思科2821路由器出现的怪现象求大家帮看一下,谢谢~~!

viv#sh run
# V' [  Y5 m6 C2 @Building configuration...
0 E0 ~* `7 ?: y. N3 v
3 U7 L' f7 m7 d3 @% E' ~* x7 CCurrent configuration : 1676 bytes
!
0 A5 m" f7 N" u* Xversion 12.4
service timestamps debug datetime msec
, {* k/ n7 M% Y$ t7 aservice timestamps log datetime msec
4 w! w" H7 T; x! R1 T( M7 Qservice password-encryption
9 q/ ~1 i" v) B1 r9 v% A!
  w0 I1 A* T3 c9 khostname viv
!
boot-start-marker
boot-end-marker
* c0 h6 {% a5 T& B!
+ @) _% y. G; aenable password 7 020706585A545C6D
!
no aaa new-model
9 {- v7 F% O$ |- M# d, b3 W, n!
resource policy
8 g/ ]! }, d9 n3 g!
!
$ R8 c! _% I2 j3 U5 w!
ip cef
' G" F, [; i7 V$ e# k!
!
( E. R3 Y3 u6 `& R!
voice-card 0
: s' i2 a  O  u9 v4 B no dspfarm
  b' M' P' d2 p% v6 n8 K! z" w!
4 q4 q, K+ n; Q, q' C  Z. m!
!
+ U3 }  {4 ^) }% B% W!
!
!
!
# t* A9 l) q9 n: \. A!
& [7 @6 r! w0 g+ b$ N! K4 |!
!
!
!
* u' ~+ K. v8 C6 `- L0 q, F!
!
; p+ t. v' _$ j& i% d0 V!
!
8 V/ W4 i) H# t!
' D8 N! V) I6 H!
!
!
7 ^2 y+ I& m) B( ?! |interface GigabitEthernet0/0
. ~/ b$ `1 w8 W* A ip address 172.30.30.18 255.255.255.252
% h, t4 e* l+ K5 ] ip nat outside
duplex auto
, v! ]; t3 U# p* |( Y% p# I& v speed auto
!
interface GigabitEthernet0/1
ip address 211.111.226.145 255.255.255.248 secondary
: I' A: C7 t* W( [0 W1 ]' u ip address 124.190.155.113 255.255.255.248 secondary
3 t/ _0 f: S7 v5 e+ E; a% U, Q9 t/ w ip address 192.168.1.1 255.255.255.0
ip helper-address 192.168.1.70
ip accounting output-packets
1 \7 a% u; `* E ip nat inside
2 w7 A1 l) W9 S* b duplex auto
speed auto
!
ip route 0.0.0.0 0.0.0.0 172.30.30.17
!
  [( e; d: Q8 i7 \8 M3 M) N!
) [! X8 l' C8 p; Hno ip http server
no ip http secure-server
' }, N+ N" E% o# m4 Qip nat pool viv 211.111.226.150 211.111.226.150 netmask 255.255.255.252
ip nat inside source list 1 pool viv overload
ip nat inside source static tcp 192.168.1.76 443 124.190.155.114 443 extendable
; K5 q% ?! v6 o, b5 v' f" vip nat inside source static tcp 192.168.1.70 3389 124.190.155.115 3389 extendabl
( g# `. k  R3 r1 N* }$ X. o- z- ~e
ip nat inside source static tcp 192.168.1.77 5756 124.190.155.116 5756 extendabl
* x8 M5 e5 k& L7 K& Ne
0 [9 k; N7 n  k( Uip nat inside source static tcp 192.168.1.74 25 124.190.155.117 25 extendable
2 I( z# f, ?: R3 Z6 q' r( m1 a& Zip nat inside source static tcp 192.168.1.74 110 124.190.155.117 110 extendable
; u/ ]8 _2 H5 Jip nat inside source static tcp 192.168.1.74 443 124.190.155.117 443 extendable
& P! n; L9 h0 `5 c5 Sip nat inside source static tcp 192.168.1.75 80 124.190.155.118 80 extendable
!
- Q& T6 ?3 h' ^+ p) d5 ^8 Z, caccess-list 1 permit 192.168.1.0 0.0.0.255
/ W& a) e! v4 N& n!
!
/ k9 {" e# k1 @" o: Q!
control-plane
& F) u7 q# `& |; d' @& @2 M; @( w' [!
4 k% U6 k( x9 c. A" c6 ^2 {!
!
!
!
* `7 L5 \, e  a* D$ t!
!
( L& p: v( W5 O, |, |!
!
" i) h! L! R, V: J% B7 {& i6 Yline con 0
" ^9 d( j4 W# O. Q0 y" X& F; iline aux 0
line vty 0 4
& b& _/ _1 X$ X' e7 v- S password 7 08204E4D584B565B
login
( Q  g4 ^7 h5 t!
scheduler allocate 20000 1000
!
+ U3 k) W7 X" U4 R2 Uend

