UVerse Router/Firewall question

[nuggetingb]

NO it will not work  i have tryed it your tv will start to fail and it just a pain in the **bleep** dont get it. i had to go back to road runner.  because thay mest every thing up and i cant get DSL back

[Kent_1]

I have a very similar setup as you mentioned.

My internet access and phone work fine but TV will freeze in 10 seconds for ever channel.

I tried to set up MTU to 1492 in Cisco router but still not help.

Appreciate if you have any clue, suggestion or solution.

[TV receiver]-----LAN [Cisco 1811-NAT] WAN-----DMZPlus mode[2wired RG]-----VDSL

[SomeJoe7777 ACE - Expert]

---

Kent wrote:

I have a very similar setup as you mentioned.

My internet access and phone work fine but TV will freeze in 10 seconds for ever channel.

I tried to set up MTU to 1492 in Cisco router but still not help.

Appreciate if you have any clue, suggestion or solution.

[TV receiver]-----LAN [Cisco 1811-NAT] WAN-----DMZPlus mode[2wired RG]-----VDSL

---

You cannot place TV STB/DVR units behind your own router.  They must be plugged directly into the RG.

Only computers should be plugged in behind your Cisco.

[Kent_1]

Thanks for you quick reply.

However, if I connect directly to RG, the screen keep staying in "AT&S U-Verse" (background orange color) and no more response even I tried to push OK, menu or guide button.

I chat with AT&T online support and reset TV receiver, restart RG and Cisco router (all wait for more than 10 minutes) but still not help.

Any suggestion? Do you have the similar setup? Do I miss any configuration on RG?

[SomeJoe7777 ACE - Expert]

It has been reported that in some cases, the reboot for the STBs can be as long as 15-20 minutes, depending on what the STB needs to do.  If it seems to hang at the orange screen, just wait.

Also, instead of rebooting the STB by holding down the power button or using the Restart command in the menu, reboot it by unplugging it for 30 seconds and plugging it back in.  Make sure and do this AFTER the network connection has been moved to the RG.

As long as your computers are accessing the internet correctly, the RG should be up and running properly, and all that you should have to restart are the DVR/STB units.

[Kent_1]

I tried your suggestion and now it stays in same orange screen but had few words at the bottom.

"Client initialization error                 Quit client"

This message was seen when the technician first time set up my U-Verse service and he called back to AT&T and provided kind of serial number things and reset TV receiver.

So, what should I do now? Do you need any info (serial # or MAC) from TV receiver box(VIP1216)?

[SomeJoe7777 ACE - Expert]

Client Initialization Error means that the STB/DVR doesn't have a good network connection.

Check the Ethernet or Coax connection to that STB/DVR carefully, make sure the connectors are screwed on tight for coax, make sure the RJ45 jack is plugged in all the way for Ethernet.  Also make sure you're using a connection that's directly to the RG.  You might try a computer on that Ethernet connection and make sure it gets a DHCP address from the RG (192.168.x.x).

If that doesn't work, you'll need to call tech support and have them send a tech.

[Kent_1]

The connection is fine. RG displays it assigned 192.168.1.64 to TV receiver.

Looks like I need to call tech support.

BTW, I just have U-verse service installed last Wednesday (3/24). Is the tesch support free for this issue?

Thanks.

[SomeJoe7777 ACE - Expert]

Yes, the tech should be free assuming its their equipment or their networking.  If they discover it's your equipment that is causing the problem they will charge you.

[smartasc_1]

I'm having a time and a half with a similar Router-behind-router and VPN issue.  I have successfully setup the RG and my Netgear WNR834b router so that all internet traffic seems to be going through just fine except for my VPN.  I am using just a standard Windows PPTP VPN client.  Nothing too fancy: 

* I've checked the IPSEC 50/51... which I think is not being used

* I've got the RG in DMZ+ mode for the WNR834B,

* I'm using a different IP Pool: 172.* for the RG and 10.* for the internal router

* My internal router is using the same subnet as the RG

What gives?  I just can't seem to get any VPN traffic through.  When I connect directly to the RG, no problem, VPN works just fine.  And all other internet traffic works fine.

