Configuration Cisco 887VA ?

lordbaco · Feb 16, 2012

Configuration Cisco 887VA ?

Good morning,

I successfully configured the Cisco 887VA to connect to Swisscom VDSL2.

On the other hand, the Swisscom TV does not work very well despite the fact that

I enabled IGMPv3. I have about 3 seconds of video stream and then

it stops and the voice is not in sync with the image.

I would like to know if you have technical documentation

(for Cisco or generic) on the configuration of routers for

Swisscom VDSL2 connection.

I would also like to have information on what to activate on the router

to correctly use Swisscom TV (IGMP Snooping, IGMP Proxy, etc.)

I guess I need to enable QoS or use 802.1p or 802.1q.

N.B. The Cisco 887VA router is approved by Swisscom:

http://www.swisscom.com/dam/swisscom/de/ws/documents/D_BBCS-Dokumente/E_BBCS_Supporting-Document_Proved-Equipment_V14-5.p df

Crigou · Feb 17, 2012

Maybe on this forum…

[https://community.swisscom.ch/t5/Discussions-sur-Swisscom-TV/bd-p/tv\_fr](https://community.swisscom.ch/t5/Discussions-sur-Swisscom-TV/ bd-p/tv_fr)

ImSoGooooood · Feb 17, 2012

Good morning,

hum it will be very interesting to see the results of your research and the solution to achieve this. I think many members are interested in your subject.

My lack of knowledge on the subject will certainly not provide you with a solution, but perhaps some suggestions to follow, or not…

It would be necessary to proceed step by step in order to know if the problem arises more from the prioritization of QoS or the IGMP protocol. To use 802.1p with User Priority 4 (High) for Multicast.

If you only leave the Box on the router do you still have the same problem? If yes then look more into configuring the IGMP protocol. If the problem no longer occurs, then no longer focus on QoS prioritization.

I say good luck to you, keep us informed of the progress of your research and perhaps we can shed some light on you 😉

lordbaco · Feb 17, 2012

My problem is that the Swisscom TV stream stops after about 10 seconds.

It appears that the Swisscom TV first establishes a unicast stream to display the 10

first seconds time to obtain the multicast stream.

I think the problem is not the QoS (I tested that quickly) but

rather at the multicast or igmp configuration level.

I found this link which talks about it see page 5

http://www.ditc.eu/downloads/Multicast_Cisco_T-Home_IPTV.pdf

http://translate.google.com/ to translate it… into French…

By debugging ip cef, I saw that it is necessary to have ip multicast-routing

to route to 224/4. On the other hand, I think I need to find the IP

PIM RP (Rendezvous Point) used by Swisscom TV to add the

line ip pim rp-address / ip igmp helper-address.

@+++

guy

ImSoGooooood · Feb 17, 2012

Hi,

10 seconds then indeed it is a Multicast problem. However, I think QoS will remain an underlying problem, but generally generates more Freeze than image freezes. But one evil after another… 😉

According to the pdf, to know the pim rp-adress IP address, one must block all IP requests by creating an entry in the access-control-list as follows:

!

ip access-list extended PUBLIC-VDSL

999 deny ip any any log

!

This way in the Log you should be able to find an announcement of blocking the igmp IP address. E.g. list PUBLIC-VDSL denied igmp xxx.x.xxx.xx (here is this famous pim rp-adress).

Then follow points 1 and 2 on page 3.

Some additional details that I found at the bottom of a file…

Igmp must support multihoming

Igmp Snooping on

Igmp robustness 2

Igmp query.intvl 125

Igmp version 3

Igmp fast-leave on

Igmp forwarding on

Looking forward to the sequel 😉

lordbaco · Feb 18, 2012

Hi,

Above all, it seems that IP RP(Rendezvous point) that

I was looking at Swisscom is… 1.1.1.1!!!

> 10 seconds then indeed it is a Multicast problem.

Indeed, it was indeed a multicast and igmp helper problem

> However, I think that QoS will remain an underlying problem,

> but generally generates more Freeze than image freezes.

> But one evil after another…![:smileywink:]( “Smiley winking”)

Yes, now it freezes after about 30-90 seconds so

now I can look at the QoS level

> According to the pdf, to know the pim rp-adress IP address,

> you must block all IP requests by creating an entry in the access-control-list as follows:

>!

> ip access-list extended PUBLIC-VDSL

> 999 deny ip any any log

>!

>

> This way in the Log you should be able to find an announcement blocking the igmp IP address. > E.g. list PUBLIC-VDSL denied igmp xxx.x.xxx.xx (here is this famous pim rp-adress).

> Then follow points 1 and 2 on page 3.

I didn’t understand that it was an inbound ACL on the WAN.

