• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Adding another Class C to my 2620

S

Soybomb

2[H]4U
Joined
Jun 12, 2000
Messages
2,171
I've got a cisco 2620 with 2 t1's bonded in a multilink configuration. I've been running it with 1 class C of IP's for the time being (lets call it 123.456.789.0/24). I just got my provider to asssign me another class c (lets call it (987.654.321.0/24) and route it to my multilink addres ip (555.555.555.555/255.255.255.252) just as they did with my other class c. I'm not sure what changes to make on my end though.

I presume that ethernet interface should have another IP address assigned to it from that class C, but I'm not sure how to add an alias without overwriting its current IP address. Am I right? What should I need to do on my end to get this up? Thanks guys!

Here's my current config:
router1#sho run
Building configuration...

Current configuration : 2979 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname router
!
boot-start-marker
boot-end-marker
!
enable secret 5 $hash
enable password itsasecrat
!
no network-clock-participate slot 1
no network-clock-participate wic 0
no aaa new-model
ip subnet-zero
ip cef
!
!
!
no ip bootp server
no ftp-server write-enable
!
!
!
!
interface Multilink1
ip address 555.555.555.555 255.255.255.252
no peer neighbor-route
no cdp enable
ppp multilink
ppp multilink fragment disable
ppp multilink group 1
!
interface FastEthernet0/0
ip address 123.456.789.1 255.255.255.0
no ip unreachables
speed auto
full-duplex
no cdp enable
no mop enabled
!
interface Serial0/0
no ip address
encapsulation ppp
no ip mroute-cache
no peer neighbor-route
no fair-queue
no cdp enable
ppp multilink
ppp multilink group 1
!
interface Serial0/1
no ip address
encapsulation ppp
no ip mroute-cache
no peer neighbor-route
no fair-queue
no cdp enable
ppp multilink
ppp multilink group 1
!
ip classless
ip route 0.0.0.0 0.0.0.0 Multilink1
no ip http server
!
access-list 1 permit myauthorizednetworkips's here
no cdp run
snmp-server community mysnmpsecret RO
snmp-server enable traps tty
banner login ^C
This sytem is for use by authorized users only. Any user not authorized for this system is required to disconncet now. By continuing you agree to the logging of your keystrokes. Unauthorized access is prosecuted.^C
banner motd ^C
This system is for use by authorized users only. Any user not authorized for this system is required to disconncet now. By continuing you agree that you are an authorized user and consent to logging of your keystrokes.^C
!
line con 0
line aux 0
line vty 0 4
access-class 1 in
password mysecrat
login
!
!
!
end
 
All you need to do is add the other IP address to the FastEthernet port as a "secondary" address.

try this:

config terminal
int FastEthernet0/0
ip address 987.654.321.1 255.255.255.0 secondary
exit
exit
write mem //saves the config, yo might want to check it first

Then if you do a "show ip route" you should see the route in the routing table.
 
I believe the above would work and while you are at it fix the word disconnect in your banner message :)
 
Thanks, works great, I was unaware of the secondary flag...very useful.

Anyone feel like running their eyes over my ACL's before I implement them and lock myself out? :D

access-list 101 deny ip 10.0.0.0 0.255.255.255 any
access-list 101 deny ip 127.0.0.0 0.255.255.255 any
access-list 101 deny ip 172.16.0.0 0.15.255.255 any
access-list 101 deny ip 192.168.0.0 0.0.255.255 any
access-list 101 deny ip 0.0.0.0 0.255.255.255 any
access-list 101 deny ip 169.254.0.0 0.0.255.255 any
access-list 101 deny ip 224.0.0.0 31.255.255.255 any
access-list 101 deny udp any any eq netbios-ns
access-list 101 deny udp any any eq netbios-dgm
access-list 101 deny tcp any any eq 139
access-list 101 deny tcp any any eq 445
access-list 101 deny udp any any eq 445
access-list 101 permit ip 888.888.888 0.0.0.63 any
access-list 101 permit ip any 987.654.321.0 0.0.0.255
access-list 101 deny udp any any eq snmp
access-list 101 deny tcp any any eq telnet
access-list 101 permit ip any any

access-list 102 deny udp any eq netbios-ns any
access-list 102 deny udp any eq netbios-dgm any
access-list 102 deny tcp any eq 139 any
access-list 102 deny tcp any eq 445 any
access-list 102 deny udp any eq 445 any
access-list 102 permit ip 123.456.789.0 0.0.0.255 any
access-list 102 permit ip 987.654.321.0 0.0.0.255 any


--------------
The goal here is to block nonrouted IPs, incoming netbios, snmp, and telnet to my 123.456.789.0/24 block, allow acccess to everyone in that block from my trusted range of 888.888.888. and allow all incoming traffic to my new class C (987.654.321.0/24).

For egress filtering I only intend to drop outbound netbios and traffic claiming to be from an IP other than one of my 2 blocks.
-------------

It looks about right, but something seems off.
 
You must log in or register to reply here.
Back
Top