CISCO router issues

[Wolf-R1]

This is how I would set it up:

T1/DSL > 1811 > PIX > switch > rest of network

On the 1811 access list the interfaces with reflexive access lists. Allow everything out (unless you want to strictly control what goes out) and any services that you want incoming such as mail allow them in. Set up path redundancy with seperate gateway statements with different administrative distances...whichever line has the greater line speed set that up as the primary traffic line. You can't bond these lines I'm sure because they're two different line speeds. You'd end up eith unequal load balancing.

On the PIX I'd be a bit more strict about security. This is also where I'd set up the NAT translations as well as your DHCP server.

This solution also affords you the ability to have a sort of DMZ in between the 1811 and the PIX firewall that's native rather than handled by a single machine. You could put a web server or an email forwarder server in there and create explicit rules governing traffic between the outside world, the 1811, anything in the DMZ, and your inside world.

I do have to note that the 1811 IOS you have does have a full featured firewall built into it so if you chose the easier route you can still be fairly well protected. Again my personal choice is to act like you can never have enough protection.

 

[Darkstar850]

Ok, after further reading of what your setup is, the floating static will not work. That PBR you are attempting looks good, but lets forget about it for now. We'll work on that later.
Unfortunately the code on my routers is too old to simulate what you are trying to do, so we'll see if we can do this just from looking at the config.

First step is to get connectivity. After that we can work on failover.

Remember to save your current config to a tftp server or something before we start messing around.

I would do the following and see how it works:

no ip route 0.0.0.0 0.0.0.0 67.94.72.193 track 123
no ip route 0.0.0.0 0.0.0.0 71.249.227.1 100
ip route 0.0.0.0 0.0.0.0 67.94.72.193

no ip nat source static tcp 192.168.0.104 5900 71.249.227.155 5900 extendable
ip nat inside source static tcp 192.168.0.104 5900 71.249.227.155 5900 extendable

Mostly just correcting errors and giving us just 1 default route for now. 67.94.72.193 is your T1 provider's gateway, correct?

Also, I don't have any experience on the 1800 at all, but you may have to force the FE interfaces to be layer 2. See if you can do the following to them:
switchport
switchport mode access
switchport access vlan 1

I have a few basic questions:
All your connected interfaces show up/up right?
You said you can ping out from the router I believe. What if you source the pings from the vlan interface?
Are your clients getting full proper dhcp information?
Is the PIX currently connected anywhere, and could it be blocking anything?

Once you have implemented the above (should you chose to do so) please attempt to ping from something attached to vlan1.
Then perform the following and paste the results in the thread

sh ip int bri
sh ip nat trans
sh ip route

 

[illumina315]

Ok, after further reading of what your setup is, the floating static will not work. That PBR you are attempting looks good, but lets forget about it for now. We'll work on that later.
Unfortunately the code on my routers is too old to simulate what you are trying to do, so we'll see if we can do this just from looking at the config.

First step is to get connectivity. After that we can work on failover.

Remember to save your current config to a tftp server or something before we start messing around.

I would do the following and see how it works:

no ip route 0.0.0.0 0.0.0.0 67.94.72.193 track 123
no ip route 0.0.0.0 0.0.0.0 71.249.227.1 100
ip route 0.0.0.0 0.0.0.0 67.94.72.193

no ip nat source static tcp 192.168.0.104 5900 71.249.227.155 5900 extendable
ip nat inside source static tcp 192.168.0.104 5900 71.249.227.155 5900 extendable

Mostly just correcting errors and giving us just 1 default route for now. 67.94.72.193 is your T1 provider's gateway, correct?

Also, I don't have any experience on the 1800 at all, but you may have to force the FE interfaces to be layer 2. See if you can do the following to them:
switchport
switchport mode access
switchport access vlan 1

I have a few basic questions:
All your connected interfaces show up/up right?
You said you can ping out from the router I believe. What if you source the pings from the vlan interface?
Are your clients getting full proper dhcp information?
Is the PIX currently connected anywhere, and could it be blocking anything?

Once you have implemented the above (should you chose to do so) please attempt to ping from something attached to vlan1.
Then perform the following and paste the results in the thread

sh ip int bri
sh ip nat trans
sh ip route

Thanks for the quick help and reply.
I've already set all my switch ports to be layer 2, as well as VLAN 1.
Both FE interfaces show up/up
Im getting DHCP ok, although Im probably going to take it off, and keep the PIX501 doing it.
PIX isnt connected to the 1811 yet.