> Some additional details that I found at the bottom of a file…

It must be worthy of an X-Files folder 😉

> Igmp must support multihoming

> Igmp robustness 2

> Igmp forwarding on

Do you know the IOS commands corresponding to multihoming, robustness and forwarding?

> Looking forward to the sequel![:smileywink:]( “Smiley winking”)

…

REFERENCES
http://www.ditc.eu/downloads/Multicast_Cisco_T-Home_IPTV.pdf
[http://www.cisco.com/en/US/docs/ios/ipmulti/command/reference/imc\_02.html](http://www.cisco.com/en/US/docs/ios/ ipmulti/command/reference/imc_02.html)
[http://packetlife.net/blog/2010/feb/5/ripe-plays-with-1-0-0-0-network-apnic-allocation/](http://packetlife.net/blog/2010 /feb/5/ripe-plays-with-1-0-0-0-network-apnic-allocation/) (fun with 1.1.1.1)

DEBUG

# INTERNET-TO-WAN IGMP Helper-Address (Rendezvous Point)
permit igmp host 1.1.1.1 any
permit icmp host 1.1.1.1 any
%SEC-6-IPACCESSLOGSP: list INTERNET-TO-WAN denied igmp 1.1.1.1 -> 224.0.0.1 (0), 1 packet

# WAN-TO-INTERNET IGMP Helper-Address (Rendezvous Point)
permit igmp any host 1.1.1.1
permit icmp any host 1.1.1.1
%SEC-6-IPACCESSLOGRP: list WAN-TO-INTERNET denied pim 172.16.78.1 -> 1.1.1.1, 1 packet

# INTERNET-TO-WAN UDP TV FLOW
permit udp any 224.0.0.0 15.255.255.255
%SEC-6-IPACCESSLOGP: list INTERNET-TO-WAN denied udp 195.186.40.122(1383) -> 239.186.36.23(10000), 1 packet

# LAN-TO-WAN NTP
permit udp any any eq 123
%SEC-6-IPACCESSLOGP: list LAN-TO-WAN denied udp 172.16.78.128(1032) (Vlan1 001c.eaae.ba0d) -> 195.186.150.230(123), 1 packet

# LAN-TO-WAN IGMP
permit igmp any 224.0.0.0 15.255.255.255
%SEC-6-IPACCESSLOGSP: list LAN-TO-WAN denied igmp 172.16.78.128 (Vlan1 001c.eaae.ba0d) -> 239.186.42.45 (22), 1 packet

# LAN-TO-WAN Microsoft SSDP Enables discovery of UPnP devices
permit udp any 224.0.0.0 15.255.255.255
%SEC-6-IPACCESSLOGP: list LAN-TO-WAN denied udp 172.16.78.138(4996) (Vlan1 0006.7808.09e1) -> 239.255.255.250(1900), 20 packets

# WAN-TO-INTERNET IGMP???
permit udp any any gt 40000
%SEC-6-IPACCESSLOGP: list WAN-TO-INTERNET denied udp 85.4.244.43(2268) -> 195.186.147.91(47806), 1 packet

# LAN-TO-WAN WWW
permit tcp any any eq 80
%SEC-6-IPACCESSLOGP: list LAN-TO-WAN denied tcp 172.16.78.128(2298) (Vlan1 001c.eaae.ba0d) -> 195.186.132.21(80), 1 packet

@++

lordbaco

ImSoGooooood · Feb 18, 2012

Hi,

I don’t have much time to analyze this data, but at first glance I will say that it is not possible that lP Rp is 1.1.1.1!

the cmd are normally

set igmp snooping on

set igmp robustness 2

set igmp query-intvl 125

set igmp query-response-intvl 100

set igmp version 3

set igmp fast-leave on

set igmp log-enable off

set igmp default-forwarding-allow on

set ip igmp-forwarding on

You shouldn’t sleep all weekend 😉

Perhaps other members more specialized than me could help you?

lordbaco · Feb 19, 2012

I got Swisscom TV working

without interruption on my Cisco 887VA-W

=> finally!!!

The secret or rather the secrets?

The IP RP (Rendezvous Point) at Swisscom is indeed 1.1.1.1!!!
without IP RP the flow stops after approximately 10 seconds (unicast flow before multicast)
ip igmp query-interval 125 or 60 or 30 does not work (set igmp query-intvl 125)
ip igmp query-interval 12 works – default Cisco (60) and Motorola (125)
without such a low value the flow stops before 60 seconds!
Timeouts at Motorola are in deci-seconds while at Cisco in milli-seconds!

> I don’t have much time to analyze this data,

> but at first glance I would say that it is not possible that lP Rp is 1.1.1.1!

Yes, for me I am convinced that IP RP Rendezvous Point is indeed 1.1.1.1

at Swisscom. Which is a questionable choice given that it is a routable block

which was removed from the boggus list by IANA.

