思科2821路由器出现的怪现象求大家帮看一下,谢谢~~!

viv#sh run
1 N- M$ D4 D% K2 [, K3 y/ WBuilding configuration...
! r: }6 @  M1 e7 d
) D6 q6 o3 ^: f& m* YCurrent configuration : 1676 bytes
" z) C, p6 u& }+ b) Y5 h4 J!
version 12.4
: d& n4 V+ D" o+ K) h! R0 Wservice timestamps debug datetime msec
service timestamps log datetime msec
+ I' K  t5 O$ `3 Yservice password-encryption
5 R' t4 \9 e1 x% p!
hostname viv
!
boot-start-marker
5 Q% Z! l2 G6 w  iboot-end-marker
!
enable password 7 020706585A545C6D
1 O' P; h( n3 V!
no aaa new-model
!
resource policy
!
!
- [/ |* t. b. V2 v!
8 ?& `2 G( ^7 h) W; hip cef
!
, x8 f* i/ k% W2 Z!
!
! a3 U# A' M5 k" o$ F% G$ ]( zvoice-card 0
5 y% V' _" H; G8 ?- k no dspfarm
!
!
0 M2 y( v4 W0 C% k: f# ~8 r$ x  w2 D8 O!
!
!
!
!
!
* Z& _3 C* P" d0 I; f: A7 Z!
$ S' X, m/ o" ?/ N: M' i' x!
!
5 x' o! J! j7 E5 M3 V( K' M!
  a! Q. X" e- i0 _" f5 W5 y!
! `' _0 W% f3 E# c5 R, X+ n!
8 n: H7 A1 U9 g0 z- X, X5 n!
!
!
!
/ r2 o8 \. d& H* p" B!
!
interface GigabitEthernet0/0
4 F! m( X# ]8 P ip address 172.30.30.18 255.255.255.252
ip nat outside
+ u1 V5 P  z6 n, u, a# M: M8 Q duplex auto
speed auto
  x( l0 P2 @. W5 \' G2 I!
interface GigabitEthernet0/1
- Z9 h2 S- |* t2 m9 S5 b3 R ip address 211.111.226.145 255.255.255.248 secondary
ip address 124.190.155.113 255.255.255.248 secondary
ip address 192.168.1.1 255.255.255.0
ip helper-address 192.168.1.70
; Z8 m6 L; s2 D6 i3 U0 @ ip accounting output-packets
5 ^4 X% v5 |1 A4 D9 d8 A2 ] ip nat inside
) s8 A( @1 i- e0 r duplex auto
speed auto
!
ip route 0.0.0.0 0.0.0.0 172.30.30.17
+ t0 F3 b% f+ j2 W; T!
2 e1 Z5 {  K5 q2 p- A# y!
5 H/ i4 h* l% R4 Ino ip http server
9 E+ a' H: s1 [) ano ip http secure-server
. Z, S) r& M  r/ ]ip nat pool viv 211.111.226.150 211.111.226.150 netmask 255.255.255.252
. U: U( s4 \" P* X3 Sip nat inside source list 1 pool viv overload
' {/ a* |' b$ M/ _, ^6 J6 b# mip nat inside source static tcp 192.168.1.76 443 124.190.155.114 443 extendable
" W4 O) J3 B" h$ a0 J* Dip nat inside source static tcp 192.168.1.70 3389 124.190.155.115 3389 extendabl
e
0 W$ n4 ?# ^) T0 `" p4 v4 ^5 r+ lip nat inside source static tcp 192.168.1.77 5756 124.190.155.116 5756 extendabl
e
ip nat inside source static tcp 192.168.1.74 25 124.190.155.117 25 extendable
ip nat inside source static tcp 192.168.1.74 110 124.190.155.117 110 extendable
/ j3 t- x4 \; j9 iip nat inside source static tcp 192.168.1.74 443 124.190.155.117 443 extendable
ip nat inside source static tcp 192.168.1.75 80 124.190.155.118 80 extendable
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
7 V) ]3 H+ a% d!
' C/ E% m5 ?& D, D& g!
! M2 o2 ^8 _5 Z+ {  X6 econtrol-plane
!
!
!
!
!
!
/ O8 u5 o7 G7 y# k!
!
" Y' x& S0 u  [  v0 p; B8 x/ C' v!
. \2 v$ ]/ j. M4 T8 |6 K; Tline con 0
line aux 0
: t" s5 d9 [7 Pline vty 0 4
! ?, {( N2 Q( \' }* D+ {+ t: I password 7 08204E4D584B565B
+ }$ k* B% F7 Y# E) T, P login
" U, u  r7 e3 m!
+ \$ s7 i( H1 s3 n# g( Xscheduler allocate 20000 1000
!
% n; q  b& P& q$ Eend

