2.2.6
no ipv6 cef
!
!
parameter-map type regex ccp-regex-nonascii
pattern [^\x00-\x80]
!
!
!
!
controller VDSL 0
!
no ip ftp passive
!
class-map type inspect match-any ccp-skinny-inspect
match protocol skinny
class-map type inspect match-any ccp-cls-insp-traffic
match protocol dns
match protocol ftp
match protocol https
match protocol icmp
match protocol imap
match protocol pop3
match protocol netshow
match protocol shell
match protocol realmedia
match protocol rtsp
match protocol smtp
match protocol sql-net
match protocol streamworks
match protocol tftp
match protocol vdolive
match protocol tcp
match protocol udp
class-map type inspect match-all ccp-insp-traffic
match class-map ccp-cls-insp-traffic
class-map type inspect match-any ccp-h323nxg-inspect
match protocol h323-nxg
class-map type inspect match-any ccp-cls-icmp-access
match protocol icmp
match protocol tcp
match protocol udp
class-map type inspect match-any ccp-h225ras-inspect
match protocol h225ras
class-map type inspect match-any ccp-h323annexe-inspect
match protocol h323-annexe
class-map type inspect match-all SDM_GRE
match access-group name SDM_GRE
class-map type inspect match-any ccp-h323-inspect
match protocol h323
class-map type inspect match-all ccp-icmp-access
match class-map ccp-cls-icmp-access
class-map type inspect match-all ccp-invalid-src
match access-group 100
class-map type inspect match-any ccp-sip-inspect
match protocol sip
class-map type inspect match-all ccp-protocol-http
match protocol http
!
!
policy-map type inspect ccp-permit-icmpreply
class type inspect ccp-icmp-access
inspect
class class-default
pass
policy-map type inspect ccp-inspect
class type inspect ccp-invalid-src
drop log
class type inspect ccp-protocol-http
inspect
class type inspect ccp-insp-traffic
inspect
class type inspect ccp-sip-inspect
inspect
class type inspect ccp-h323-inspect
inspect
class type inspect ccp-h323annexe-inspect
inspect
class type inspect ccp-h225ras-inspect
inspect
class type inspect ccp-h323nxg-inspect
inspect
class type inspect ccp-skinny-inspect
inspect
class class-default
drop
policy-map type inspect ccp-permit
class class-default
drop
!
zone security in-zone
zone security out-zone
zone-pair security ccp-zp-self-out source self destination out-zone
service-policy type inspect ccp-permit-icmpreply
zone-pair security ccp-zp-in-out source in-zone destination out-zone
service-policy type inspect ccp-inspect
zone-pair security ccp-zp-out-self source out-zone destination self
service-policy type inspect ccp-permit
!
!
!
!
!
!
!
interface Ethernet0
description $ETH-WAN$
no ip address
pppoe-client dial-pool-number 1
!
interface Ethernet0.7
encapsulation dot1Q 7
pppoe-client dial-pool-number 1
!
interface ATM0
no ip address
shutdown
no atm ilmi-keepalive
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
switchport access vlan 2
no ip address
!
interface FastEthernet2
no ip address
shutdown
!
interface FastEthernet3
no ip address
shutdown
!
interface Vlan1
description $FW_INSIDE$
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip nat enable
ip virtual-reassembly in
zone-member security in-zone
ip tcp adjust-mss 1412
!
interface Vlan2
description $FW_INSIDE$
ip address 192.168.2.1 255.255.255.0
ip nat inside
ip nat enable
ip virtual-reassembly in
zone-member security in-zone
ip tcp adjust-mss 1412
!
interface Dialer1
description $FW_OUTSIDE$
ip address negotiated
ip mtu 1492
ip nat outside
ip virtual-reassembly in max-reassemblies 1024
zone-member security out-zone
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication pap callin
ppp pap sent-username [email protected] password xxx
ppp ipcp dns request accept
ppp ipcp route default
ppp ipcp address accept
!
ip forward-protocol nd
ip http server
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip dns server
!
ip access-list extended SDM_GRE
remark CCP_ACL Category=1
permit gre any any
!
access-list 100 remark CCP_ACL Category=128
access-list 100 permit ip host 255.255.255.255 any
access-list 100 permit ip 127.0.0.0 0.255.255.255 any
dialer-list 1 protocol ip permit
!
!
line con 0
line aux 0
line vty 0 4
login local
transport input ssh
!
end

[zid]

hallo yast,

falls das prob noch besteht:

- der cisc kennt 2 nat-konzepte, du nimmst das flußorientierte ("inside -> outside"). auf dialer1, vlan1 und vlan2 das "ip nat enable" mit "no" rausnehmen.

- acl fürs masquerading setzen:

Code: Alles auswählen

(config)#ip access-l st masquerade-ppp
(config-std-nacl)#p 192.168.0.0 0.0.3.255

- nat tmpl fürs masquerading setzen:

Code: Alles auswählen

(config)#ip nat i s l masquerade-ppp i D 1 o

cef könntest noch aktivieren.

lg
zid