Any suggestions?  Maybe a WNR834B Walkthrough?

Thanks,

Adarsh

[HectorG]

Have an issue with a Cisco 1801 Integrated Services Router connecting to my Uverse RG.

Here is my setup

RG (Lan Port 2) -> (FE0 Wan port)  Cisco 1801 (FE1 Lan Port) -> (LAN Port 1) Linksys WRT610N

No Choice       ->         My FW I already have configured             -> 1000MB/s Speed and Wireless N Support

Here is the config for that interface

interface FastEthernet0
 ip address dhcp client-id FastEthernet0
 ip nat outside
 ip virtual-reassembly
 zone-member security out-zone
 speed 100
 full-duplex

If I sh interface stats Take a look at my interface resets. I am not sure Why that is happening. That is an 18 hour period I believe.

#sh int fa0
FastEthernet0 is up, line protocol is up
  Hardware is PQ3_TSEC, address is 0024.978d.4044 (bia 0024.978d.4044)
  Internet address is 00.00.00.00/22 masked for safety
  MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Full-duplex, 100Mb/s, 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:01, output 00:00:02, output hang never
  Last clearing of "show interface" counters 1d13h
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 11000 bits/sec, 1 packets/sec
  5 minute output rate 1000 bits/sec, 2 packets/sec
     669271 packets input, 486172123 bytes
     Received 37606 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog
     0 input packets with dribble condition detected
     547309 packets output, 88064555 bytes, 0 underruns
     0 output errors, 0 collisions, 13647 interface resets
     0 unknown protocol drops
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out

If I connect my computer directly to the RG I get a good download speed of about 11  and an up of 1.4

I am not sure if I am doing something wrong here but would sure appreciate any help.

The Linksys is set up as a router but really actls like a switch since I am not using the WAN port. I am pretty sure all this equipment is good as I was using it with my dsl before. I believe the interface resets are due to a physical problem but cant pinpoint it. I tried replacing the cable between the two routers and nothing. It is an Xover cat 6 cable that I made and tested with a fluke. The other was a straight cat 5e store bought. Both did the same thing. Not sure if I can give any better info but if I can just let me know. Thanks in advance.

[SomeJoe7777 ACE - Expert]

I would remove your forced 100Mbps full duplex config.  Instead use:

speed auto

duplex auto

Not positive on those commands, they might be different syntax.  My IOS knowledge is a little rusty. 

[cheer]

---

SomeJoe7777 wrote:

I would remove your forced 100Mbps full duplex config.  Instead use:

speed auto

duplex auto

Not positive on those commands, they might be different syntax.  My IOS knowledge is a little rusty. 

---

Those are correct, but if there were a duplex mismatch I'd expect to see CRC errors, not interface resets.

Most of the times I've seen interface resets it's been underruns or queued packets not transmitting for several seconds.  It can also be actual interface bounces.

I would try enabling debug-level logging and checking the log after the resets counter increments.

[HectorG]

I did that and it made things a whole lot better. I have had just 2 interface resets in the last 15 minutes. I did try downloading a 1080p trailer to make sure it was working.  My upload speed is a little more solid. It seems to stay above the 6M and mostly up in the 9 - 11 range which is way better than what I was getting before. Is it normal to get interface resets? I have never seen this before.. 

[HectorG]

I had read something about DHCP rests every 5 minutes or something like that. Is it possible that it is what is causing the resets now? If so is there any way to check that from the RG logs? I am not sure what to look for.

[SomeJoe7777 ACE - Expert]

To get a better idea of how many interface resets you're actually getting, you need to wait a lot longer than 15 minutes.  Give it 12 hours and then go check again.  It's possible that those 2 resets occurred right when the interfaces came online, and you're not actually getting any now.

[HectorG]

I thought about that so I cleared my counters nd tried again. I am pretty convinced that it has something to do with the DHCP.. Here is Why...

Any Ideas?

