|
Question : Telnet access to Cisco 1841
|
|
I cannot connect via telnet to my router. It actually looks like I connect when I telnet from a DOS window but hitting any key drops me right out. I get the following debug messages:
089354: Jan 22 19:48:45.548: Telnet194: 1 1 251 1 089355: Jan 22 19:48:45.548: TCP194: Telnet sent WILL ECHO (1) 089356: Jan 22 19:48:45.548: Telnet194: 2 2 251 3 089357: Jan 22 19:48:45.548: TCP194: Telnet sent WILL SUPPRESS-GA (3) 089358: Jan 22 19:48:45.548: Telnet194: 80000 80000 253 24 089359: Jan 22 19:48:45.548: TCP194: Telnet sent DO TTY-TYPE (24) 089360: Jan 22 19:48:45.548: Telnet194: 10000000 10000000 253 31 089361: Jan 22 19:48:45.552: TCP194: Telnet sent DO WINDOW-SIZE (31)
Config:
sh run Building configuration...
Current configuration : 9094 bytes ! ! Last configuration change at 19:19:05 UTC Mon Jan 22 2007 ! NVRAM config last updated at 19:21:37 UTC Mon Jan 22 2007 ! version 12.3 service timestamps debug datetime msec service timestamps log datetime msec service password-encryption service sequence-numbers no service dhcp ! hostname Company-Router ! boot-start-marker boot-end-marker ! logging buffered 4096 warnings enable secret 5 $1$hcyn$5WbS5UP1nqPn2R3cKPuqT/ ! aaa new-model ! ! aaa authentication login userauthen local aaa authorization exec default local group radius aaa authorization exec vty local aaa authorization network groupauthor local ! aaa session-id common ! resource policy ! mmi polling-interval 60 no mmi auto-configure no mmi pvc mmi snmp-timeout 180 ip subnet-zero no ip cef ! ! no ip dhcp use vrf connected ! ! no ip ips deny-action ips-interface no ip domain lookup ip domain name Company.net ip name-server 192.168.0.100 ip name-server 198.6.1.1 ! no ftp-server write-enable ! ! ! username user1 password 7 13151601181B0B382F ! ! class-map match-any vonage-traffic match access-group 102 ! ! policy-map vonage-policy class vonage-traffic priority 100 class class-default fair-queue ! ! ! crypto isakmp policy 1 hash md5 authentication pre-share group 2 ! crypto isakmp policy 2 encr 3des hash md5 authentication pre-share group 2 ! crypto isakmp policy 3 encr 3des hash md5 authentication pre-share group 2 crypto isakmp invalid-spi-recovery crypto isakmp ccm ! crypto isakmp client configuration group 3000client key password! dns 192.168.0.100 domain Company.net pool ippool acl 108 max-users 20 ! ! crypto ipsec transform-set myset esp-des esp-md5-hmac ! crypto dynamic-map dynmap 10 set transform-set myset ! ! crypto map clientmap local-address Loopback0 crypto map clientmap isakmp authorization list groupauthor crypto map clientmap client configuration address respond crypto map clientmap 10 ipsec-isakmp dynamic dynmap ! ! ! interface Loopback0 ip address 12.12.12.129 255.255.255.248 ! interface FastEthernet0/0 ip address 192.168.0.1 255.255.0.0 no ip redirects no ip unreachables no ip proxy-arp ip nat inside ip virtual-reassembly ip route-cache same-interface duplex auto speed auto no keepalive no cdp enable service-policy output vonage-policy ! interface FastEthernet0/1 no ip address ip access-group ether-in in ip access-group ether-out out ip virtual-reassembly shutdown duplex auto speed auto ! interface Serial0/0/0 bandwidth 1536 no ip address no ip redirects no ip unreachables no ip proxy-arp encapsulation frame-relay IETF no ip mroute-cache ntp disable service-module t1 timeslots 1-24 service-module t1 fdl both frame-relay lmi-type ansi service-policy output vonage-policy ! interface Serial0/0/0.1 point-to-point frame-relay interface-dlci 16 ppp Virtual-Template1 ! interface Virtual-Template1 ip address negotiated ip access-group serial-in in no ip redirects no ip unreachables no ip proxy-arp ip nat outside ip virtual-reassembly ppp chap hostname 1977821@bz8 ppp chap password 7 045A5A000E771E4F59 ppp ipcp dns request ppp ipcp route default ppp ipcp address accept crypto map clientmap ! ip local pool ippool 172.16.1.1 172.16.1.254 ip classless ! no ip http server no ip http secure-server ip nat pool pool-one 12.12.12.133 12.12.12.134 netmask 255.255.255.248 ip nat inside source list 101 pool pool-one overload ip nat inside source static 192.168.0.110 12.12.12.130 ip nat inside source static 192.168.0.100 12.12.12.131 ip nat inside source static 192.168.0.103 12.12.12.132 ! ip access-list extended ether-in permit ip 192.168.0.0 0.0.255.255 172.16.1.0 0.0.0.255 permit tcp any any eq telnet permit udp any any eq 22 permit tcp any any eq 22 deny tcp any any range 135 139 deny udp any any range 135 netbios-ss deny tcp any any eq 445 deny udp any any eq 445 permit ip 192.168.0.0 0.0.255.255 any deny ip any any log-input ip access-list extended