思科2821路由器出现的怪现象求大家帮看一下,谢谢~~!

viv#sh run
5 ~1 o5 [; H2 C1 u# t3 s( f4 YBuilding configuration...

8 m$ i2 N, R8 g3 e9 }0 q& V' hCurrent configuration : 1676 bytes
% t4 h- R+ N3 J!
& H0 Y" @6 G3 f9 A* I1 y) J2 t% j% xversion 12.4
3 A1 N7 F4 C% Hservice timestamps debug datetime msec
service timestamps log datetime msec
9 _3 i# s. t8 E/ R% B: _- rservice password-encryption
!
$ P! I. @4 m9 [7 P% jhostname viv
!
/ i6 B. A/ W8 E/ l; q/ W- Mboot-start-marker
boot-end-marker
!
enable password 7 020706585A545C6D
!
' Y+ E2 l' X. F: Bno aaa new-model
!
resource policy
!
" Y, Q+ U0 @' u& @7 \7 r& R2 e. {!
5 q8 h0 g; K' D3 Y4 I$ G!
& e7 s8 o$ W6 G& h5 n4 p' p# Z2 cip cef
!
8 l$ K; q# N, I9 L!
!
voice-card 0
( D3 @- ]  ^+ g- i no dspfarm
' q7 M0 Z& v$ i0 V!
!
!
!
!
: t& I4 W! q! J  o! x- D!
!
!
1 ?' p' b$ t( R, x; Z!
!
!
. |3 q3 k4 O, J9 S: d% F+ E!
* ^3 z  d0 b8 R9 y/ I4 S8 W! ^!
; y. `+ D8 R% x& P8 d7 m, M' ?!
/ X; G2 ]+ m5 [: p2 I!
!
3 w" K+ N* _! P3 G( K8 B- T2 `!
* u% k) ?. {- _( C2 L, f. D1 g!
!
$ c1 {) O$ ~# t!
; a% v  Q0 j. G4 V/ |interface GigabitEthernet0/0
ip address 172.30.30.18 255.255.255.252
ip nat outside
4 e) \- R) a% ~0 Y4 B) Q, M3 A4 S5 ^) u duplex auto
2 E/ C0 P! ]  U: Z2 T speed auto
. k/ x+ g. O0 ~$ i9 t!
interface GigabitEthernet0/1
ip address 211.111.226.145 255.255.255.248 secondary
ip address 124.190.155.113 255.255.255.248 secondary
ip address 192.168.1.1 255.255.255.0
' `! e# g7 \- a9 Q ip helper-address 192.168.1.70
ip accounting output-packets
ip nat inside
duplex auto
8 s' ]% c1 r% O( ]6 } speed auto
!
ip route 0.0.0.0 0.0.0.0 172.30.30.17
!
: w) Y* h, x3 X/ T+ a( D' {!
+ h6 E# J; l( ?3 ~8 |no ip http server
no ip http secure-server
5 T5 [( V( F. w' E3 zip nat pool viv 211.111.226.150 211.111.226.150 netmask 255.255.255.252
/ Z  |, X4 R0 @ip nat inside source list 1 pool viv overload
ip nat inside source static tcp 192.168.1.76 443 124.190.155.114 443 extendable
ip nat inside source static tcp 192.168.1.70 3389 124.190.155.115 3389 extendabl
% n; ?. |+ E2 he
