Solved

Bridging Internet connection throught PIX and Adtran

Posted on 2004-10-14
19
558 Views
Last Modified: 2007-12-19
HI

       I have a pix 501 that is connected to an internet cloud on one interface. on the other, there are computers on a lan with the first 3 octets of 192.168.1.x with a mask of 255.255.0.0. (ill explain in a sec) I have set up user access lists that allow for some computers to have internet and not others. My problem is not with the LAN but with a new connection that i added a few days ago. The new connection is a frame to another location (approx. 75mi away). Both ends of the frame have an Adtran router. (dont ask me... i didnt pick it) the iso for the adtrans are identical to cisco's but i cant see to allow internet to go through. By the way, the ip address for the adtrans are 192.168.40.x with a sub of 255.255.0.0 (should explain the reason for the choice in mask). the adtrans are just setup as bridges (no DHCP or NAT) the IP address of the computer at the remote location is 192.168.40.5 with a sub of 255.255.0.0 and a default gateway of 192.168.1.1 (Pix 501).

I feel like i am doing somthing incorrectly in the pix.... if it's not too obvious :)

    mike
0
Comment
Question by:MichaelSwitzer
  • 9
  • 8
19 Comments
 
LVL 79

Expert Comment

by:lrmoore
ID: 12318508
So you have:
  Internet --->PIX----PCs --------Adtran---frame/bridge----Adtran---PC's

Why are you bridging instead of routing between the two sites?
How do you have your NAT (inside) setup on the PIX?
0
 
LVL 1

Author Comment

by:MichaelSwitzer
ID: 12320531
Your diagram is correct

   >>Why are you bridging instead of routing between the two sites?
        Umm..... because its easier????? i am lacking education in the routing Dept. I would absolutely love to route packets between the two sites.

the pix doesnt manage any Ip address ( by manage, i mean assign) I set up a domain controller with Server 03 on it. The Controller allows assigning ip addresses to MAC addresses.  I would love some suggestion of a routing scheme, but i would need guidance. I am willing to jump what ever hoop needed to create a strong/effecient network(wan).
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 500 total points
ID: 12320655
Best bet scenario:

Remote Adtran - turn off all bridging

   Interface Eth0
     ip address 192.168.225.1 255.255.255.0   <-- note the mask    
     ip helper-address 192.168.1.255  <-- allows you to use just the one DHCP server with multiple scopes
     
   Interface fr 1.1  <-- I'm assuming that you have this already setup/configured for frame-relay and that part is working
     ip address 192.168.255.2 255.255.255.252

   ip route 0.0.0.0 0.0.0.0 192.168.255.1   <-- all traffic goes to the HQ side Adtran

HQ Adtran - turn off all bridging

   Interface Eth 0
     ip address 192.168.1.254 255.255.255.0  <-- note the mask

   Interface fr 1.1
     ip address 192.168.255.1 255.255.255.252

   ip route 0.0.0.0 0.0.0.0 192.168.1.1  <-- points to the PIX

PIX:
   ip address inside 192.168.1.1 255.255.255.0     <-- note the mask
   global (outside) 1 interface
   nat (inside) 1 0 0
   route inside 192.168.225.0 255.255.255.0 192.168.1.254

Done. Now just make sure all of your local systems use the correct mask 255.255.255.0, and that the default gateway points to the local Adtran, not to the PIX.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12320682
Oops, I forgot the other static route on the HQ Adtran:
   
    ip route 1921.68.225.0 255.255.255.0 192.168.255.2

0
 
LVL 1

Author Comment

by:MichaelSwitzer
ID: 12321413
i need to soak all that in....I will study it and probably ask a question or two until i am able to administer the equiptment. (i am at school until about 6 CST mon/wed/fri)

In the mean time...i am trying to understand "HQ." becuase of its shortness, google is not very effective.

again, thank you so much for your help. Ill check back as soon as possible.

Mike
0
 
LVL 1

Author Comment

by:MichaelSwitzer
ID: 12321442
by the way.... how does  "soho" relate to "hq"
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12321581
HQ = HeadQuarters - main site, company offices, where the PIX resides
SOHO = Small Office, Home Office. SOHO is a marketing term that designates products designed specifically for the "Small office /Home office environment. They are not designed to be "industrial strength" or to meet any coroporate standards or heavy-duty use.