At the Cisco level, I got this:

%SEC-6-IPACCESSLOGSP: list INTERNET-TO-WAN denied igmp 1.1.1.1 -> 224.0.0.1 (0), 1 packet

On the Motorola Netopia 3397GP and after activating bridge/router mode

and the igmp log mode… bingo again 1.1.1.1!!!

Netopia-3000/31499700> config

Config Mode v1.3
Netopia-3000/31499700 (top)>> set igmp log-enable on
Netopia-3000/31499700 (top)>> save
WARNING: Concurrent-bridging/routing has been turned ON!

Configuration data saved.
Netopia-3000/31499700 (top)>> top
Netopia-3000/31499700 (top)>> cd..
Error: Command (‘cd’) not found

Netopia-3000/31499700 (top)>> exit

Netopia-3000/31499700> show log

Message Log:
2/19/12 09:10:21 AM L3 TR-069: Closing connection on auth fail
2/19/12 09:10:21 AM L3 SSL: Closing Connection: rms.bluewin.ch
2/19/12 09:10:25 AM L3 IGMP: [ENWAN1] Received General Query host: 1.1.1.1 max-response-time 2 s
2/19/12 09:10:25 AM L3 IGMP: [en0] Received General Query host: 1.1.1.1 max-response-time 2 s
2/19/12 09:10:26 AM L3 IGMP: [ENWAN1] Sending v2-Report group: 239.255.255.250
2/19/12 09:10:26 AM L3 IGMP: [ENWAN1] Sending v2-Report group: 224.0.0.251
2/19/12 09:10:26 AM L3 IGMP: [ENWAN1] Sending v2-Report group: 239.186.63.6
2/19/12 09:10:26 AM L3 IGMP: [en0] Received v2-Report group: 239.186.63.6 host: 172.16.78.128
2/19/12 09:10:26 AM L3 IGMP: [en0] Received v2-Report group: 239.255.255.250 host: 172.16.78.128
2/19/12 09:10:27 AM L3 IGMP: [en0] Received v2-Report group: 224.0.0.251 host: 172.16.78.2
2/19/12 09:10:36 AM L3 IGMP: [ENWAN1] Received General Query host: 1.1.1.1 max-response-time 2 s
2/19/12 09:10:36 AM L3 IGMP: [en0] Received General Query host: 1.1.1.1 max-response-time 2 s
2/19/12 09:10:36 AM L3 IGMP: [ENWAN1] Sending v2-Report group: 239.186.63.6

Netopia-3000/31499700>

Even though 1.0.0.0 has been assigned to APNIC it seems that Swisscom uses it internally.

You can also ping 1.1.1.1 from your Swisscom connection!

ping -c 1 1.1.1.1
PING 1.1.1.1 (1.1.1.1): 56 data bytes
64 bytes from 1.1.1.1: icmp_seq=0 ttl=126 time=19.913 ms

--- 1.1.1.1 ping statistics —
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 19.913/19.913/19.913/0.000 ms

1.1.1.1 clearly does not arrive in the USA with 19ms!

traceroute 1.1.1.1
traceroute to 1.1.1.1 (1.1.1.1), 64 hops max, 52 byte packets
1 * 172.16.78.1 (172.16.78.1) 0.591 ms 0.601 ms
2 1.1.1.1 (1.1.1.1) 19.706 ms 19.553 ms 19.902 ms

See also this article 🙂

[http://packetlife.net/blog/2010/feb/5/ripe-plays-with-1-0-0-0-network-apnic-allocation/](http://packetlife.net/blog/2010 /feb/5/ripe-plays-with-1-0-0-0-network-apnic-allocation/)

inetnum: 1.1.1.0 - 1.1.1.255
netname: Debogon-prefix
descr: APNIC Debogon Project
descr: APNIC Pty Ltd
country: AU
admin-c: AR302-AP
tech-c: AR302-AP
mnt-by:APNIC-HM
mnt-routes: MAINT-AU-APNIC-GM85-AP
mnt-irt: IRT-APNICRANDNET-AU
status: ASSIGNED PORTABLE
changed: hm-changed@apnic.net 20110922
source: APNIC

> the cmd are normally

> set igmp snooping on

> set igmp robustness 2

> set igmp query-intvl 125

> set igmp query-response-intvl 100

> set igmp version 3

> set igmp fast-leave on

> set igmp log-enable off

> set igmp default-forwarding-allow on

> set ip igmp-forwarding on

Here is the configuration that works with Swisscom TV and Swisscom VDSL2

!
internal service
!
memory-size iomem 20
!
controller VDSL 0
operating mode vdsl2
co5 modem
!
ip pim rp-address 1.1.1.1
!
ip multicast-routing
!
ip igmp snooping
!
Ethernet interface0
ip dhcp client broadcast-flag clear
ip address dhcp
no ip virtual-reassembly in
no ip route-cache