ip nat inside source static tcp 192.168.1.77 5756 124.190.155.116 5756 extendabl
  D% Q* f: \/ f7 F- V" R: \e
1 H" J/ z  [% w  u& Z% `' Lip nat inside source static tcp 192.168.1.74 25 124.190.155.117 25 extendable
ip nat inside source static tcp 192.168.1.74 110 124.190.155.117 110 extendable
$ @( ^# i: O' @2 C5 D" b8 rip nat inside source static tcp 192.168.1.74 443 124.190.155.117 443 extendable
ip nat inside source static tcp 192.168.1.75 80 124.190.155.118 80 extendable
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
!
!
$ h, Y2 ]6 g3 F* O8 d" ^control-plane
" d0 ?9 `$ b9 H!
' {# q; I# X1 }, A7 X3 v!
!
2 X; L: Y2 p+ w8 Q7 k) e!
!
!
!
. E) m9 u. W) m2 I* a!
!
line con 0
line aux 0
: [4 P8 y  @& u! C' A7 R8 a( A: a0 b  `$ Iline vty 0 4
password 7 08204E4D584B565B
login
!
scheduler allocate 20000 1000
!
4 r/ G+ |# B3 n/ Xend
: D: r7 t3 v6 k2 V
viv#
! g" F3 v5 `& u( ^+ j4 n; {
事情是这样的,用户有几台服务器需要外网访问,上边是用户的路由器配置,G0/0为外口,G0/1为内口,用户有两段各8个公网IP地址,与ISP用的4个私网地址互联,上联ISP端为华为5700三层交换机,路由设置为
; J5 f( v: T( j' `% ]ip route-static 124.190.155.112 255.255.255.248 172.30.30.18
ip route-static 211.111.226.144 255.255.255.248 172.30.30.18
: a- K0 Y. a0 Q( u9 u目前用户内网有两台可用服务器,IP地址分别为192.168.1.70和192.168.1.77,开启远程桌面连接服务,192.168.1.70用的124.190.155.115作的TCP3389端口映射,而192.168.1.77用的124.190.155.116作的TCP5756端口映射,都可以正常连接,后边的几个地址作好了映射但是服务器没有到位,现在发现一个问题,我在外网(与用户的ISP不是同一个ISP)测试这些地址,发现只有124.190.155.113到116可以ping通,而ping124.190.155.117丢包非常严重,124.190.155.118则根本不通,ping211.111.226.145和当前地址池里的211.111.226.150也可以ping通,如果把124.190.155.118作一地址池则124.190.155.118也可以ping通,本以为没接服务器不能ping通,但是发现124.190.155.114也没有接服务器则可以ping通,不知此问题出在什么地方.把上边远程桌面的124.190.155.116改为124.190.155.118让此服务器通过124.190.155.118则无法打开远程连接.ISP方面也查过上端路由指向及是否存在垃圾路由但均显示是正常的.
5 n( {4 u3 s! t) V9 O/ A用户物理结构从ISP华为5700通过一对单模双芯光转换器接到一台H3C的两层交换机再到一台锐捷两层交换机,交换机间使用trunk加VLAN方式连接,在锐捷两层交换机端口上作的限速(用户10M带宽),锐捷设备端对应用户端口接了一点对点微波设备无线打到用户端15楼,再背对背接另一套无线策波设备打到用户端.
- L; x3 e# H8 x; f* c1 \这个问题困扰了用户和ISP很久一直未能解决,开始时包括用户网关的所有地址外网均无法ping通,路由器远程也无法telnet,但后来不知怎么这些好了,但是124.190.155.118还是不行,但用户普通上网一直是正常的.上传下载速率也够,ping外网也不丢包....好奇怪.......