viv#

- L! D# l+ [/ `! Z( \* N- N3 K. L事情是这样的,用户有几台服务器需要外网访问,上边是用户的路由器配置,G0/0为外口,G0/1为内口,用户有两段各8个公网IP地址,与ISP用的4个私网地址互联,上联ISP端为华为5700三层交换机,路由设置为
; q( s6 r% Q9 D4 Q2 x/ g3 oip route-static 124.190.155.112 255.255.255.248 172.30.30.18
ip route-static 211.111.226.144 255.255.255.248 172.30.30.18
目前用户内网有两台可用服务器,IP地址分别为192.168.1.70和192.168.1.77,开启远程桌面连接服务,192.168.1.70用的124.190.155.115作的TCP3389端口映射,而192.168.1.77用的124.190.155.116作的TCP5756端口映射,都可以正常连接,后边的几个地址作好了映射但是服务器没有到位,现在发现一个问题,我在外网(与用户的ISP不是同一个ISP)测试这些地址,发现只有124.190.155.113到116可以ping通,而ping124.190.155.117丢包非常严重,124.190.155.118则根本不通,ping211.111.226.145和当前地址池里的211.111.226.150也可以ping通,如果把124.190.155.118作一地址池则124.190.155.118也可以ping通,本以为没接服务器不能ping通,但是发现124.190.155.114也没有接服务器则可以ping通,不知此问题出在什么地方.把上边远程桌面的124.190.155.116改为124.190.155.118让此服务器通过124.190.155.118则无法打开远程连接.ISP方面也查过上端路由指向及是否存在垃圾路由但均显示是正常的.
. ?% p0 s6 ~7 I, f. D& m7 o& j用户物理结构从ISP华为5700通过一对单模双芯光转换器接到一台H3C的两层交换机再到一台锐捷两层交换机,交换机间使用trunk加VLAN方式连接,在锐捷两层交换机端口上作的限速(用户10M带宽),锐捷设备端对应用户端口接了一点对点微波设备无线打到用户端15楼,再背对背接另一套无线策波设备打到用户端.
这个问题困扰了用户和ISP很久一直未能解决,开始时包括用户网关的所有地址外网均无法ping通,路由器远程也无法telnet,但后来不知怎么这些好了,但是124.190.155.118还是不行,但用户普通上网一直是正常的.上传下载速率也够,ping外网也不丢包....好奇怪.......

更正一下,用户的路由器型号我弄错了,是思科2821,不是2811........
- h" h' g$ W1 {" g# r5 A2 a为了尊重用户,用户的公网地址我在这里稍作了些改变.

又发现一个情况,在用户路由器上ping不通124.190.155.118,sh arp也看不到此地址的MAC,其他的地址都可以ping通也能看到MAC地址,clear arp过也不行!

viv#ping 124.190.155.118

1 z8 S1 k- H& r# M( l7 ^4 PType escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 124.190.155.118, timeout is 2 seconds:
% _* Y- |) ~* u& a$ l.....
Success rate is 0 percent (0/5)
1 z& D$ _, ]9 W+ Nviv#

* X$ l- p( ]8 d0 Q6 k; O0 z! G但是其他 的地址全可以通.....
viv#ping 124.190.155.117

Type escape sequence to abort.
0 l, j' s' r( R5 g- lSending 5, 100-byte ICMP Echos to 124.190.155.117, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
viv#ping 124.190.155.116
# `$ v+ Q" k% Z) `; t- d
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 124.190.155.116, timeout is 2 seconds:
!!!!!
0 v1 q4 x$ U' a: kSuccess rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
viv#ping 124.190.155.115