Pinging internally from VLAN1 works when DSL is plugged in, but not when T1 is. (I manually unplugged the FE0/DSL line when I test the T1)

 

[illumina315]

edit: im a moron

router#sh ip int bri
Interface IP-Address OK? Method Status Protocol
Async1 unassigned YES NVRAM down down
FastEthernet0 71.249.227.154 YES NVRAM up up
FastEthernet1 67.94.72.220 YES NVRAM up up
FastEthernet2 unassigned YES unset up down
FastEthernet3 unassigned YES unset up down
FastEthernet4 unassigned YES unset up down
FastEthernet5 unassigned YES unset up down
FastEthernet6 unassigned YES unset up down
FastEthernet7 unassigned YES unset up up
FastEthernet8 unassigned YES unset up down
FastEthernet9 unassigned YES unset up down
NVI0 unassigned YES unset up up
Vlan1 192.168.0.1 YES NVRAM up up

router#show ip nat trans
Pro Inside global Inside local Outside local Outside global
tcp 71.249.227.155:5900 192.168.0.104:5900 --- ---
tcp 67.94.72.218:5900 192.168.0.218:5900 --- ---

router#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route

Gateway of last resort is 67.94.72.193 to network 0.0.0.0 71.0.0.0/24 is subnetted, 1 subnets C 71.249.227.0 is directly connected, FastEthernet0
67.0.0.0/27 is subnetted, 1 subnets C 67.94.72.192 is directly connected, FastEthernet1
C 192.168.0.0/24 is directly connected, Vlan1 S* 0.0.0.0/0 [1/0] via 67.94.72.193
router#


Current config:

router#write t
Building configuration...

Current configuration : 4101 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname router
!
boot-start-marker
boot-end-marker
!
logging buffered 52000 debugging
enable secret x
enable password x
!
no aaa new-model
!
resource policy
!
clock timezone NewYork -5
clock summer-time NewYork date Apr 6 2003 2:00 Oct 26 2003 2:00
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip subnet-zero
!
!
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.0.1
ip dhcp excluded-address 192.168.0.34 192.168.0.254
ip dhcp excluded-address 192.168.0.2
!
ip dhcp pool Default
import all
network 192.168.0.0 255.255.255.0
dns-server 151.202.0.85 65.106.1.196
default-router 192.168.0.1
lease 5
!
!
ip name-server 151.202.0.85
ip name-server 209.116.241.10
no ip ips deny-action ips-interface
ip sla monitor 1
type echo protocol ipIcmpEcho 67.94.72.193
timeout 1000
threshold 2
frequency 3
ip sla monitor schedule 1 life forever start-time now
!
!
crypto pki trustpoint TP-self-signed-4248908665
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-4248908665
revocation-check none
rsakeypair TP-self-signed-4248908665
!
!
crypto pki certificate chain TP-self-signed-4248908665
certificate self-signed 01
x
quit
username x privilege 15 password 0 x
!
!
track 123 rtr 1 reachability
!
!
!
!
interface FastEthernet0
description $ETH-WAN$
ip address 71.249.227.154 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet1
description $ETH-WAN$
ip address 67.94.72.220 255.255.255.224
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
!
interface FastEthernet5
!
interface FastEthernet6
!
interface FastEthernet7
!
interface FastEthernet8
!
interface FastEthernet9
!
interface Vlan1
ip address 192.168.0.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
interface Async1
no ip address
!
ip classless
ip route 0.0.0.0 0.0.0.0 67.94.72.193
!
!
ip http server
ip http authentication local
ip http secure-server
ip nat inside source list 1 interface FastEthernet0 overload
ip nat inside source static tcp 192.168.0.218 5900 67.94.72.218 5900 extendable
ip nat inside source static tcp 192.168.0.104 5900 71.249.227.155 5900 extendable
!
access-list 1 permit any
snmp-server community x RO
!
!
!
!
control-plane
!
!
line con 0
line 1
modem InOut
stopbits 1
speed 115200
flowcontrol hardware
line aux 0
line vty 0 4
privilege level 15
password x
login local
transport input telnet ssh
!
no scheduler allocate
end

router#


Thanks again guys.