no ip mfib cef input
no ip mfib cef output

ip pim sparse-mode

ip igmp query-interval 10
ip igmp querier-timeout 60
ip igmp query-max-response-time 8

ip igmp last-member-query-interval 1000
ip igmp last-member-query-count 2
ip igmp version 3
ip igmp proxy-service
load-interval 30
auto discovery qos
service-policy output QoS-Ethernet0
!
interface Vlan1
ip address 172.16.78.1 255.255.255.0
ip nat inside
no ip virtual-reassembly in
ip tcp adjust-mss 1452
ip pim sparse-mode

ip igmp query-interval 10
ip igmp querier-timeout 60
ip igmp query-max-response-time 8

ip igmp last-member-query-interval 1000
ip igmp last-member-query-count 2
ip igmp version 3
ip igmp proxy-service
ip igmp helper-address 1.1.1.1
ip igmp explicit-tracking
load-interval 30
auto discovery qos
service-policy output QoS-Vlan1
!
class-map match-any QoS-Video
match protocol rtp video
match ip dscp af41
!
policy-map QoS-Ethernet0
class class-default
fair-tail
!
policy-map QoS-Vlan1
class QoS-Video
set dscp af41
class class-default
set dscp default
!
ip forward-protocol nd
!
scheduler allocate 20000 1000
!
end

> You shouldn’t sleep all weekend :smileywink:

> Perhaps other members more specialized than me could help you?

I think it’s good now.

Thanks again for your help!

I must say that I was disgusted for three days to go back to my old

Motorola Netopia from 2008… so my little family can watch Swisscom TV…

It was strange though that by connecting only the Swisscom TV

on the Cisco 887VA, the Swisscom TV flow freezes… It’s not the QoS that would help

because with 22Mbps/5Mps it is sufficient for a stream of 12Mbps (HD) or 5Mbps (SD)

TECHNICAL DETAILS

> set igmp query-intvl 125
>
> Query Interval– the amount of time in seconds between IGMP General Query messages sent by the
> querier gateway. The default query interval is 125 seconds

THIS WAS THE ORIGIN OF THE IMAGE STOP AFTER LESS THAN 60 SECONDS
(THE STOP AFTER 10 SEC HAS BEEN SET WITH THE ADDRESS RendezvousPoint => 1.1.1.1)

SETUP
ip igmp query-interval 10

CISCO
ip igmp query-interval?
<1-18000> Query interval in seconds

INFO
Both 125 (Motorola/RFC default) and 60 (Cisco default) and even 30 does not work well with Swisscom TV.
You need ip igmp query-interval 12!!!

<< Note: We recommend that you use the default IGMP query interval and timeout period.
The Cisco IOS software uses a default IGMP query interval of 60 seconds,
which is different from the RFC standard default of 125 seconds.
Using a lower default IGMP query interval of 60 seconds allows routers
to stop forwarding traffic faster when a member crashes without sending
leaves (in IGMPv2 or IGMPv3 environment) >>

> set igmp last-member-query-intvl 10
>
> Sets the last member query and inter val: the amount of time in tenths of a second that the IGMP gateway
> waits to receive a response to a Group-Speciﬁc Quer y message. The last member quer y inter val is also
> the amount of time in seconds between successive Group-Speciﬁc Quer y messages.
> The default is 1 second (10 deci-seconds)

SETUP

ip igmp last-member-query-interval 1000

CISCO
ip igmp last-member-query-interval?
<100-25500> Last member query interval in milliseconds

INFO
You have to be very careful, the Motorola values are in deci-seconds while Cisco in milli-seconds!!!

> set igmp last-member-query-count 2

SETUP
ip igmp last-member-query-count 2

CISCO
ip igmp last-member-query-count?

<1-7> Last member query count

> set igmp query-response-intvl 100
>
> Sets the query-response interval range: from 5 deci-seconds (tenths of a second) – 255 deci-seconds.
> The default is 100 deci-seconds.
>
> Last Member Query Interval – the amount of time in tenths of a second that the IGMP gateway
> waits to receive a response to a Group-Speciﬁc Query message. The last member query interval is
> also the amount of time in seconds between successive Group-Speciﬁc Query messages. Tea
> default last member query interval is 1 second (10 deci-seconds).

INFO
no info I thought it was ip igmp last-member-query-interval??

> set igmp version 3

SETUP

ip igmp version 3

> set igmp snooping on

SETUP
ip igmp snooping

INFO
and not ip igmp snooping vlan 1

> set igmp default-forwarding-allow on

ip multicast-routing

> set igmp fast-leave on
>
> Fast Leave – set to off by default, fast leave enables a non-standard expedited leave mechanism.
> The querier keeps track of which client is requesting which channel by IP address. When a leave
> message is received, the querier can check its internal table to see if there are any more clients on
> this group. If there are none, it immediately sends an IGMP leave message to the upstream querier.