更正一下,用户的路由器型号我弄错了,是思科2821,不是2811........
为了尊重用户,用户的公网地址我在这里稍作了些改变.

又发现一个情况,在用户路由器上ping不通124.190.155.118,sh arp也看不到此地址的MAC,其他的地址都可以ping通也能看到MAC地址,clear arp过也不行!

viv#ping 124.190.155.118

Type escape sequence to abort.
8 }: [! ?$ G7 q$ |Sending 5, 100-byte ICMP Echos to 124.190.155.118, timeout is 2 seconds:
.....
. `0 U. v5 s7 J2 @' ?Success rate is 0 percent (0/5)
% j; M) y# H  {$ U5 V# ?; ~& @viv#
/ M- |! \# Y- J, q7 K
0 k5 Z+ F% E8 i+ O但是其他 的地址全可以通.....
viv#ping 124.190.155.117

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 124.190.155.117, timeout is 2 seconds:
7 `& E" j8 W$ x. t6 x+ a) h!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
viv#ping 124.190.155.116
; t+ I! F  M( R! M1 {
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 124.190.155.116, timeout is 2 seconds:
; k# ]- M7 I- e!!!!!
0 Y( `! i  ~% s  uSuccess rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
viv#ping 124.190.155.115

, [! a- R) v- D& lType escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 124.190.155.115, timeout is 2 seconds:
+ Q/ ]1 W7 ^; K!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
viv#ping 124.190.155.114
9 d3 l( d4 [/ w9 f/ |- }
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 124.190.155.114, timeout is 2 seconds:
' x4 U, U. l) {( J!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
viv#
; u+ s2 m; `# Xviv#ping 211.111.226.150

Type escape sequence to abort.
0 ?1 h' W# z. ]7 S: Y2 s2 w7 cSending 5, 100-byte ICMP Echos to 211.111.226.150, timeout is 2 seconds:
; o1 h7 O+ o. F0 o' L1 M/ i& W!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
viv#

汗,我刚才试着把124.190.155.118那条静态映射删除重新写了下,在路由器里可以ping通了,但是从外网仍ping不通,之前操作是我把124.190.155.118放到地址池里作转换从外网可以ping通,但放回静态映射后从外网就不通了~~~

viv#ping 124.190.155.118

Type escape sequence to abort.
5 }+ K' W) w0 ZSending 5, 100-byte ICMP Echos to 124.190.155.118, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
1 z  ^5 F1 p2 k8 ^. ]- t$ s( d8 x
  I4 n$ {$ a6 }# x会是用户路由器本身的问题么?
用户表示他换过一台路由器了也没什么效果.
1 a8 e; V1 a8 M3 t下面是用户路由器版本信息
5 Y  b8 f! f, u; d/ dviv# sh ver
Cisco IOS Software, 2800 Software (C2800NM-SPSERVICESK9-M), Version 12.4(6)T7, R
# A. f0 P, s9 H( S1 \ELEASE SOFTWARE (fc5)
Technical Support:
4 U* _: M& S/ C, C: {) y# UCopyright (c) 1986-2007 by Cisco Systems, Inc.
0 ^8 c+ H& n; ?Compiled Thu 29-Mar-07 05:08 by khuie
& g' p  }/ d; D( M* _
ROM: System Bootstrap, Version 12.4(13r)T6, RELEASE SOFTWARE (fc1)
4 B) s/ A/ t8 A, M$ ]9 V
viv uptime is 1 week, 11 hours, 54 minutes
+ Y3 F+ i# K0 L; \. jSystem returned to ROM by reload at 02:13:17 UTC Tue Jul 16 2013
0 B5 [' [1 S3 F& L5 _System image file is "flash:c2800nm-spservicesk9-mz.124-6.T7.bin"
9 C% A3 E8 K$ G0 l, K6 K

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
( G6 h( {, f4 e& iImporters, exporters, distributors and users are responsible for
( F$ P  K/ Y* gcompliance with U.S. and local country laws. By using this product you
8 @: q" N5 @/ Q: L& Eagree to comply with applicable laws and regulations. If you are unable
6 R) E& _7 [- c6 x7 M) a. J5 [/ v% ~to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
! i* }) I2 {/ f3 M' Z  ?: b
$ K# {4 E( O$ C/ i' q
If you require further assistance please contact us by sending email to
.

+ i3 V4 U! D5 L- {$ {& ZCisco 2821 (revision 53.51) with 514048K/10240K bytes of memory.
Processor board ID FTX0902D0SB
2 Gigabit Ethernet interfaces
; q2 d2 {6 |6 BDRAM configuration is 64 bits wide with parity enabled.
239K bytes of non-volatile configuration memory.
62720K bytes of ATA CompactFlash (Read/Write)
' e4 ?5 K: t: p& k
( j/ l, f3 A( D9 h7 d: f+ J2 q6 iConfiguration register is 0x2102
8 v# f3 e% d  ^0 g
viv#

cisco设备在启用nat后都可以ping得通，只要路由正常；
如果想不让cisco设备进行自动arp应答，可以使用 no-alias ；

不错不错，楼主您辛苦了。。。

没看完~~~~~~ 先顶，好同志

写的真的很不错

小手一抖，金币到手！