Press "Enter" to skip to content

//> A L C A T R O N . N E T //> Posts

Port Forward on Cisco 877

Published January 3, 2009

Are you running a server, utorrent or some other application which requires a port to be forwarded back to your internal network?

Its very simple and easy to do on the Cisco 877.

Direct Forwarding

a) We have a webserver on port 80 and we wish to forward port 80 from outside back to internal

ip nat inside source static tcp 10.108.1.6 80 interface Dialer1 80

b) A torrent type port forward:

ip nat inside source static tcp 10.108.1.1 61437 interface Dialer1 61437

As we can see basically we are opening external ports on the router, and allowing that port to be routed back to our internal network on the specified IP address. (Remember to substitute your internal IP address above and the port you wish to use. You may also need to change the Dialer, either Dialer1 or Dialer0 depending how your device is configured)

Re-Direct Forwarding

In your internal network you may have 3 machines which all run RDP on port 3389. Now you cannot map 3389 three times, only 1 port can be used at a time.

So what you can do, is setup a redirection so that the external port numbers are different but map to the same 3389 port numbers internally.

Example:

ip nat inside source static tcp 10.108.1.1 3389 interface Dialer1 4321

In this example, port 4321 is opened externally which maps back to the internal IP address on port 3389  (RDP)

ip nat inside source static tcp 10.108.1.10 3389 interface Dialer1 1832

Another example opening another external port to redirect to a different host inside the internal network for RDP

Another good example is you might be running a SSH server on your inside network on port 22, while externally you can configure it to be seen as port 6211.

ip nat inside source static tcp 10.108.1.10 3389 interface Dialer1 6211

This is a good security practice, so that you do not get constantly probed by bots on port 22 to try hack into your box with username/password combinations.

Leave a Comment

Upgrading Alcatel DSL Firmware on Cisco 877

Published December 27, 2008

Brief Overview

The Cisco 877 comes with the default Alcatel firmware loaded AMR-3.0.014.bin. I decided to upgrade this to the latest one AMR-4.0.015.bin. There is quite a few improvements in this firmware mainly to do with stability and dslam compatibility. Since I had c870-advsecurityk9-mz.124-22.T IOS installed the firmware update worked but I could get no sync, the CD light kept flashing constantly. I think they are looking at creating a later version of the firmware to work with the -22T IOS.

In order to get the new firmware (AMR-4.0.015.bin) fully working I had to downgrade the IOS to c870-advsecurityk9-mz.124-20. After this occured everything worked perfect.

Previously by default if you issued “show dsl int” it would read:

Init FW: init_AMR-3.0.014_no_bist.bin
Operation FW: AMR-3.0.014.bin
FW Source: embedded
FW Version: 3.0.14

Now after the firmware upgrade it read:

Init FW:         init_AMR-4.0.015.bin
Operation FW:    AMR-4.0.015.bin
FW Source:       external
FW Version:      4.0.15

The Process

To upgrade the firmware I downloaded the latest adsl_alc_20190.bin.4.0.15, next I setup my TFTP server.
The file required to be renamed so the adsl modem can pick up the new firmware. So i renamed the file to “adsl_alc_20190.bin”

This file had to be placed on the tftp server so I could perform the upgrade. The following commands were issued as an example:

cisco877#copy tftp flash
Address or name of remote host []? 10.108.1.16
Source filename []? adsl_alc_20190.bin
Destination filename [adsl_alc_20190.bin]?
Accessing tftp://10.108.1.16/adsl_alc_20190.bin…
Loading adsl_alc_20190.bin from 10.108.1.16 (via Vlan1): !!!!
[OK – 996472 bytes]

996472 bytes copied in 9.176 secs (108595 bytes/sec)

I issued the “dir flash:” command to make sure it was present:

cisco877#dir
Directory of flash:/

2  -rwx    18275844  Dec 27 2008 16:42:44 +10:30  c870-advsecurityk9-mz.124n
3  -rwx        3179   Mar 1 2002 10:34:39 +10:30  sdmconfig-8xx.cfg
4  -rwx      931840   Mar 1 2002 10:34:59 +10:30  es.tar
5  -rwx     1505280   Mar 1 2002 10:35:27 +10:30  common.tar
6  -rwx        1038   Mar 1 2002 10:35:44 +10:30  home.shtml
7  -rwx      112640   Mar 1 2002 10:35:58 +10:30  home.tar
8  -rwx      996472  Dec 27 2008 16:43:47 +10:30  adsl_alc_20190.bin

23482368 bytes total (1648640 bytes free)

After this was complete, the command “reload” was issued so the router can reboot and pickup the new firmware.

cisco877#reload
Proceed with reload? [confirm] yes

Note: If I issued “delete flash:adsl_alc_20190.bin” the firmware would be removed and the default one would be loaded from within the IOS “AMR-3.0.014.bin”. So there is nothing you can really do to screw up the upgrade if something goes wrong, simply just delete the file from the flash.