INFO
“ip igmp snooping fast-leave” not available on my IOS

> set igmp robustness 2
>
> Robustness – a way of indicating how sensitive to lost packets the network is.
> IGMP can recover from robustness minus 1 lost IGMP packet. The default value is 2.

INFO
Not available on my IOS version

> set igmp unsol-report-intvl 10
>
> Sets the unsolicited report interval: the amount of time in seconds between repetitions of a particular
> computer’s initial report of membership in a group. The default is 10 seconds

INFO
No info on a similar command on IOS

> set igmp wireless-m2u on
>
> This command allows you enable or disable wireless multicast-to-unicast if igmp snooping is set to on.
>
> Wireless Multicast to Unicast conversion – Only available if IGMP Snooping is enabled. If set to
> on, the Gateway replaces the multicast MAC-address with the physical MAC-address of the wireless
> customer. If there is more than one wireless client interested in the same multicast group, the Gateway
> will rev t to multicast the stream immediately. When one or more wireless clients leave a group,
> and the Gateway determines that only a single wireless client is interested in the stream, it will once

> again unicast the stream.

INFO
No info for IOS

REFERENCES
Page 158 [http://broadband.motorola.com/consumers/products/7107-65-10NA/downloads/AdminHndbkV784-sku29\_34.pdf](http://broadband.motorola.com/consumers/products/7107-65- 10NA/downloads/AdminHndbkV784-sku29_34.pdf)
[http://www.cisco.com/en/US/docs/ios/ipmulti/command/reference/imc\_02.html](http://www.cisco.com/en/US/docs/ios/ ipmulti/command/reference/imc_02.html)

[http://www.sadikhov.com/forum/index.php?/topic/186519-cisco-88xva-%26-8211%3B-part-5-vdsl-advanced-configuration-%26-8211%3B- iptv-via-multicast/] (http://www.sadikhov.com/forum/index.php?/topic/186519-cisco-88xva-%26-8211%3B-part-5-vdsl-advanced-configuration-%26-8211%3B- iptv-via-multicast/)

http://www.ditc.eu/downloads/Multicast_Cisco_T-Home_IPTV.pdf

ImSoGooooood · Feb 20, 2012

Hi lordbaco,

So what can I say other than BRAVO and great perseverance!

I think your post will gain followers… if I could, it would gladly be 10 kudos 😉

Thanks for the info and for others who are interested, go buy this router and give a Kudos to lordbaco.

lordbaco · Feb 20, 2012

N.B. copy run start (write memory) makes the Swisscom TV jerk 😉

After a day of HD, SD and TV recording this evening

the TV is still stable. Sometimes after 1-2 hours I have

1 sec of stream desynchronization (as encoding default).

So I tested another 12 to 10 adjustment.

To reduce query-interval 12 to 10 you also need

reduce query-max-response-time from 10 to 8.

You have to be careful if you test values because during the

stream multicast video the Swisscom TV buffer the stream

(30-40 sec?). For example, I tested 125 again

of query-interval and 250 of querier-timeout and the

fux jerked again and stopped after 30

seconds…

And hop I quickly returned to a value of around 10

for the query-interval and it works perfectly again!

(perfect for continuing to see top chef)

ip igmp query-interval 10
ip igmp querier-timeout 60
ip igmp query-max-response-time 8

I also noticed that it is better to manually configure

querier-timeout because otherwise the value is not consistent between

Ethernet0 (WAN) and Vlan0 (LAN) interface

BEFORE

show ip igmp interface

Ethernet0 is up, line protocol is up

…

IGMP query interval is 10 seconds
IGMP configured query interval is 10 seconds
IGMP querier timeout is 100 seconds
IGMP configured querier timeout is 100 seconds
IGMP max query response time is 10 seconds
Last member query count is 2
Last member query response interval is 1000 ms

…

IGMP querying router is 1.1.1.1
No multicast groups joined by this system

Vlan1 is up, line protocol is up
…

IGMP query interval is 12 seconds
IGMP configured query interval is 12 seconds
IGMP querier timeout is 24 seconds
IGMP configured querier timeout is 24 seconds
IGMP max query response time is 10 seconds
Last member query count is 2
Last member query response interval is 1000 ms
…

IGMP helper address is 1.1.1.1
Multicast groups joined by this system (number of users): 224.0.1.40(1)

AFTER

show ip igmp interface

Ethernet0 is up, line protocol is up
…

IGMP query interval is 10 seconds
IGMP configured query interval is 10 seconds
IGMP querier timeout is 60 seconds
IGMP configured querier timeout is 60 seconds
IGMP max query response time is 8 seconds
Last member query count is 2
Last member query response interval is 1000 ms

…

IGMP querying router is 1.1.1.1

Vlan1 is up, line protocol is up

…

IGMP query interval is 10 seconds
IGMP configured query interval is 10 seconds
IGMP querier timeout is 60 seconds
IGMP configured querier timeout is 60 seconds
IGMP max query response time is 8 seconds
Last member query count is 2
Last member query response interval is 1000 ms
…

IGMP helper address is 1.1.1.1
Multicast groups joined by this system (number of users): 224.0.1.40(1)

P.S. Otherwise my colleagues were amazed to learn that 1.1.1.1 ping

from home but not outside the Swisscom xDSL network 😉

samzor · May 18, 2012

Hello,

First of all thank you for the configuration, I haven’t been able to test it yet but I have the same router as you.