3 E/ P- A- b+ `3 p4 C0 Aviv#
" v# c3 d6 y  f$ U: }8 p2 ]8 n6 i
6 u4 k6 b1 q! d1 C) B( V/ ]事情是这样的,用户有几台服务器需要外网访问,上边是用户的路由器配置,G0/0为外口,G0/1为内口,用户有两段各8个公网IP地址,与ISP用的4个私网地址互联,上联ISP端为华为5700三层交换机,路由设置为
, s$ q4 c, ~0 V! `# Cip route-static 124.190.155.112 255.255.255.248 172.30.30.18
ip route-static 211.111.226.144 255.255.255.248 172.30.30.18
# o5 D/ {9 X* r# F% ?( Q8 K目前用户内网有两台可用服务器,IP地址分别为192.168.1.70和192.168.1.77,开启远程桌面连接服务,192.168.1.70用的124.190.155.115作的TCP3389端口映射,而192.168.1.77用的124.190.155.116作的TCP5756端口映射,都可以正常连接,后边的几个地址作好了映射但是服务器没有到位,现在发现一个问题,我在外网(与用户的ISP不是同一个ISP)测试这些地址,发现只有124.190.155.113到116可以ping通,而ping124.190.155.117丢包非常严重,124.190.155.118则根本不通,ping211.111.226.145和当前地址池里的211.111.226.150也可以ping通,如果把124.190.155.118作一地址池则124.190.155.118也可以ping通,本以为没接服务器不能ping通,但是发现124.190.155.114也没有接服务器则可以ping通,不知此问题出在什么地方.把上边远程桌面的124.190.155.116改为124.190.155.118让此服务器通过124.190.155.118则无法打开远程连接.ISP方面也查过上端路由指向及是否存在垃圾路由但均显示是正常的.
用户物理结构从ISP华为5700通过一对单模双芯光转换器接到一台H3C的两层交换机再到一台锐捷两层交换机,交换机间使用trunk加VLAN方式连接,在锐捷两层交换机端口上作的限速(用户10M带宽),锐捷设备端对应用户端口接了一点对点微波设备无线打到用户端15楼,再背对背接另一套无线策波设备打到用户端.
这个问题困扰了用户和ISP很久一直未能解决,开始时包括用户网关的所有地址外网均无法ping通,路由器远程也无法telnet,但后来不知怎么这些好了,但是124.190.155.118还是不行,但用户普通上网一直是正常的.上传下载速率也够,ping外网也不丢包....好奇怪.......

更正一下,用户的路由器型号我弄错了,是思科2821,不是2811........
为了尊重用户,用户的公网地址我在这里稍作了些改变.

又发现一个情况,在用户路由器上ping不通124.190.155.118,sh arp也看不到此地址的MAC,其他的地址都可以ping通也能看到MAC地址,clear arp过也不行!
2 v' [# ?# S  V! L. g0 q
viv#ping 124.190.155.118

$ p9 F- }1 x" B% o* A" SType escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 124.190.155.118, timeout is 2 seconds:
.....
2 K1 _' ?6 h3 x2 k/ s2 x; p, ]/ mSuccess rate is 0 percent (0/5)
viv#
( p3 ^& v/ x) c4 s
$ t, g. g8 L" B, U但是其他 的地址全可以通.....
viv#ping 124.190.155.117
9 g+ Y' H$ |' o& y4 M7 ^; _7 X, M
Type escape sequence to abort.
! k9 g3 W: _- u1 H: R  mSending 5, 100-byte ICMP Echos to 124.190.155.117, timeout is 2 seconds:
!!!!!
) |2 P4 j! \# U% ^' `Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
9 s- }# I# ~' nviv#ping 124.190.155.116

