Solved

SR520 Router Configuration

Posted on 2011-03-23
4
1,390 Views
Last Modified: 2012-08-13
I am a newbie at this.  I need to configure an SR520 to go in front on a UC520 that is already working and routing fine.    I have tried using the CCA but failed at doing anything useful.  
We have 3 global static IP addresses.  184.x.x.131, 184.x.x.132, 184.x.x.133.     We want the .133 for the UC520.   The .132 for the server, and the .131 for the SR520 if needed.

The subnet is 255.255.255.224, gateway 184.x.x.129, DNS 68.105.28.16.

The ISP connected to FastEthernet 4.
The Server (3), .132, will be connected to Fast Ethernet 0.   Will only use port 1190.
The UC520 (2), .133, will be connected to Fast Ethernet 3.   Use SIP Trunking (TCP/UDP port 5060, plus standard lan traffic)

FastEthernet 1 & 2 - should be open for open routing using .131 and standard DHCP on these links with no port or traffic filtering.



                                   (1)                (2)
-----> Internet -----> SR520 ---->  UC520 ---> Phone / Lan
                                    |                (3)
                                    |------>  SERVER (DMZ)


We tried using the CCIE Taskforce in Dallas and they gave up.  They couldn't figure out how to setup a configuration on this box and basically gave up and said we should buy a better unit.   So we don't have any configuration or anything to work from.

Any help would be most appreciated.



0
Comment
Question by:PeggyPitchford
  • 2
  • 2
4 Comments
 
LVL 1

Accepted Solution

by:
rolledoats earned 500 total points
ID: 35213789
Peggy, My understanding is that ISP, Server and UC520 are on same broadcast domain using no-nat to internet. You are using the SR520 to connect with the ISP broadband. Then you have ports 1&2 using NAT with a private address via DHCP.

So for Server and UC520 you need to turn off NAT on the SR520 or ports 0&3. This means that ports 0,3,4 will  have the same IP address of .131.  leaving .132 and .133 to assign to the server and UC520.Now this may not be configurable on the SR520 so your only other option is to use DMZ. However DMZ usually only lets you place 1 IP in DMZ but this would be ok for the UC520. Then use port fowarding  eg http and https to the server.

The App note may also help http://www.cisco.com/en/US/docs/routers/sr500_series/sr520t1/app_notes/sr520t1_uc500_setup/uc500_sr520t1_cca21_setup.pdf

If all this fails then i would agree with the tac and get another router. If it was me I would use a netgear/draytek router which does support No-Nat to ISP - or a cisco router and config the ISP/server/UC520 as a bridge group.

Netgear/Draytek usually come with 4 port switch so you can connect the server, UC520 and SR520. Then config the SR520 for NAt and dhcp
 

so you could try and use port forwarding
0
 
LVL 1

Expert Comment

by:rolledoats
ID: 35213797
Correction - "so you could try and use port forwarding" text not meant to be present  
0
 
LVL 1

Author Comment

by:PeggyPitchford
ID: 35219580

The only way I seem to get this done is by static nat.   Here is excerpt of my configuration using .131 and .132 address.   I haven't even thought about the .133 and moving the UC520 over, but think I can overload the .131 address   But this seems to work, but doesn't address my desire to have the server to have the physical static ip address.  Plus overloading the WAN interface seems wrong.

Thoughts?

===============================/========
SR520W Basic Config / excerpt
========================================
.
.
.
!
ip dhcp excluded-address 192.168.1.1 192.168.1.30
!
ip dhcp pool vlan1pool
   network 192.168.1.0 255.255.255.0
   default-router 192.168.1.1
   dns-server 68.105.28.16 68.105.29.16
!
!
ip cef
!
no ipv6 cef
multilink bundle-name authenticated
!

!        
!
!
! All using VLAN1
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
 ip address xxx.xxx.xxx.xx2 255.255.255.224 secondary
 ip address xxx.xxx.xxx.xx1 255.255.255.224
 ip access-group 110 in
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface Dot11Radio0
 no ip address
 shutdown
 speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
 station-role root
!
interface Vlan1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 FastEthernet4
!
no ip http server
no ip http secure-server
ip nat inside source list 1 interface FastEthernet4 overload
!
! static route to the server
!
ip nat inside source static tcp 192.168.1.2 80 xxx.xxx.xxx.xx2 80 extendable

!
! Wide Open ACL
!
access-list 1 permit any
!
! block telnet configuring rtr from outside
!
access-list 20 permit 192.168.1.0 0.0.0.255
!
! wide open acl.   Will close down once routing correctly.
!
access-list 110 permit ip any any
!
!
!
.
.
.
0
 
LVL 1

Author Closing Comment

by:PeggyPitchford
ID: 35262065
Still did not figure out how to route a static IP address to the server through the router.   However, it can be done by using NAT for 1:1 mapping.   Works great.
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

It happens many times that access list (ACL) have to be applied to outgoing router interface in order to limit some traffic.This article is about how to test ACL from the router which is not very intuitive for everyone. Below scenario shows simple s…
I have seen some questions on problems with SSH/telnet access to Cisco routers that may occur despite the fact that from a PC connected to your LAN, Internet connectivity is in place and users can access Internet sites without any issues.  There are…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now