I have a few questions regarding the router, do you have the 887Va-W version?

I have this version and I can’t configure AP mode via telnet/ssh.

On the other hand, do you also have the ATM0 interface and if so can you post your config?

I have access to the router via telnet/ssh but when I type service-module wlan-ap0 session I get:

router-1#service-module wlan-ap 0 session
% telnet connections not permitted from this terminal

Do you have an idea?

Here is my config:

Current configuration: 3281 bytes
!
! Last configuration change at 21:43:11 UTC Fri May 18 2012 by jon
! NVRAM config last updated at 21:46:05 UTC Fri May 18 2012 by jon
! NVRAM config last updated at 21:46:05 UTC Fri May 18 2012 by jon
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname router-1
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 xxxx
enable password xxxx
!
no aaa new-model
crypto pki token default removal timeout 0
!
!
ip source-route
ip cef
!
!
!
ip dhcp excluded-address 192.168.2.254
ip dhcp excluded-address 192.168.2.0 192.168.2.100
!
!
no ip domain lookup
ip domain name jbtech.local
ip name-server 195.186.1.162
ip name-server 195.186.4.162
ip multicast-routing
no ipv6 cef
!
!
license udi pid xsXXXxXXxXXx
!
!
username XxXX privilege 15 password 0 XXXXX
!
!
!
!
controller VDSL 0
operating mode vdsl2
co5 modem
!
ip ssh version 2
!
class-map match-any Qos-Video
match protocol rtp video
match ip dscp af41
!
!
policy-map Qos-Ethernet0
class class-default
fair-tail
policy-map Qos-Vlan1
class Qos-Video
set dscp af41
class class-default
set dscp default
!
!
!
!
!
!
!
!
ATM0 interface
no ip address
no atm ilmi-keepalive
PVC 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
Ethernet interface0
ip dhcp client broadcast-flag clear
ip address dhcp
ip pim sparse-mode
no ip mfib cef input
no ip mfib cef output
ip nat inside
no ip virtual-reassembly in
no ip route-cache
ip igmp query-max-response-time 8
ip igmp version 3
ip igmp query-interval 10
ip igmp querier-timeout 60
ip igmp proxy-service
load-interval 30
service-policy output Qos-Ethernet0
!
interface FastEthernet0
switchport mode trunk
no ip address
!
interface FastEthernet1
no ip address
!
FastEthernet2 interface
no ip address
!
FastEthernet3 interface
no ip address
!
interface Wlan-GigabitEthernet0
description Internal switch interface connecting to the embedded AP
no ip address
!
wlan-ap0 interface
description Embedded Service module interface to manage the embedded AP
ip unnumbered Vlan1
!
interface Vlan1
ip address 192.168.2.254 255.255.255.0
ip pim sparse-mode
ip nat inside
no ip virtual-reassembly in
ip tcp adjust-mss 1452
ip igmp helper-address 1.1.1.1
ip igmp query-max-response-time 8
ip igmp version 3
ip igmp explicit-tracking
ip igmp query-interval 10
ip igmp querier-timeout 60
ip igmp proxy-service
load-interval 30
service-policy output Qos-Vlan1
!
interface Vlan20
description Vlan Wireless
ip address 192.168.20.1 255.255.255.0
!
interface Dialer1
ip address negotiated
ip nat outside
ip virtual-reassembly in
dpi encapsulation
dialer pool 1
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
ip pim rp-address 1.1.1.1
ip nat inside source list 1 interface Dialer1 overload
ip route 0.0.0.0 0.0.0.0 Dialer1
!
access-list 1 permit 192.168.2.254
!
!
!
!
snmp-server community public RO
!
line con 0
line to 0
line 2
no activation-character
no exec
transport preferred none
transport input all
stopbits 1
line vty 0 4
privilege level 15
password xxxxxxxxxxxx
local login
transport input ssh
transport output ssh
!
scheduler allocate 20000 1000
end

Thank you in advance and have a good evening.