ether-out permit ip any 192.168.0.0 0.0.255.255 permit tcp any any eq telnet permit udp any any eq 22 permit tcp any any eq 22 deny ip any any log-input ip access-list extended serial-in permit esp any any permit udp any any eq isakmp permit udp any any eq non500-isakmp permit tcp host 12.12.51.79 any eq telnet permit tcp host 12.12.156.206 any eq telnet permit udp any any eq 22 permit tcp any any eq 22 deny tcp any any range 135 139 deny udp any any range 135 netbios-ss deny tcp any any eq 445 deny udp any any eq 445 deny ip 12.12.12.128 0.0.0.7 any log-input deny ip 127.0.0.0 0.255.255.255 any log-input deny ip 10.0.0.0 0.255.255.255 any log-input deny ip 172.16.0.0 0.15.255.255 any log-input deny ip 192.168.0.0 0.0.255.255 any log-input deny ip 224.0.0.0 15.255.255.255 any log-input deny ip 240.0.0.0 7.255.255.255 any log-input deny ip 60.11.0.0 0.0.255.255 any deny ip 204.16.0.0 0.0.255.255 any deny ip 222.169.0.0 0.0.255.255 any deny ip 210.73.0.0 0.0.255.255 any deny ip 218.38.0.0 0.0.255.255 any deny ip 218.242.0.0 0.0.255.255 any deny ip 202.183.0.0 0.0.255.255 any deny ip 81.84.0.0 0.0.255.255 any deny ip 58.51.0.0 0.0.255.255 any deny ip 221.6.0.0 0.0.255.255 any deny ip 221.203.0.0 0.0.255.255 any deny ip 204.180.198.0 0.0.0.255 any deny ip 82.165.252.0 0.0.0.255 any deny ip 85.14.217.0 0.0.0.255 any deny ip 59.34.196.0 0.0.0.255 any deny ip 220.70.88.0 0.0.0.255 any deny ip 217.126.19.0 0.0.0.255 any permit tcp any host 12.12.12.131 eq 55521 permit tcp any host 12.12.12.131 range 50000 50050 permit tcp any host 12.12.12.131 eq 5177 permit udp 12.17.91.0 0.0.0.31 eq isakmp any permit udp 12.17.91.0 0.0.0.31 eq non500-isakmp any permit esp 12.17.91.0 0.0.0.31 any permit udp 155.94.0.0 0.0.255.255 eq isakmp any permit udp 155.94.0.0 0.0.255.255 eq non500-isakmp any permit esp 155.94.0.0 0.0.255.255 any permit ip host 12.31.67.211 any permit gre host 12.31.67.211 any permit tcp any any established permit tcp any eq ftp-data any gt 1023 permit udp any eq domain any gt 1023 permit udp any any eq ntp permit udp any eq ntp any gt 1023 permit udp any host 12.12.12.130 range 10000 20000 permit udp any eq domain host 12.12.12.130 permit udp any eq 21 host 12.12.12.130 permit udp any eq tftp host 12.12.12.130 permit udp any eq 2400 host 12.12.12.130 permit udp any eq 80 host 12.12.12.130 permit udp any eq ntp host 12.12.12.130 permit icmp 69.59.224.0 0.0.31.255 host 12.12.12.130 permit icmp 216.115.16.0 0.0.15.255 host 12.12.12.130 permit icmp 206.132.64.0 0.0.63.255 host 12.12.12.130 permit udp any host 12.12.12.132 range 5198 5199 permit udp any range 12035 12036 host 12.12.12.132 permit udp any range 13000 13050 host 12.12.12.132 deny icmp any any echo permit icmp any any echo-reply permit icmp any any source-quench permit icmp any any packet-too-big permit icmp any any time-exceeded deny icmp any any deny ip any any log-input ip access-list extended serial-out deny ip any 12.12.12.128 0.0.0.7 log-input permit ip any any ! logging trap debugging logging 192.168.0.101 access-list 10 permit 12.105.110.66 access-list 10 permit 12.62.5.30 access-list 10 permit 12.26.4.105 access-list 10 remark ntp peer access-list 10 permit 128.182.58.100 access-list 10 permit 12.12.156.2 access-list 10 permit 12.12.195.62 access-list 11 remark ntp serve access-list 11 permit 192.168.0.0 0.0.255.255 access-list 13 remark ntp query-only access-list 13 permit any log access-list 101 deny ip 192.168.0.0 0.0.255.255 172.16.1.0 0.0.0.255 access-list 101 deny ip host 192.168.0.110 any access-list 101 deny ip host 192.168.0.100 any access-list 101 deny ip host 192.168.0.103 any access-list 101 permit ip 192.168.0.0 0.0.255.255 any access-list 102 permit udp any host 192.168.0.110 access-list 102 permit udp host 12.12.12.130 any access-list 108 permit ip 192.168.0.0 0.0.255.255 172.16.1.0 0.0.0.255 access-list 108 permit ip host 12.12.12.131 172.16.1.0 0.0.0.255 no cdp run ! ! control-plane ! ! line con 0 password 7 03085E1D030373 speed 115200 line aux 0 exec-timeout 0 1 no exec line vty 0 4 exec-timeout 0 1 privilege level 15 password 7 10420C0F001B40 authorization exec vty no exec transport input all ! ntp logging ntp clock-period 17178879 ntp source FastEthernet0/0 ntp access-group query-only 13 ntp access-group peer 10 ntp access-group serve 11 ntp server 65.105.111.66 end
Company-Router#
|
Answer : Telnet access to Cisco 1841
|
|
line vty 0 4 >authorization exec vty >no exec
Remove the "no exec" (config)#line vty 0 4 (config-ln)#exec
Try again... "no exec" means don't accept any commands coming IN to the interface from external device. Ergo, you get disconnected when you try to even send a carriage return..
|
|
|