) d* J7 v9 [' M% n: KType escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 124.190.155.116, timeout is 2 seconds:
2 Y8 h) G$ T+ p6 J4 j!!!!!
0 V% @7 ]" E: i: A8 `# A# q8 q+ w. USuccess rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
5 i' f% [' n) H, z# _viv#ping 124.190.155.115
' G0 S6 s9 w# X! H# I4 B
* I2 s7 a0 R/ h- LType escape sequence to abort.
/ [5 F% ^6 U5 j; TSending 5, 100-byte ICMP Echos to 124.190.155.115, timeout is 2 seconds:
% V6 p+ ]6 A6 [- N' l; b8 ?!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
$ D8 A* O9 y6 P1 o2 Q  Xviv#ping 124.190.155.114
; L8 w( u& a- Q' d* {' e+ U, ^8 m
Type escape sequence to abort.
/ w$ Y' [# C7 m$ S$ m0 b( KSending 5, 100-byte ICMP Echos to 124.190.155.114, timeout is 2 seconds:
8 q4 K- R$ O, H9 z8 ^0 j; K4 D  f: O6 I!!!!!
7 r( g  h. d0 ?# N% ?$ V4 d, k* ESuccess rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
viv#
8 p9 Y8 I. X$ u2 b3 F' x# jviv#ping 211.111.226.150

4 X* W1 S. S" S& hType escape sequence to abort.
! I  G6 R* d1 t; z0 aSending 5, 100-byte ICMP Echos to 211.111.226.150, timeout is 2 seconds:
, d: Y6 {8 k: Z  o" e  E- v!!!!!
* J" ^3 }3 C- ZSuccess rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
# j( Y+ f' q' A6 r" S% dviv#

汗,我刚才试着把124.190.155.118那条静态映射删除重新写了下,在路由器里可以ping通了,但是从外网仍ping不通,之前操作是我把124.190.155.118放到地址池里作转换从外网可以ping通,但放回静态映射后从外网就不通了~~~

viv#ping 124.190.155.118
) |3 u& W+ X( e9 Z/ e0 p7 P% J
/ f. N. u8 J- [$ T  {Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 124.190.155.118, timeout is 2 seconds:
: E/ k/ m, f1 X, b6 z!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
: Y3 l- K  R# ?) n
: z4 O; p: O5 ~" w5 i) d/ A3 T会是用户路由器本身的问题么?
! D6 N6 ~, X- }8 ?用户表示他换过一台路由器了也没什么效果.
下面是用户路由器版本信息
viv# sh ver
1 Q  k0 Z! D# J7 Y  PCisco IOS Software, 2800 Software (C2800NM-SPSERVICESK9-M), Version 12.4(6)T7, R
ELEASE SOFTWARE (fc5)
9 X3 s3 _, w- \0 p  a" U* yTechnical Support:
8 E, \* d9 U$ dCopyright (c) 1986-2007 by Cisco Systems, Inc.
1 ^/ K3 M- K7 ], V) P* A, J8 TCompiled Thu 29-Mar-07 05:08 by khuie

) I; S7 I0 K: k& P! t% u, `% jROM: System Bootstrap, Version 12.4(13r)T6, RELEASE SOFTWARE (fc1)

1 o4 N3 l. G& g; H: L2 w6 B* A& ^9 Gviv uptime is 1 week, 11 hours, 54 minutes
6 t7 D& C- }: |; S  `System returned to ROM by reload at 02:13:17 UTC Tue Jul 16 2013
System image file is "flash:c2800nm-spservicesk9-mz.124-6.T7.bin"


This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
  M- J4 G) s6 G; J' vImporters, exporters, distributors and users are responsible for
9 ^: Q; I" b7 i9 ncompliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:


If you require further assistance please contact us by sending email to
' J  C9 C6 w$ s2 k2 v2 h.

Cisco 2821 (revision 53.51) with 514048K/10240K bytes of memory.
$ ?. m4 L0 ~9 s" X, LProcessor board ID FTX0902D0SB
2 Gigabit Ethernet interfaces
1 S! F: B5 H& w5 `8 m- X* zDRAM configuration is 64 bits wide with parity enabled.
, K; x1 e+ {! s239K bytes of non-volatile configuration memory.
62720K bytes of ATA CompactFlash (Read/Write)

' H5 C  b# Q& d+ p! l4 `Configuration register is 0x2102
# A) l, l  ?% T# _- ?7 i; x2 U
viv#

cisco设备在启用nat后都可以ping得通，只要路由正常；
  {, c. E% p* v. z如果想不让cisco设备进行自动arp应答，可以使用 no-alias ；

不错不错，楼主您辛苦了。。。

没看完~~~~~~ 先顶，好同志

写的真的很不错

小手一抖，金币到手！