Jon

Crigou · May 19, 2012

For samzor

The present discussions were initiated by Lordbaco, and the latter, having obtained the desired answers, concluded with a green VU. So samzor would have a better chance of getting a response from lordbaco, with one of the following two methods:

- private message to lordbaco

- starting a new exchange

lordbaco · May 21, 2012

Hello,

> First of all thank you for the configuration, I haven’t been able to test it yet but I have the same router as you.

> I have a few questions regarding the router, do you have the 887Va-W version?

Yes, I have the C887VA-W-E-K9

> I have this version and I cannot configure AP mode via telnet/ssh.

The AP module is a separate router with its own IOS (but included in the same box)

which you can access with the command “service-module wlan-ap 0 session”

I advise you to add the following alias:

terminal config

alias exec dot11radio service-module wlan-ap 0 session"

end

copy run start

dot11radio

like that you can do “dot11radio” on the pumpt to access the AP router.

> On the other hand, do you also have the ATM0 interface and if so can you post your config?

ATM0 is not useful for Swisscom only Ethernet0

!
ATM0 interface
no ip address
shutdown
no atm ilmi-keepalive
!
Ethernet interface0
ip address dhcp

!

controller VDSL 0
operating mode vdsl2
co5 modem

!

> I have access to the router via telnet/ssh but when I type service-module wlan-ap0 session I get a:

>

> router-1#service-module wlan-ap 0 session
> % telnet connections not permitted from this terminal

>

> Do you have an idea?

It is possible that your WiFI module (AP) is not correctly configured

to access it via “service-module wlan-ap 0 session”

I advise you to launch the Cisco Configuration Professional Express Wizard

(Cisco CP Express) via the web interface and configure AP with a

Dedicated IP (other than that of the router like.1 for router,.254 for routerAP)

Afterwards you can deactivate the web interface.

ip http server
ip http access-class 42
ip http authentication local
ip http secure-server

!
line con 0
exec-timeout 0 0
privilege level 15
synchronous logging
local login
line to 0
transport input all
line 2
no activation-character
no exec
transport preferred none
transport input all
stopbits 1
line vty 0 4
access-class 42 in
exec-timeout 0 0
privilege level 15
synchronous logging
local login
transport input ssh
!

access-list 42 permit 192.168.1.0 0.0.0.255

Otherwise you can also try via cisco-config-pro-k9-pkg-2_6-en.zip under Windows

[http://www.cisco.com/cisco/software/release.html?mdfid=281795035&softwareid=282159854&release=2.6&relind=AVAILABLE&rellifecycle=&reltype=latest] (http://www.cisco.com/cisco/software/release.html?mdfid=281795035&softwareid=282159854&release=2.6&relind=AVAILABLE&rellifecycle=&reltype=latest)

P.S. I’m not a fan of Wizard (gui for lamers) but to do the basic config it’s not bad

afterwards you can use it as inspiration for the final configuration…

vgohl · Apr 9, 2013

Hello, I have the same router but cannot get it to work. Is it possible to have an example of config?

from the router I ping the internet but from my laptop it’s impossible it stops at the router, for me it’s a routing or login problem. What is the login mode?

Thank you Greetings

lordbaco · Apr 9, 2013

Hello,

> from the router I ping the internet but from my laptop it is impossible, it stops at the router,

> for me it’s a routing or login problem.

I think it’s a private range NAT problem.

> What is the login mode?

There is no login (it’s not PPPoE but simply DHCP from Ethernet0).

> I have the same router but can’t get it to work

> is it possible to have an example config?

!
multilink bundle-name authenticated
!
controller VDSL 0
operating mode vdsl2
sync mode itu
co5 modem
description Swisscom Infinity VDSL2 20Mbps/5Mbps
!
ATM0 interface
no ip address
shutdown
no atm ilmi-keepalive
!
Ethernet interface0
ip dhcp client broadcast-flag clear
ip address dhcp
no ip redirects
ip pim sparse-mode
ip nat outside
no ip virtual-reassembly in
no ip route-cache
ip igmp version 3
ip igmp query-interval 12
ip igmp proxy-service
load-interval 30
!
interface FastEthernet0
no ip address
load-interval 30
full duplex
speed 100
spanning tree portfast
!
interface Wlan-GigabitEthernet0
description Internal switch interface connecting to the embedded AP
no ip address
load-interval 30
!
wlan-ap0 interface
description Embedded Service module interface to manage the embedded AP
ip unnumbered Vlan1
load-interval 30
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
ip address 172.16.78.1 255.255.255.0
ip pim sparse-mode
ip nat inside
no ip virtual-reassembly in
ip tcp adjust-mss 1452
ip igmp helper-address 1.1.1.1
ip igmp version 3
ip igmp explicit-tracking
ip igmp query-interval 12
ip igmp proxy-service
load-interval 30
!
ip forward-protocol nd
no ip http server
ip http access-class 23
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip dns view default
domain timeout 1
domain retry 1
domain name-server interface Ethernet0
ip dns server
ip pim rp-address 1.1.1.1
ip nat inside source list 23 interface Ethernet0 overload
!
access-list 23 permit 172.16.78.0 0.0.0.255
no cdp run
!
control plane
!
alias exec dot11radio service-module wlan-ap 0 session
!
line con 0
exec-timeout 0 0
privilege level 15
synchronous logging
local login
line to 0
line 2
no activation-character
no exec
transport preferred none
transport input all
stopbits 1
line vty 0 4
access-class 23 in
exec-timeout 0 0
privilege level 15
synchronous logging
local login
transport input ssh
!
scheduler allocate 20000 1000
end

