Routing and Default Route / Cisco 2821

Posted on 2009-02-18
Last Modified: 2012-05-06
Hello experts.

I am hoping this is an easy question to write out, so if I am unclear on the scenario please let me know what other information I can provide to help with a solution.

I am working with a Cisco 2821 which I want to enable one of the Gig ports to allow an external routable IP to utilize. We currently have a firewall solution which the default route of the 2821 points to. We can currently use routable IPs on the firewall device, and we also have everything on the LAN side connecting to the firewall device (FD).

Currently, the 2821 uses both Gig ports to route seperate internal subnets to the FD, but I want to convert one to actually use a routable IP address. There is a 2 x T multilink and a 3 x T multilink (MPLS) ppp terminating to this 2821.

Given this setup, I have tried to assign a routable IP to the G0/1 port but I am unable to see it from the outside. I believe this is because the routable IP is using the default route of the FD instead of the next hop which would be the ISP's and not the internal hop of the FD. I can assign this same routable IP to the FD's interface and it works perfectly.

Can someone help me understand what I need to so with the route table and ACL's to allow what I need to happen? Thanks a bunch!
Question by:swcrook
    LVL 5

    Expert Comment

    assuming, you mean public (nonprivate) IP addresses, by writing "routable IPs" and you're using RFC1918 (private addresses) internal. then you have to setup NAT from external to internal site on your router. every private address has to be translated while going through this device.
    to enable transport from outside to a private inside address you need static translation for addresses an sometimes also for ports.

    Author Comment

    Hello Heiko, and thanks for the info. Yes, I am aware that I would require natting except for the moment I just want to be able to ping the address I have setup on this port (public). Here is somewhat of a visual on the setup:
    Cisco 2821:
    Incoming  ---> MPLS Network, 3 T1's.
    Incoming ---> 2 Multilink PPP T1's
    Default Route = ---> only route on this 2821 = Firewall Device
    Firewall Device:
    Internal Network --->
    External Network ---> 68.x.x.x Default Route
    Numberous natting, routing and firewall policies. This device can also have routable 68.x.x.x IPs going to it, and this works.
    I want to use a routable 68.x.x.x address on the 2821 and NOT on the Firewall Device. This 68.x.x.x /29 block is different from the /29 block on the firewall device. The 2821 will route all traffic to the address, correct? However, I think this is the problem because the device has a default route of 68.x.x.x. /29 for the first block.

    So, do I need to add a route to the 2821 to allow traffic to go to the second 68.x.x.x /29's external gateway instead of first going to the hop? If not, would I need to simply add a route to the with the second block's default gateway?

    LVL 5

    Accepted Solution

    your firewall-device is configured for NAT. thats why you can use private addresses behind this.
    to use 68.xx adresses behind FD you have two possible solutions.

    1. you add a static route for your 68.xx-/29 subnet to your device pointing to your 2821 (10.10.10.x-interface). on 2821 you setup then static translations for each address you want to use.

    2. you define static NAT for each device (address) of second 68.xx/29 block you want to use on FD to a different ip of 10.10.10.x subnet. for all addresses who should be handled by 2821 you add secondary addresse on 2821. for example: if you translate to you have to add as secondary address on 2821.

    everything else is normal routing proc

    Author Comment

    On the first scenario, you say " then static translations for each address you want to use" On the 2821, when I add a static NAT translation rule for the "from interface" to the "to interface" going outside to in how does the 2821 determine to translate on the proper interface?  Do I need to add ip ant inside and outside commands to the interfaces and when I do that, will it affect the other MPLS interfaces at all? I assume no?
    On the second scenario, I think this will work best for me, but is it only possible to have a secondary address or can I have a third, fourth, etc., on  one interface? I believe I understand what this scenario will achieve but can I have more than 2 addresses?
    Thanks for the help!


    Author Comment

    Scenario 1 (S1):
    Right now, the 2821 has two Gig ports. The G0/0 already has and the other will have an external IP pf /29?

    Scenario 2 (S2): If I have a free G0/1 port wouldn't it be better to use this port for the NAT translated IP that will be on the subnet or do I still need to add the secondary address to the G0/0 port?
    LVL 5

    Expert Comment

    Hi swcrook,

    for scenario 1)
    on 2821 routers you have interface commands to specify inside and outside interfaces.
    if you want to translate packets while going through int g0/0 then you have to specify

    interface g0/0
     ip nat outside

    interface g0/1
     ip nat inside

    if you have multiple outside interfaces specify there also "ip nat outside" and you will see translations on both interfaces.
    then setup static translations like

    ip nat inside source static ip 68.x.y.z

    you only have to define how to translate from inside to outside. the IOS will automaticaly translate also from outside to inside.

    for scenario 2)
    on this case you dont have to change 2821 all translations are made by FD. so you dont need additional interfaces or other on 2821.

    Author Comment

    Ok, I think I have this working partly except I am running into a snag. On the 2821, the interface Loopback0 is set to an address on the second /29 block. So, when I try to assign the G0/1 interface as the gateway .105 (.104 is access provider's gateway), the router responds that Loopback0 overlaps with .104.

    If I change the blocks to flip-flop, meaning the Loopback0 is set to an IP in the first block and the interface on G0/0 is now 68.x.x.105, it I know the block is functioning. The thing is, I need a loopback obviously, but I am unsure how to solve this delimma. Any ideas? Do I have to have the loopback set to an external IP in one of the blocks?

    I sure am getting an education :)
    Thanks for the help.

    Author Comment

    Ignore my last email. I have the loopback issue resolved.  I will update this ticket as I am able to verify that everything is working. Thanks!

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Maximize Your Threat Intelligence Reporting

    Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

    The Cisco RV042 router is a popular small network interfacing device that is often used as an internet gateway. Network administrators need to get at the management interface to make settings, change passwords, etc. This access is generally done usi…
    I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    20 Experts available now in Live!

    Get 1:1 Help Now