 

[illumina315]

and yet another silly question:

if ISP 1 gives me their Pri and Sec DNS and ISP 2 gives me theirs, which ones should I use for my DHCP's DNS? the Primary's of both?

thanks as usual

 

[illumina315]

im going to cry.

I used a patch cable instead of a crossover cable to hookup the 1811 to the CSU/DSU.

FE1 works now.



now heres the fun part:

how do I set up NATing for both FastEthernet Interfaces? Seems like I cant overload both (IOS wont let me).

thanks a bunch! and sorry for my utter stupidity.

 

[Darkstar850]

how do I set up NATing for both FastEthernet Interfaces? Seems like I cant overload both (IOS wont let me).

thanks a bunch! and sorry for my utter stupidity.

I had already pondered this, and I think it might be tricky. I shall think on this after I go to the gym and read a little TCP/IP illustrated ( )

 

[illumina315]

I had already pondered this, and I think it might be tricky. I shall think on this after I go to the gym and read a little TCP/IP illustrated ( )

Perhaps NAT on a stick?

 

[illumina315]

Perhaps NAT on a stick?

OR:

dont use NAT on the 1811, and do the NATing on the PIX501?

(im running out of ideas)

 

[illumina315]

bump for mass confusion! hooray!

 

[illumina315]

I attempted to move the NATing to the PIX501 without results. I removed the DHCP and nat inside/outside statements on the 1811, and gave the internal VLAN a IP of 192.168.1.1, and the PIX an IP of 192.168.1.2. So far though, no luck.

Any clues as to what im doing wrong?

thanks!

 

[illumina315]

It works. Thanks for all the help guys!


router#write t
Building configuration...

Current configuration : 4386 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname router
!
boot-start-marker
boot-end-marker
!
logging buffered 52000 debugging
enable secret 5 x
enable password x
!
no aaa new-model
!
resource policy
!
clock timezone NewYork -5
clock summer-time NewYork date Apr 6 2003 2:00 Oct 26 2003 2:00
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip subnet-zero
!
!
ip cef
no ip dhcp use vrf connected
!
!
ip name-server 151.202.0.85
ip name-server 209.116.241.10
no ip ips deny-action ips-interface
ip sla monitor 1
type echo protocol ipIcmpEcho 67.94.72.193
timeout 1000
threshold 2
frequency 3
ip sla monitor schedule 1 life forever start-time now
!
!
crypto pki trustpoint TP-self-signed-4248908665
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-4248908665
revocation-check none
rsakeypair TP-self-signed-4248908665
!
!
crypto pki certificate chain TP-self-signed-4248908665
certificate self-signed 01
x
quit
username x privilege 15 password 0 x
!
!
interface Loopback1
no ip address
!
interface FastEthernet0
description ispB
ip address 71.249.227.x 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet1
description ispA
ip address 67.94.72.y 255.255.255.224
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
!
interface FastEthernet5
!
interface FastEthernet6
!
interface FastEthernet7
!
interface FastEthernet8
!
interface FastEthernet9
!
interface Vlan1
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
interface Async1
no ip address
!
ip local policy route-map nexthop
ip classless
ip route 0.0.0.0 0.0.0.0 67.94.72.19x
ip route 0.0.0.0 0.0.0.0 71.249.227.1 100
!
!
ip http server
ip http authentication local
ip http secure-server
ip nat inside source route-map ispA interface FastEthernet1 overload
ip nat inside source route-map ispB interface FastEthernet0 overload
!
access-list 1 permit any
access-list 40 remark NATd addresses
access-list 40 permit 192.168.1.0 0.0.0.255
access-list 130 remark Backup Reroute
access-list 130 permit icmp any any
snmp-server community x RO
!
route-map ispA permit 10
match ip address 40
match interface FastEthernet1
!
route-map ispB permit 10
match ip address 40
match interface FastEthernet0
!
!
!
control-plane
!
!
line con 0
line 1
modem InOut
stopbits 1
speed 115200
flowcontrol hardware
line aux 0
line vty 0 4
privilege level 15
password x
login local
transport input telnet ssh
!
no scheduler allocate
end

Last question:

Where should I put my static IP declarations? on the 1811 as IP NAT source static.... or on the PIX501 behind it as static (inside,outside)... ?


thanks!