Best regards

guy

vgohl · Apr 9, 2013

Thank you I will test… but one more question, don’t we use a dialer with my login and pass? (ppp chap or other)

lordbaco · Apr 9, 2013

> Thank you, I will test… but one more question,

> we don’t use a dialer with my login and pass? (ppp chap or other)

No dialer (no PPPoE), no login and no pass

just DHCP to have a public IP on Ethernet 0

The fact that you can ping 8.8.8.8 (Google DNS) from the router

the Internet connection is already working so you just need to

NAT so that private IPs on the LAN can use the assigned public IP

at Cisco.

Best regards

guy

vgohl · Apr 9, 2013

Re voilà je test, ping 8.8.8.8 depuis le router ->ok ping ping depuis le pc ->ok mais impossible d’afficher une page web…. voici ma config…

Router#sh run
Building configuration…

Current configuration: 2864 bytes
!
! Last configuration change at 14:15:45 UTC Tue Apr 9 2013 by admin
! NVRAM config last updated at 13:56:34 UTC Tue Apr 9 2013 by admin
! NVRAM config last updated at 13:56:34 UTC Tue Apr 9 2013 by admin
version 15.1
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
enable password cisco
!
no aaa new-model
!
memory-size iomem 10
crypto pki token default removal timeout 0
!
!
ip source-route
!
!
!
!
ip dhcp pool lan0
network 192.168.2.0 255.255.255.0
dns-server 195.186.1.162 195.186.4.162
default-router 192.168.2.1
!
!
ip cef
ip domain retry 1
ip domain timeout 1
no ip domain lookup
ip name-server 195.186.1.162
ip name-server 195.186.4.162
no ipv6 cef
!
!
multilink bundle-name authenticated
license udi pid CISCO887VA-M-K9 sn FCZ1620C51U
license accept end user agreement
license boot module c880-data level advipservices
!
!
vtp mode transparent
username admin privilege 15 password 0 cisco
!
!
!
!
controller VDSL 0
operating mode vdsl2
sync mode itu
description Swisscom Infinity VDSL2 20Mbps/5Mbps
!
!
!
!
!
!
!
!
interface Ethernet0
ip dhcp client broadcast-flag clear
ip address dhcp
no ip redirects
ip pim sparse-mode
ip nat outside
ip virtual-reassembly in
no ip route-cache
ip igmp version 3
ip igmp query-interval 12
ip igmp proxy-service
load-interval 30
!
interface ATM0
no ip address
shutdown
no atm ilmi-keepalive
!
interface FastEthernet0
no ip address
load-interval 30
duplex full
speed 100
spanning-tree portfast
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
duplex full
speed 100
!
interface FastEthernet3
no ip address
duplex full
speed 100
!
interface Vlan1
description Swisscom Access
ip address 192.168.2.1 255.255.255.0
ip pim sparse-mode
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
ip igmp helper-address 1.1.1.1
ip igmp version 3
ip igmp explicit-tracking
ip igmp query-interval 12
ip igmp proxy-service
load-interval 30
!
ip forward-protocol nd
no ip http server
ip http access-class 23
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
ip dns view default
domain timeout 1
domain retry 1
domain name-server interface Ethernet0
no dns forwarding
ip dns server
ip pim rp-address 1.1.1.1
ip nat inside source list 23 interface Ethernet0 overload
!
access-list 1 permit 192.168.2.1
no cdp run
!
!
!
!
!
control-plane
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
login local
line aux 0
line vty 0 4
session-timeout 30
access-class 55 in
exec-timeout 30 0
privilege level 15
logging synchronous
login local
history size 32
transport input telnet
transport output none
escape-character 3
!
end

Router#

This post is in English

lordbaco · Apr 9, 2013

I think ACL 23 is missing for the NAT rule to work…

otherwise test using Google’s DNS instead of Swisscom’s.

!
access-list 23 permit 192.168.2.0 0.0.0.255
!
ip nat inside source list 23 interface Ethernet0 overload
!
ip dhcp pool lan0
network 192.168.2.0 255.255.255.0
dns-server 8.8.8.8
default-router 192.168.2.1
!

vgohl · Apr 10, 2013

It works thanks for your help:smileyhappy: