xstream62
asked on
Cisco: Route Ethernet Hand Off to Router..Assign Public IP to FW and Route outgoing internet traffic to ISP
The image attached displays the questions in detail. I have been assigned a public IP gateway address from service provider so it leaves me to assign the connected interface the next octet. Right? That puts the router online and next is the connection to the firewall. A point to point was established between the two so I can manage the router and use the link to route traffic through. How is there a way to pass INTERNET traffic to the ASA so I can assign a public IP on the firewall? Then to route traffic the necessary traffic to provide internet access to the internal networks?
Thanks
Thanks
ASKER
I have no more available ports on the ASA. Four ports are taken by two port-channels, two ports per port-channel.
The 4451-X router has some weird command variations of layer 2. So I am not sure exactly how to go about creating a trunk connection between router and ASA, if I could make room for a connection on the ASA. Following are two commands relating to layer 2 I found on the switch. Which one would work?
The 4451-X router has some weird command variations of layer 2. So I am not sure exactly how to go about creating a trunk connection between router and ASA, if I could make room for a connection on the ASA. Following are two commands relating to layer 2 I found on the switch. Which one would work?
interface GigabitEthernet0/0/1
service instance 1 ethernet
encapsulation dot1q 14
or a command like this
interface GigabitEthernet0/0/1
no ip address
vlan-id dot1q 14
service instance 1 ethernet
encapsulation dot1q 14
or a command like this
interface GigabitEthernet0/0/1
no ip address
vlan-id dot1q 14
Traditionally, you'd make it an access-layer port on VLAN 14, and either trunk the internal interface to your internal switch or make that one an access-layer VLAN port, too.
interface G0/0/1
switchport mode access
swithport access vlan 14
interface G0/0/1
switchport mode access
swithport access vlan 14
ASKER
The router does not have switchport options
Sorry, it pulled up an IOS command reference when I searched for the 4451-x. Weird.
Looking through the configuration examples, I don't see a way to accomplish this using the 4451-x ISR.
I would check with Cisco TAC, though, in case I'm wrong.
Looking through the configuration examples, I don't see a way to accomplish this using the 4451-x ISR.
I would check with Cisco TAC, though, in case I'm wrong.
ASKER
No other alternative to do this with a layer 3? Or to establish routes some how through the /30 point to point between the router and switch?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Maybe I'm a bit confused but to clarify, The ISP issued /27
I configured the router with the /27 and the /30 assigned based on our available subnets. /27 would never mistakenly be assigned because its our public IP block.
I configured the router with the /27 and the /30 assigned based on our available subnets. /27 would never mistakenly be assigned because its our public IP block.
I was discussing a new /30 using public addresses. Use that for the link between your router and the ISP's. Then they route the /27 to your router.
ASKER
I sent an email to one of the representative. I doubt they will so moving on. They are using line "encapsulation dot1Q 110" on the interface that connects to my router. Not sure if I could take that somehow to continue trunking?
Earlier you mentioned the idea of connecting the ISP directly to firewall. Then when would the router come to play... wouldn't/should it still be needed? Since I do not have enough interfaces on the ASA I created a VLAN on 6500 with the public IP then connected the ISP to an interface in VLAN14. Assigned the firewall a public IP address and added NAT translation (internal, New_Internet). So now I have two public IPs assigned to the firewall. Not sure though how to tell traffic in the DMZ vlan with IP /27 (new ISP public block), route through /27 and not /24 (old ISP public ip block)
Earlier you mentioned the idea of connecting the ISP directly to firewall. Then when would the router come to play... wouldn't/should it still be needed? Since I do not have enough interfaces on the ASA I created a VLAN on 6500 with the public IP then connected the ISP to an interface in VLAN14. Assigned the firewall a public IP address and added NAT translation (internal, New_Internet). So now I have two public IPs assigned to the firewall. Not sure though how to tell traffic in the DMZ vlan with IP /27 (new ISP public block), route through /27 and not /24 (old ISP public ip block)
ASKER
I much appreciated your fast response (up to the point of the last comment I had). lol
Your recommendation for the provider to supply a /30 route the public IP to my router was a success! They made the changes without having to twist an arm. Therefore I am now able to assign the interface on the router connected to the switch a public IP address (rather than public IP assigned to the interface connected to the ISP.)
Please see my other questions --- route issue. It would be great, with your knowledge, to hear your feedback.
Your recommendation for the provider to supply a /30 route the public IP to my router was a success! They made the changes without having to twist an arm. Therefore I am now able to assign the interface on the router connected to the switch a public IP address (rather than public IP assigned to the interface connected to the ISP.)
Please see my other questions --- route issue. It would be great, with your knowledge, to hear your feedback.
ASKER
I much appreciated your fast response (up to the point of the last comment I had). lol
In a similar term, your recommendation for the provider to supply a /30 private route to the public IP to my router was a success!
In a similar term, your recommendation for the provider to supply a /30 private route to the public IP to my router was a success!
Alternately, perform your NAT operations on the edge router. Often this will result in traffic being "double NAT'd". Some folks don't like that, but it will work.
I've implemented it both ways.