?
Solved

How to route 5 static IP's over a cisco network.

Posted on 2006-05-24
11
Medium Priority
?
309 Views
Last Modified: 2008-03-04
Because of the expert knowledg on this forum, I recently got my first Cisco network to route :).  My question now is:  I currently have a block of 5 static IP's.  How do I get my 2620 router to recognize the IP's and pass them to the Firewall so it can filter them.  Once filtered have it pass them to the appropriate machine.

Public IP range:  71.X.X.185 - 71.X.X.189
Public Interface on 2620 gets 17.X.X.190 every time it negotiates with my ISP.

Internal Web Server IP: 10.197.11.10
Internal Mail Server IP: 10.197.11.11

My current setup is as follows:  (71.X.X.190:Public interface)  Cisco 2620 (192.168.9.1: internal interface) --> (192.168.9.2:external interface)  PIX (10.197.11.10: internal interface) --> 10.197.11.0/24 network.

How I would like this setup is:  I want 71.X.X.189 to be pointed to my webserver, 71.X.X.188 pointed to the mail server.  IP's 185-187 just NATed out.  If possible I would like to stay away from DMZ, and just forward the ports that are needed.  I want the 2620 to just pass all incomming IP requests to the PIX and have it forward the approprate ports.

Thank you again for all of your help all!

Adam
0
Comment
Question by:gimmiecpt
  • 3
  • 2
  • 2
  • +1
8 Comments
 
LVL 12

Expert Comment

by:Scotty_cisco
ID: 16752420
Then why are you running a private IP address on the router at all?  how does your connectivity come into the router? ethernet or serial?
you should be able to negotiate the address to the router and then use the first public on the ethernet of your firewall.

Thanks
Scott
0
 
LVL 32

Accepted Solution

by:
rsivanandan earned 336 total points
ID: 16752913
On the router do this;

ip nat inside source static 10.197.11.10 71.x.x.189
ip nat inside source static 10.197.11.11 71.x.x.188

The above says to map the private address to the public address. So when your ISP routes traffic to 71.x.x.189/188, the traffic hits your 2620 router and gets translated to the respective private address.

Try this.

Cheers,
Rajesh

0
 

Author Comment

by:gimmiecpt
ID: 16758067
Scott,
   That is what I thought too, but was never able to get it to work.  How would I set it up to work in that fashion?

Adam

0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 12

Assisted Solution

by:pjtemplin
pjtemplin earned 332 total points
ID: 16760601
Your public subnet is local to the LAN segment from your ISP.  If it's local to that segment, you can't use it on the other side of the router.  As others have pointed out, you'll need to NAT on the Cisco to make your private addresses inherit a public personality.
0
 
LVL 12

Assisted Solution

by:Scotty_cisco
Scotty_cisco earned 332 total points
ID: 16761308
your ISP should have given you 2 addresses one with a 255.255.255.252 mask that goes on the serial.  You use one of the next set (that has 5 addresses in it) on the ethernet or you can use ip unnumbered fa0/0 on the serial and put the serial ip address on the ethernet therefore only using one IP address out of the block for the outside of the firewall.  The firewall will proxy arp for the remaining address if the are configured in the firewall.

Thanks
Scott
0
 
LVL 12

Expert Comment

by:pjtemplin
ID: 16761393
"Should have" and "did" are likely two different things here.

What they likely did is put the /29 on the handoff segment.  "Here you go, you have five addresses."

Most DSL providers will encourage the pounding of sand before they go around reprovisioning subnets because the customer wanted it engineered a different way.  "Here's our T1 product..."
0
 
LVL 12

Expert Comment

by:Scotty_cisco
ID: 16761420
Well then lets clear it up .... what type of interface is facing the ISP .... what type of interface is facing you?  is the ISP give you a 30 bit subnet for one interface and then a 29 bit subnet for the other?

However pjtemplin is correct in stating an ISP  would rather go pound sand than Re-address even the smallest segments.

Thanks
Scott
0
 

Author Comment

by:gimmiecpt
ID: 17162371
Thank you guys for the assistance, sorry for the delay in the response.  My WIC died and I have been trying for 2 months to get it replaced, but the company is being a pain.  I will post on here again soon.. I see some light at the end of the tunnel.

Adam
0

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this tutorial I will show you with short command examples how to obtain a packet footprint of all traffic flowing thru your Juniper device running ScreenOS. I do not know the exact firmware requirement, but I think the fprofile command is availab…
Tired of waiting for your show or movie to load?  Are buffering issues a constant problem with your internet connection?  Check this article out to see if these simple adjustments are the solution for you.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question