Cisco DMVPN Hub Router placement on network

I have planned out a DMVPN deployment for use as backup links into our main datacenter if our remote branches were to go down. I am just having some trouble trying to place my DMVPN hub router on our corporate network. We have a T-1 feeding into a T-1 router, and behind that is a PIX 515 firewall, which then in turn plugs into our corporate switch. I know the hub router has to have a public IP address, and I thought about placing our hub router behind the firewall, and do a nat translation to the inside IP address, BUT this is a router and I need to different networks on both sides of the router....any help on this design would be appreciated. Thanks.
StaffordITAsked:
Who is Participating?
 
dkarpekinConnect With a Mentor Commented:
You probably should redraw this , to reflect interfaces FE0/0 , FE0/1, T1serial0/0/0, T1serial0/1/0 and so on....
Post as .vsd file - so it can be modifyed  and posted back.
Here is very easy guide, you can try out, to begin with
http://www.cisco.com/en/US/technologies/tk583/tk372/technologies_white_paper0900aecd801af458.html
Also you should see
http://www.cisco.com/en/US/docs/routers/access/cisco_router_and_security_device_manager/25/software/user/guide/DMVPN.html
and choose what out of 4 VPN topologies you need -
http://www.cisco.com/en/US/docs/net_mgmt/ip_solution_center/5.0/mpls_diagnostics/user/guide/ap_vpn.html#wp1015853
0
 
dkarpekinCommented:
Ussially www.cisco.com have all kind of design topology- it is endless, as well sales might help you choose one.
You should post some diagram, with IP addressing, sanitazed, if have to.
0
 
StaffordITAuthor Commented:
Ok, yea I've had a couple of engineers to try and help me, but what they say isn't making any sense. and i'm still stuck. I'll post a diagram, let me work up a diagram and post it...thanks.
0
Improve Your Query Performance Tuning

In this FREE six-day email course, you'll learn from Janis Griffin, Database Performance Evangelist. She'll teach 12 steps that you can use to optimize your queries as much as possible and see measurable results in your work. Get started today!

 
dkarpekinCommented:
If you search cisco.com by keywords- network topology, diagram, and so on, DMVPN schenario, and so on, I'm sure you'll find a lot of very usefull stuff, in your case. It is just not really easy to find the right one.
0
 
StaffordITAuthor Commented:
I understand the layout and how it's supposed to be setup, but I'm just trying to figure out where to place my hub router on my internal network I've got a diagram attached..i thought about placing it behind my PIX and do a static nat translation of the public IP address to the internal IP of the router...if I do this, then my router will have an internal IP address, but where does my other interface on my router plug up to, and what IP do I give that? I can't give my router 2 internal IP's on the same network...I thought about just making a new subnet and utilizing one of the extra interfaces on my PIX and plug up the router to it, and give it a subnet that doesn't exist on our network anywhere, and then the other interface of my router give it an IP address on our VLAN 21 subnet....what do you think? Thanks for your help so far
Design-and-Layout.jpg
0
 
dkarpekinCommented:
It is a bit confusing still - there is no IP/VLAN/purpose discription of MPLS/internet routers , and why is 10.9.0.X- is that  T1's used for home users?
Is the purpose here have "remote users" be able connect to datacenter either over internet or from home as well? And
Personally I would never use 192.168.0.0 on producion, it is ment to use for really small networks (home), and can create problem.
If "Data Center router" is 2800 series, than you can use instead of "DMVPN Hub router", this way it is should simplify config, or have it "DMVPN Hub router" place "before" firewall, if so much security consern.
If not then enable firewall on "DMVPN Hub router" itself will do the job (I assume it is 2800).
Can't give you advise on IP schema - it is not totaly clear, what portions have to be separated and goal, you tring achive.
0
 
StaffordITAuthor Commented:
Sorry for the confusion...I've went through a bunch of people already about this, and after a while of saying it so much you dont realize you leave out details. What we are trying to acheive is a failover model for our branch offices. Network traffic would failover to the DMVPN link to the main office in case the MPLS router/link were to go down. We are just simplly trying to achieve failover to our home network. I've changed the subnets to different subnets (those are not our actual subnets just for security purposes) The data center router is a 2800 series router. If I use it, then since it's in front of the firewall, what kind of traffic do I let through? And If I'm using EIGRP as my routing protocol, wouldn't this traffic have to pass through the firewall as well? Thanks for your help and I hope this better explains our mission. Thanks.
0
 
StaffordITAuthor Commented:
Oh to add, i put the users on the right hand side of the document because we are actually thinking about starting to utilize the home/office thing. I just laid it out on the diagram as a potential future option. This definitely isn't going to be part of phase 1 of this.
0
 
StaffordITAuthor Commented:
Great! Thanks for your help!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.