Cisco DMVPN Hub Router placement on network

I have planned out a DMVPN deployment for use as backup links into our main datacenter if our remote branches were to go down. I am just having some trouble trying to place my DMVPN hub router on our corporate network. We have a T-1 feeding into a T-1 router, and behind that is a PIX 515 firewall, which then in turn plugs into our corporate switch. I know the hub router has to have a public IP address, and I thought about placing our hub router behind the firewall, and do a nat translation to the inside IP address, BUT this is a router and I need to different networks on both sides of the router....any help on this design would be appreciated. Thanks.
StaffordITAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

dkarpekinCommented:
Ussially www.cisco.com have all kind of design topology- it is endless, as well sales might help you choose one.
You should post some diagram, with IP addressing, sanitazed, if have to.
0
StaffordITAuthor Commented:
Ok, yea I've had a couple of engineers to try and help me, but what they say isn't making any sense. and i'm still stuck. I'll post a diagram, let me work up a diagram and post it...thanks.
0
dkarpekinCommented:
If you search cisco.com by keywords- network topology, diagram, and so on, DMVPN schenario, and so on, I'm sure you'll find a lot of very usefull stuff, in your case. It is just not really easy to find the right one.
0
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

StaffordITAuthor Commented:
I understand the layout and how it's supposed to be setup, but I'm just trying to figure out where to place my hub router on my internal network I've got a diagram attached..i thought about placing it behind my PIX and do a static nat translation of the public IP address to the internal IP of the router...if I do this, then my router will have an internal IP address, but where does my other interface on my router plug up to, and what IP do I give that? I can't give my router 2 internal IP's on the same network...I thought about just making a new subnet and utilizing one of the extra interfaces on my PIX and plug up the router to it, and give it a subnet that doesn't exist on our network anywhere, and then the other interface of my router give it an IP address on our VLAN 21 subnet....what do you think? Thanks for your help so far
Design-and-Layout.jpg
0
dkarpekinCommented:
It is a bit confusing still - there is no IP/VLAN/purpose discription of MPLS/internet routers , and why is 10.9.0.X- is that  T1's used for home users?
Is the purpose here have "remote users" be able connect to datacenter either over internet or from home as well? And
Personally I would never use 192.168.0.0 on producion, it is ment to use for really small networks (home), and can create problem.
If "Data Center router" is 2800 series, than you can use instead of "DMVPN Hub router", this way it is should simplify config, or have it "DMVPN Hub router" place "before" firewall, if so much security consern.
If not then enable firewall on "DMVPN Hub router" itself will do the job (I assume it is 2800).
Can't give you advise on IP schema - it is not totaly clear, what portions have to be separated and goal, you tring achive.
0
StaffordITAuthor Commented:
Sorry for the confusion...I've went through a bunch of people already about this, and after a while of saying it so much you dont realize you leave out details. What we are trying to acheive is a failover model for our branch offices. Network traffic would failover to the DMVPN link to the main office in case the MPLS router/link were to go down. We are just simplly trying to achieve failover to our home network. I've changed the subnets to different subnets (those are not our actual subnets just for security purposes) The data center router is a 2800 series router. If I use it, then since it's in front of the firewall, what kind of traffic do I let through? And If I'm using EIGRP as my routing protocol, wouldn't this traffic have to pass through the firewall as well? Thanks for your help and I hope this better explains our mission. Thanks.
0
StaffordITAuthor Commented:
Oh to add, i put the users on the right hand side of the document because we are actually thinking about starting to utilize the home/office thing. I just laid it out on the diagram as a potential future option. This definitely isn't going to be part of phase 1 of this.
0
dkarpekinCommented:
You probably should redraw this , to reflect interfaces FE0/0 , FE0/1, T1serial0/0/0, T1serial0/1/0 and so on....
Post as .vsd file - so it can be modifyed  and posted back.
Here is very easy guide, you can try out, to begin with
http://www.cisco.com/en/US/technologies/tk583/tk372/technologies_white_paper0900aecd801af458.html
Also you should see
http://www.cisco.com/en/US/docs/routers/access/cisco_router_and_security_device_manager/25/software/user/guide/DMVPN.html
and choose what out of 4 VPN topologies you need -
http://www.cisco.com/en/US/docs/net_mgmt/ip_solution_center/5.0/mpls_diagnostics/user/guide/ap_vpn.html#wp1015853
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
StaffordITAuthor Commented:
Great! Thanks for your help!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Networking Hardware-Other

From novice to tech pro — start learning today.