Type escape sequence to abort.
7 N3 n* o8 G1 D' n8 @6 r* h  WSending 5, 100-byte ICMP Echos to 124.190.155.115, timeout is 2 seconds:
+ E' c5 [( Y  e7 k: Z$ y  X!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
, V, }! H: J: qviv#ping 124.190.155.114

Type escape sequence to abort.
4 ?* {) U6 `, xSending 5, 100-byte ICMP Echos to 124.190.155.114, timeout is 2 seconds:
5 L2 H+ \) I$ O" I5 q& u4 W!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
/ x- |3 n" V2 g, \6 ]# jviv#
viv#ping 211.111.226.150
% Y9 X. Z) ^6 g# g" h. p
Type escape sequence to abort.
+ G% p# _' y0 ?$ V5 xSending 5, 100-byte ICMP Echos to 211.111.226.150, timeout is 2 seconds:
!!!!!
4 e6 Q% i8 T, W3 E* K' WSuccess rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
viv#

汗,我刚才试着把124.190.155.118那条静态映射删除重新写了下,在路由器里可以ping通了,但是从外网仍ping不通,之前操作是我把124.190.155.118放到地址池里作转换从外网可以ping通,但放回静态映射后从外网就不通了~~~

viv#ping 124.190.155.118
, z1 D+ h: \. h# q" m2 g8 O
6 s/ R' e  f6 u+ \3 y- i7 J- gType escape sequence to abort.
" D6 v1 ~$ ]( K& u; [Sending 5, 100-byte ICMP Echos to 124.190.155.118, timeout is 2 seconds:
!!!!!
& S! `! H# I/ }9 F* J. }# KSuccess rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

会是用户路由器本身的问题么?
- M2 t6 }" @/ N4 Y# T用户表示他换过一台路由器了也没什么效果.
8 y6 l; p9 i: Z下面是用户路由器版本信息
viv# sh ver
$ G9 c8 S. }0 i6 ^Cisco IOS Software, 2800 Software (C2800NM-SPSERVICESK9-M), Version 12.4(6)T7, R
ELEASE SOFTWARE (fc5)
. a/ A* D5 P0 m# T1 b1 ~Technical Support:
5 U% s+ X4 ]0 a. }6 T3 r4 E( VCopyright (c) 1986-2007 by Cisco Systems, Inc.
8 i- X* r+ O- p( lCompiled Thu 29-Mar-07 05:08 by khuie
- e! x" j  p# s' @$ D1 X1 F
) A1 h: d% h7 gROM: System Bootstrap, Version 12.4(13r)T6, RELEASE SOFTWARE (fc1)

viv uptime is 1 week, 11 hours, 54 minutes
8 m) h3 G8 ^+ W/ F8 I: ]System returned to ROM by reload at 02:13:17 UTC Tue Jul 16 2013
System image file is "flash:c2800nm-spservicesk9-mz.124-6.T7.bin"


% g" H  H( {- r7 @, u# \1 {This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
  E% {: p) N; D$ ~* ?agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
( O" n! o/ A% |# H# w
+ I9 y9 F0 N1 e6 G' X7 C, tA summary of U.S. laws governing Cisco cryptographic products may be found at:


: {4 H# [+ e1 Y% t" B2 y* q1 bIf you require further assistance please contact us by sending email to
.

( o8 \( o, q0 r; |; v/ w7 eCisco 2821 (revision 53.51) with 514048K/10240K bytes of memory.
Processor board ID FTX0902D0SB
2 Gigabit Ethernet interfaces
/ z) f4 a3 h& jDRAM configuration is 64 bits wide with parity enabled.
239K bytes of non-volatile configuration memory.
! Z5 B& ~, Z# Y* T; Q62720K bytes of ATA CompactFlash (Read/Write)

1 ]$ C  r8 d/ o; M+ NConfiguration register is 0x2102
5 v4 l7 O# a- j- r  J
viv#

cisco设备在启用nat后都可以ping得通，只要路由正常；
如果想不让cisco设备进行自动arp应答，可以使用 no-alias ；

不错不错，楼主您辛苦了。。。

没看完~~~~~~ 先顶，好同志

写的真的很不错

小手一抖，金币到手！