Issues discovered

I needed to rollback to c870-advsecurityk9-mz.124-20.T for the firmware to work, and I had c870-advsecurityk9-mz.124-22.T installed. So what I did was just issue the command

cisco877#delete flash:/c870-advsecurityk9-mz.124-22.T.bin
Delete filename [c870-advsecurityk9-mz.124-22.T.bin]?
Delete flash:/c870-advsecurityk9-mz.124-22.T.bin? [confirm]

After this I then tried copying the -20.T IOS via FTP however this kept constantly failing, and I had no idea why with the following error:

cisco877#copy tftp flash
Address or name of remote host []? 10.108.1.16
Source filename []? c870-advsecurityk9-mz.124-20.T.bin
Destination filename [c870-advsecurityk9-mz.124-20.T.bin]?
Accessing tftp://10.108.1.16/c870-advsecurityk9-mz.124-20.T.bin…
Loading c870-advsecurityk9-mz.124-20.T.bin from 10.108.1.16 (via Vlan1): !!!!!!]

%Error reading tftp://10.108.1.16/c870-advsecurityk9-mz.124-20.T.bin (Connectio)

I was now thinking, what am i going to do now without the ability to copy this IOS via TFTP. So I did a bit more research and found you can also copy the IOS image via FTP. So then I setup a FTP server with anonymous login and attempted again..

cisco877#copy ftp://10.108.1.10/c870-advsecurityk9-mz.124-20.T.bin flash
Destination filename [c870-advsecurityk9-mz.124-20.T.bin]?
Accessing ftp://10.108.1.10/c870-advsecurityk9-mz.124-20.T.bin…
Loading c870-advsecurityk9-mz.124-20.T.bin !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[OK – 18275844/4096 bytes]

18275844 bytes copied in 220.164 secs (83010 bytes/sec)

And YESS! The copy worked perfect and IOS loaded just fine, no idea why TFTP didnt like the file 🙁

So if you are in the same scenario ever like this, simply use FTP instead of TFTP to copy an IOS.

A Tip

Remember previously how you had to issue the command “service internal” to configure noise margin settings…well that is no longer the case with this new firmware! Now it is by default in the atm0 interface mode, and theres a few other settings you can adjust as well..

cisco877(config-if)#dsl ?
bitswap              Bitswap Feature
enable-training-log  enable the fw training log for Showtime and failure  cases
gain-setting         ADSL programmable gain setting
lom                      Loss Of Margin watch counter for line retrain
max-tone-bits     set maximum bits per tone limit
noise-margin       set noise margin offset
operating-mode   auto or specific ADSL mode
power-cutback     Noise Threshold for Power CutBack
sync                    ADSL sync preferences

If you decide to take this upgrade path, let me know how you go and if you have any comments or further tips to add to this 🙂

[ad#googleadd1]

15 Comments

Cisco 877 SNR Adjustment for Stability

Published December 27, 2008

I managed to find out a secret setting within the 877 to fine tune the SNR margin if you are having stability issues maintaining adsl line sync.

Go into global configuration mode and type the following:
service internal
int atm 0
dsl noise-margin (a value between -3 and 3)

The service internal command exposes the dsl noise-margin command (and other hidden/non standard commands). The dsl noise-margin forces the router to training at a higher noise margin (sacrificing speed for stability). Setting this to 3 for example should see you get a higher noise margin, slower speed (and depending on firmware) a higher attenuation.
Start at 3 and work your way down to 0 in 0.5 steps until you get a stable connection. A value of 0 is the same as not having this command at all (eg: normal settings).
If you add a dsl noise-margin command, after a reload you’ll see “WARNING: Unsupported Command. May cause violation to ADSL standards.” on bootup, ignore it, it’s just the addition of the noise-margin command.
Use the dsl noise-margin command to fine tune your connection to get that extra stability if required.

[ad#googleadd1]

2 Comments