[HectorG]

Here are those images again looks like they were blocked by the forum for some reason.

http://www.flickr.com/photos/hectorg/4859411883/

http://www.flickr.com/photos/hectorg/4860032192/

http://www.flickr.com/photos/hectorg/4859412085/

[SomeJoe7777 ACE - Expert]

We've seen this kind of oddity with DHCP on some routers, most notably on Linksys routers running aftermarket firmware like DDWRT or Tomato.  There's something in those DHCP implementations that the 2Wire doesn't like.

Change the IP address on your Cisco to a static IP, use something below the DHCP range of the 2Wire, like 192.168.1.20.

[HectorG]

I currently have it using dmzplus and my cisco router gets the wan ip from the RG. I am not sure how that would help me? Must I remove my dmzplus settings on the RG? I thought that was the only way to set up a router behind the RG and use my own private subnet internally.

[SomeJoe7777 ACE - Expert]

You have to use DHCP at first to get the RG to recognize that your router is on the network.

Once you have the outside IP, subnet mask, gateway, and DNS assigned to your Cisco via DHCP, just write them down.

Now go back and statically assign those same settings to the Cisco so that it doesn't attempt DHCP renewals all the time.  The RG will be fine with this.  You'll keep the RG configuration the same, including the DMZplus setting.

[HectorG]

Great I will try that when I get home. I guess I will be good as long as I don't loose power since uverse assigns a dhcp address to my RG. Is that a correct assumption?

[SomeJoe7777 ACE - Expert]

Technically, the IP address assigned by AT&T to your RG is dynamic, but it is set up with your account and is tied to the X.509 certificate in the RG.  Unless your RG is swapped or your account is reprovisioned, the outside IP address will not change.

[HectorG]

Thats good to know. Thanks again, I will let you know how it goes.

[HectorG]

Alright so it looks like that worked! I have been up for about 1 hour with the changes and no more resets! Woohoo. Thanks.

Got another question though, I assigned the WAN IP (for example 123.123.123.12) to interface on cisco router, assigned default-gateway (123.123.123.1) to router, and finally I assigned both of the name-servers to the router. For some reason the default-gateway setting didn't do much and still wasn't allowing me to surf the web. I was forced to put a static route going to my WAN gateway (123.123.123.1) I though the default-gateway would do the trick? How come the DHCP didnt need the default route that I added to get it to work? Did I do this correctly?

Thanks again!

[SomeJoe7777 ACE - Expert]

On Cisco routers when doing a static IP configuration, you need both.

default-gateway ww.xx.yy.zz

tells the Cisco what default gateway to use for commands within the IOS session.  For example, if you do:

ping ww.xx.yy.zz

within the IOS session, the configured default gateway in the default-gateway command will be used to perform that ping.

ip route ww.xx.yy.zz aa.bb.cc.dd ii.jj.kk.ll

is the command to put in a static route.  This is required to actually route packets that are coming in from other hosts on the network.

When using DHCP, the DHCP client process in the Cisco configures both of these behind the scenes.

[HectorG]

Great explanation thanks! Looks like everything is working now. I appreciate all your help!

[Prem_Tech]

Actually, though STB receivers may work with a 100Mbps switch, optimum performance requires a Gigabit switch, which is what the Prem Techs install if needed. The receivers should run @ 112Mbps and the DVR @ 128Mbps.

[SomeJoe7777 ACE - Expert]

---

Prem_Tech wrote:

Actually, though STB receivers may work with a 100Mbps switch, optimum performance requires a Gigabit switch, which is what the Prem Techs install if needed. The receivers should run @ 112Mbps and the DVR @ 128Mbps.

---

Not true at all.  The RG's internal Ethernet switch is 100 Mbps and works perfectly.

The 112 Mbps bandwidth on coax is an aggregate/shared rate among the entire coax system, and each STB only gets a fraction of that.

The important part with any switch is that is support 802.1p priority tags, not the bandwidth.

[wb6vpm]

can someone provide the step by step instructions to be able to use a public IP (doesnt have to be statically set as far as i am concerned, it can continue to be DHCP) for a separate firewall?