<8-}

0
 
LVL 1

Author Comment

by:MichaelSwitzer
ID: 12326073
Now that all of this has been said, I would like to post the situation that will be happening shortly...  :)

There are about 9 locations (including the two that we are discussing currently) that will be connected by a frame. (the original reason for this is to be able to view any 5 cameras at any desired location from 1 computer) I really anticipate on being able to use the new exhisting server (running Windows Server 2003 Enterprise) to control (if possible: multiple ??) the domain currently set up but expanded to the other 8 locations. I am bringing this up because is looked as though the subnets (i could be blatantly incorrect) of the frame (255.255.255.252) would mask 6bits, only allowing for 3 possible ip address that can be seen. Is there a reason that the masks couldnt be 255.255.255.240, masking only the first 4 bits, thus allowing 15 possibilities? again, my cisco is a little weak and i am not trusting it a whole lot, but i thought that was the case.

- I got all excited when i saw you use the word "scopes." This is because i was working with them on the server... I want to use the most correct method and system that i can. i need to learn more.

-i dont understand (not because i know what im talking about) why the third octet of the remote adtran ip addres is 255 (192.168.255.1) does that allow for broadcasting on the oct.....sub....maskkk.........help.

-More over, i cant express how much i appriciate your help thus far. i dont feel like i am being completely fair though because i feel as if i need to know more. Would you have any recomendations of literature that i can study to become more proficient in the iso and frames? (not to mention server 03)   ( similar to "give a man a fish, feed him for a day. Teach a man to fish, feed him for a lifetime..")

                    Thanks again
                             Mike


0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 
LVL 79

Expert Comment

by:lrmoore
ID: 12346750
>why the third octet of the remote adtran ip addres is 255 (192.168.255.1) does that allow for broadcasting on the oct.....sub....maskkk.........help.
No, just a subnet I picked out of the air. Most people don't realize that they can use this subnet, so I like to reserve it for point-to-point links

Any progress on your part?
0
 
LVL 1

Author Comment

by:MichaelSwitzer
ID: 12350490
if i change the ipaddress of interface eth 0 of the remote adtran, wont i loose connectivity to the comuters that are on the 192.168.40.x subnet?

i changed the ip of fr 1.1 on remote adtran to 192.168.255.2 255.255.255.252 and i lost connectivity to it.

On the Hq adtran, I created interface fr 1.1 and made it's ip address 192.168.255.1 255.255.255.252 and created the route 0.0.0.0 0.0.0.0 192.168.1.1          I still dont have connectivity to the remote adtran and when i "show interfaces," fr 1.1 is inactive ( still on the HQ)
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12350576
Yes, you do have some planning to do on the remote site to change the computer's IP's and subnet masks, same on the HQ side to chang all the masks to 255.255.255.0

You may have lost connectivity because the DLCI is inactive. Was it up before you changed the IP? That doesn't make sense that the layer 2 pvc goes inactive because the L3 ip address changed... unless you have overlapping masks now. Did you change the Ethernet mask on the remote site, too?

Unless you are physically at the remote and can touch everything, you have to be very careful of what order you change things.
How are you connecting to the remote Adtran? If by telnet, which interface did you telnet to?




0
 
LVL 1

Author Comment

by:MichaelSwitzer
ID: 12350691
i am currently at my home and i ( becuase of your help) am able to RDC into the main server. once i am on the main server, i could telnet into hq adtran, remote adtran, and the pix, but after i made the change to the remote adtran, i have no more connection to it.

right now, i am mainly worried about getting connectivity to the remote adtran again. eth 0 should not affect connectivity to the router from the frame, correct?
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12351511
It might if the ip subnets overlap on Eth0 and fr 1.1
Did you turn bridging off?
0
 
LVL 1

Author Comment

by:MichaelSwitzer
ID: 12351579
what command turns off bridging?
Overlap?
please bare with me. If you know a good site that trains cisco command lines, please let me know. (Maybe with an explination that doesn't take me 4 hours just to read (ie: cisco.netacad.net)
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12403558
Any progress? Are you still working on this?
Sorry if I have been lax in getting back with you on it..

0
 
LVL 1

Author Comment

by:MichaelSwitzer
ID: 12414514
After i changed the ip address and subnet to the soho, i lost connectivity... i tried a number of things on the HQ but was unsuccessful. I dont understand the iso enough yet... :(..    I am going to the remote location today to change the settings back to what they were.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 13688762
Do you need more information?
Have you resolved this problem?
Can you close this question?
Thanks!
0

Featured Post

Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

Join & Write a Comment

Problem Description:   Couple of months ago we upgraded the ADSL line at our branch office from Home to Business line. The purpose of transforming the service to have static public IP’s. We were in need for public IP’s to publish our web resour…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now