Уважаемые хабра-люди, прошу помощи, так как уже вторые сутки не могу победить одну проблему, а именно — не открывается
www.facebook.com и несколько других сайтов.
Топология:
PPPoE-->Cisco 2801-->Свитч-->клиент
Оборудование:
Cisco 2801 (Cisco IOS Software, 2801 Software (C2801-ADVSECURITYK9-M), Version 12.4(17), RELEASE SOFTWARE (fc1))
MacPro (Lion 10.7)/Windows 7 x64
Проблема — не открывается
www.facebook.com и еще несколько нужных сайтов.
Вопрос — Как лечить?
Как выглядит проблема со стороны клиента
ping facebook.com
PING facebook.com (69.63.181.12): 56 data bytes
64 bytes from 69.63.181.12: icmp_seq=0 ttl=246 time=244.621 ms
64 bytes from 69.63.181.12: icmp_seq=1 ttl=246 time=243.474 ms
64 bytes from 69.63.181.12: icmp_seq=2 ttl=246 time=243.472 ms
ping www.facebook.com
ping: cannot resolve www.facebook.com: Unknown host
Как выглядит со стороны роутера
nskc2801#ping facebook.com
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 69.63.189.11, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 204/205/208 ms
nskc2801#ping www.facebook.com
Translating "www.facebook.com"...domain server (217.70.119.206) [OK]
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 69.171.229.11, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 244/248/260 ms
но с роутера трассировка не прохлжит ни до одного адреса.
конфиг роутера
!
version 12.4
no service pad
service timestamps debug datetime localtime show-timezone
service timestamps log datetime localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname nskc2801
!
boot-start-marker
boot-end-marker
!
!
aaa new-model
!
!
aaa authentication login default local
!
aaa session-id common
clock timezone NOVST 7
no ip source-route
ip cef
!
!
ip inspect name INSPECT_OUT dns
ip inspect name INSPECT_OUT icmp router-traffic
ip inspect name INSPECT_OUT ntp
ip inspect name INSPECT_OUT tcp router-traffic
ip inspect name INSPECT_OUT udp router-traffic
ip inspect name INSPECT_OUT http
ip inspect name INSPECT_OUT https
ip inspect name INSPECT_OUT ftp
!
!
ip ips sdf location flash://128MB.sdf
ip ips notify SDEE
ip ips name ips_rule
no ip bootp server
ip domain name name.domain.name
ip name-server 217.70.119.206
ip name-server 217.70.119.150
ip name-server 8.8.8.8
!
!
!
!
username cisco privilege 15 secret <ПАРОЛЬ>
!
!
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 2
!
!
!
!
interface FastEthernet0/0
description === WAN ===
no ip address
no ip proxy-arp
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet0/3/0
!
interface FastEthernet0/3/1
!
interface FastEthernet0/3/2
!
interface FastEthernet0/3/3
!
interface Vlan1
description === LAN ===
ip address 10.10.45.1 255.255.255.0
ip accounting output-packets
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
!
interface Dialer0
ip address negotiated
ip access-group FIREWALL in
no ip proxy-arp
ip mtu 1492
ip inspect INSPECT_OUT out
ip ips ips_rule in
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication chap callin
ppp chap hostname ЛОГИН
ppp chap password 7 ПАРОЛЬ
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
!
no ip http server
no ip http secure-server
ip nat inside source list NAT interface Dialer0 overload
ip dns server
!
ip access-list extended FIREWALL
!
! тут полотенце из правил (для теста удалил все)
!
ip access-list extended NAT
permit ip host 10.10.45.2 any
permit ip host 10.10.45.3 any
! и еще куча хостов, динамический нат я не использую по ряду причин
!
dialer-list 1 protocol ip permit
!
!
control-plane
!
banner login ^CCAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user! ^C
!
line con 0
line aux 0
line vty 0 4
privilege level 15
transport input telnet ssh
!
scheduler allocate 20000 1000
ntp clock-period 17179814
ntp update-calendar
ntp server 62.117.76.142
ntp server 10.10.45.2
end
Заранее спасибо.
Сложный
Средний
