[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Cisco DMVPN Hub Router placement on network

Posted on 2008-11-05
9
Medium Priority
?
1,700 Views
Last Modified: 2011-10-19
I have planned out a DMVPN deployment for use as backup links into our main datacenter if our remote branches were to go down. I am just having some trouble trying to place my DMVPN hub router on our corporate network. We have a T-1 feeding into a T-1 router, and behind that is a PIX 515 firewall, which then in turn plugs into our corporate switch. I know the hub router has to have a public IP address, and I thought about placing our hub router behind the firewall, and do a nat translation to the inside IP address, BUT this is a router and I need to different networks on both sides of the router....any help on this design would be appreciated. Thanks.
0
Comment
Question by:StaffordIT
  • 5
  • 4
9 Comments
 
LVL 7

Expert Comment

by:dkarpekin
ID: 22889672
Ussially www.cisco.com have all kind of design topology- it is endless, as well sales might help you choose one.
You should post some diagram, with IP addressing, sanitazed, if have to.
0
 

Author Comment

by:StaffordIT
ID: 22889727
Ok, yea I've had a couple of engineers to try and help me, but what they say isn't making any sense. and i'm still stuck. I'll post a diagram, let me work up a diagram and post it...thanks.
0
 
LVL 7

Expert Comment

by:dkarpekin
ID: 22889808
If you search cisco.com by keywords- network topology, diagram, and so on, DMVPN schenario, and so on, I'm sure you'll find a lot of very usefull stuff, in your case. It is just not really easy to find the right one.
0
New Tabletop Appliances Blow Competitors Away!

WatchGuard’s new T15, T35 and T55 tabletop UTMs provide the highest-performing security inspection in their class, allowing users at small offices, home offices and distributed enterprises to experience blazing-fast Internet speeds without sacrificing enterprise-grade security.

 

Author Comment

by:StaffordIT
ID: 22894834
I understand the layout and how it's supposed to be setup, but I'm just trying to figure out where to place my hub router on my internal network I've got a diagram attached..i thought about placing it behind my PIX and do a static nat translation of the public IP address to the internal IP of the router...if I do this, then my router will have an internal IP address, but where does my other interface on my router plug up to, and what IP do I give that? I can't give my router 2 internal IP's on the same network...I thought about just making a new subnet and utilizing one of the extra interfaces on my PIX and plug up the router to it, and give it a subnet that doesn't exist on our network anywhere, and then the other interface of my router give it an IP address on our VLAN 21 subnet....what do you think? Thanks for your help so far
Design-and-Layout.jpg
0
 
LVL 7

Expert Comment

by:dkarpekin
ID: 22896710
It is a bit confusing still - there is no IP/VLAN/purpose discription of MPLS/internet routers , and why is 10.9.0.X- is that  T1's used for home users?
Is the purpose here have "remote users" be able connect to datacenter either over internet or from home as well? And
Personally I would never use 192.168.0.0 on producion, it is ment to use for really small networks (home), and can create problem.
If "Data Center router" is 2800 series, than you can use instead of "DMVPN Hub router", this way it is should simplify config, or have it "DMVPN Hub router" place "before" firewall, if so much security consern.
If not then enable firewall on "DMVPN Hub router" itself will do the job (I assume it is 2800).
Can't give you advise on IP schema - it is not totaly clear, what portions have to be separated and goal, you tring achive.
0
 

Author Comment

by:StaffordIT
ID: 22896871
Sorry for the confusion...I've went through a bunch of people already about this, and after a while of saying it so much you dont realize you leave out details. What we are trying to acheive is a failover model for our branch offices. Network traffic would failover to the DMVPN link to the main office in case the MPLS router/link were to go down. We are just simplly trying to achieve failover to our home network. I've changed the subnets to different subnets (those are not our actual subnets just for security purposes) The data center router is a 2800 series router. If I use it, then since it's in front of the firewall, what kind of traffic do I let through? And If I'm using EIGRP as my routing protocol, wouldn't this traffic have to pass through the firewall as well? Thanks for your help and I hope this better explains our mission. Thanks.
0
 

Author Comment

by:StaffordIT
ID: 22896920
Oh to add, i put the users on the right hand side of the document because we are actually thinking about starting to utilize the home/office thing. I just laid it out on the diagram as a potential future option. This definitely isn't going to be part of phase 1 of this.
0
 
LVL 7

Accepted Solution

by:
dkarpekin earned 2000 total points
ID: 22897161
You probably should redraw this , to reflect interfaces FE0/0 , FE0/1, T1serial0/0/0, T1serial0/1/0 and so on....
Post as .vsd file - so it can be modifyed  and posted back.
Here is very easy guide, you can try out, to begin with
http://www.cisco.com/en/US/technologies/tk583/tk372/technologies_white_paper0900aecd801af458.html
Also you should see
http://www.cisco.com/en/US/docs/routers/access/cisco_router_and_security_device_manager/25/software/user/guide/DMVPN.html
and choose what out of 4 VPN topologies you need -
http://www.cisco.com/en/US/docs/net_mgmt/ip_solution_center/5.0/mpls_diagnostics/user/guide/ap_vpn.html#wp1015853
0
 

Author Closing Comment

by:StaffordIT
ID: 31513519
Great! Thanks for your help!
0

Featured Post

Upgrade your Question Security!

Add Premium security features to your question to ensure its privacy or anonymity. Learn more about your ability to control Question Security today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Hi there, This article summarizes what you need if you are going to set up your home or small business Network Attached Storage (NAS) to be accessible from the internet. Of course there are configuration differences based on your NAS or router ma…
In the hope of saving someone else's sanity... About a year ago we bought a Cisco 1921 router with two ADSL/VDSL EHWIC cards to load balance local network traffic over the two broadband lines we have, but we couldn't get the routing to work consi…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

834 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question