We help IT Professionals succeed at work.

DHCP to only 1 interface on Cisco1603:Possible?

Medium Priority
293 Views
Last Modified: 2013-11-16
I have a VPN setup with 2 sites.  Let's call SiteA the 192.168.1 network.  I will call SiteB the 192.168.2 nework.  I have a new group of people that showed up at SiteB.  We want to keep them apart.  So, I thought that I could put up a Cisco 1603 router with IOS 12.0.(5) and seperate them.  I have diagramed this below.  So, I thought that if I put them on one side of the 1603 and forwarded their requests to the Internet -- then they would be safe in their own little world.  And, I have a couple of questions about it.  (Also, I realize that some one may see this and prefer a different physical configuration, but I don't have a lot of resources...fire away.)

My Rules:
I want the 1603 router to answer DHCP requests on interface E1 for the new group.  
I want them to have network address like 176.16.0.10 and up.  
I only want the new group to get to the Internet.
I don't want them on the 192.168.2 network except to jump on to the Internet.  
Oh, Yeah...there is no other DHCP server on the network at this time...all PC's are statically assigned--small shop ya know.

First, can you put DHCP on one interface only?  (This is important to me because the netork may have a DHCP server on the other segment in the future.)
Second, does anyone have a router configuration that would satisfy this design?  

I have static IP's assigned to the pix boxes in the picture.  They are working fine and negotiate a 3DES connection: life is good.  Thus, I don't really want to change the configuration on the pix boxes nor do I want to put the 1603 in between them in some way.  HOWEVER, I am open to suggestions from the experts.  

(Final Note: I realize that I have to put some kind of additional commands in the SiteB pix so that it accepts request from the 172 network.)

    The World
    |
    |
    Internet-----VPN TUNNEL----(public IP address)---[Pix 501 SiteA]+---(192.168.1 SiteA Network)
    |
    |
    + (public IP address)
    [Pix 501 SiteB]
    + (192.168.2.1 SiteB Network)
    |
    +
    [Switch]+---[PC]----[PC]----[etc... 192.168.2 SiteB Network]
    +
    |
    +{E0} (192.168.2.254 Network)
    [Cisco 1603]
    +{E1} (172.16.0.254 New Group at SiteB)
    |
    [Switch]----[PC]----[PC]----[etc... 172.16.0 Network]

Thanks.

William
Comment
Watch Question

Seems simple enough to me.

As long as your IOS on the 1603 support DHCP pools, you're golden.

Just enter a configuration similar to this;

ip dhcp pool "name"
   network 172.16.0.0 255.255.255.0
   dns-server "enter your DNS server here"
   default-router 172.16.0.254
   

This will enable all clients off the E1 interface of that router to get a dynamically assigned IP address.

On the 1603, make sure you enter a default route of 192.168.2.1

On the PIX you'll need to add something similar to "nat (inside) 1 172.16.0.0 255.255.255.0" to allow access to the internet. You'll probably also have to add a route to this new network by typing "route inside 172.16.0.0 255.255.255.0 192.168.2.254" on the PIX.

If you want to limit access of this new group to your 192.168.2.0 network; just create an access-list denying it. Keep in mind though; they will need access to 192.168.2.1; that's it.

Make sense?

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts

Author

Commented:
Italia,

this made perfect sense.  Thanks.  At my first attempt, I found I did not have DHCP supported under this image.  I have upgraded the IOS and this is just perfect.

Thank you again.

William

Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.