topic Re: Two subnets from ISP one gateway in Routing and SD-WAN

Two subnets from ISP one gateway

mattmayer — Mon, 18 Dec 2023 15:01:08 GMT

I just received a set of public IPs from my ISP. I configured everything internally and can see the IPs internally etc. However I can not get out to the internet using those IPs. I reached out to my ISP about it since I saw a lot of times this is handled on the ISP side of the house but they said I would need to configure it on my side. Basically I'm trying to use the old gateway with the new subnet. I know it's possible just not sure how.

I have an ASR-1001-x with the ISP on port Gi0/0/0, the original subnet is on Gi0/0/1 and the new subnet on Gi0/0/4. The person I spoke with at the ISP said to look into setting up two gateways on the ASR. Any help would be appreciated.

Thanks,

Matt

Re: Two subnets from ISP one gateway

M02@rt37 — Mon, 18 Dec 2023 15:09:55 GMT

Hello @mattmayer

what do you mean by "I configured everything internally and can see the IPs internally" ?

Do you perform NAT on taht ASR 1001-x ? What about routing table ? ou have default-route towards ISP ?

Re: Two subnets from ISP one gateway

MHM Cisco World — Mon, 18 Dec 2023 15:10:33 GMT

Old GW with new subnet

This not work'

The ISP will use new subnet with new GW' they add it to routing table point to your new GW.

MHM

Re: Two subnets from ISP one gateway

mattmayer — Mon, 18 Dec 2023 15:30:20 GMT

No NAT on the ASR. Routing table shows the old route with the default route going to the ISP. It also shows the new IPs directly connected. However if I'm on that new subnet I can reach my old subnet and vice versa but unable to get out to the internet.

Re: Two subnets from ISP one gateway

M02@rt37 — Mon, 18 Dec 2023 15:48:08 GMT

@mattmayer

A traceroute from that 1001-X with IP source one of the new IP public, next-hop is your ISP ?

Re: Two subnets from ISP one gateway

Richard Burts — Mon, 18 Dec 2023 16:19:01 GMT

Matt

If we knew more about your environment we might be able to give better advice. As a start can you tell us more about the public IPs that you received? You mention using old gateway with new subnet. Can you provide details about these?

Is something in your network doing Network Address Translation? In some networks that might be done on the edge router, or done on the firewall, or done somewhere else. What can you tell us about nat in your environment?

What is the addressing on G0/0/0 connecting to the ISP?? What is the subnet on G0/0/1? and what is on G0/0/4?

Re: Two subnets from ISP one gateway

mattmayer — Mon, 18 Dec 2023 18:08:13 GMT

Hi Richard,

I'll attach a pic to hopefully clear things up a little bit more. IPs have been changed to protect the innocent. As for NAT translation that is done by an ASA firewall that sits off the first subnet.

Re: Two subnets from ISP one gateway

mattmayer — Mon, 18 Dec 2023 18:10:16 GMT

This is the weird part... when I go from the new subnet to say 8.8.8.8 it dies from the start, but when I send a trace route to an IP on the old subnet it hops to the ASR and continues on just fine.

Re: Two subnets from ISP one gateway

Richard Burts — Mon, 18 Dec 2023 22:48:19 GMT

Matt

Thanks for the diagram, which is helpful. Am I correct in understanding that the mask for the G0/0/0 is /30. If not what is it?

Also am I correct in understanding that originally the ISP gave you 2 Public address blocks (a /30 as a transit subnet and a /29 for use by devices in your internal network)? And correct in understanding that the same ISP has now given you a second /29 of Public IPs? If not what is correct?

Also, do you have devices connected in subnet B using the new IP addresses? If so does their default gateway point to the address of G0/0/4?

Also are there any security policies, acls, etc on G0/0/0 checking traffic coming in from the Internet?

Re: Two subnets from ISP one gateway

paul driver — Mon, 18 Dec 2023 23:23:49 GMT

Hello
on gig0/0 give it an secondary ip address off the new subnet.

Int gig0/0
ip addres 54.16.x.x 255.255.255.248 secondary

Re: Two subnets from ISP one gateway

mattmayer — Tue, 19 Dec 2023 13:39:12 GMT

Richard,

Correct, the mask for Gi0/0/0 is a /30 and correct the /30 for transit and the /29 for my devices. And also correct I have a new /29 from the ISP.

I do have a device on the new subnet and the default gateway is the IP from gi0/0/4. I can route internally from that subnet to the old subnet but not out to the internet.

No security policies in place

Matt

Re: Two subnets from ISP one gateway

mattmayer — Tue, 19 Dec 2023 13:59:56 GMT

Hi Paul,

Thanks for the idea but when I do this I get 54.16.79.48 is assigned to Gi0/0/4.

Matt

Re: Two subnets from ISP one gateway

MHM Cisco World — Tue, 19 Dec 2023 14:06:18 GMT

If what you mention to @paul driver correct

And if both IP in same supernet then

The ISP give you additional IP which will add to your old IP' you need to change mask to include both IP's and change pool of nat.

MHM

Re: Two subnets from ISP one gateway

paul driver — Tue, 19 Dec 2023 14:17:57 GMT

Hello
I would say that public subnet needs to be on the wan interface as a secondary and then you can an internal private subnet on gig0/4 interface which will allow you to nat on that private subnet

Example:
int gig0/0
ip nat outside
ip addres 54.16.x.x 255.255.255.248 secondary
int gig0/4
ip nat inside
Ip address 192.168.1.1 255.255.255.0

access-list 10 permit 192.168.1.0 0.0.0.255
ip nat pool NATPOOL1 54.16.x.x 54.16.x.y prefix-length 29
ip nat inside source-list 10 pool NATPOOL

Re: Two subnets from ISP one gateway

Richard Burts — Tue, 19 Dec 2023 17:24:10 GMT

Matt
Thanks for confirming my understanding of the environment. To investigate this please do these steps and let us know the result on the ASR (either console, or telnet/SSH):
- attempt to ping 8.8.8.8 specifying the source as the address on G0/0/1
- attempt to ping 8.8.8.8 specifying the source as the address on G0/0/4
Also would you post the config of G0/0/0?

Re: Two subnets from ISP one gateway

mattmayer — Tue, 19 Dec 2023 17:38:13 GMT

Rick.

Here you go:

ASR-01#ping 8.8.8.8 source x.x.13.17
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
Packet sent with a source address of x.x.13.17
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 3/3/4 ms

ASR-01#ping 8.8.8.8 source x.x.79.50
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
Packet sent with a source address of x.x.79.50
.....
Success rate is 0 percent (0/5)

!
interface GigabitEthernet0/0/0
description ISP1
bandwidth 100000
ip address 74.33.13.26 255.255.255.252
load-interval 30
negotiation auto

Matt

Re: Two subnets from ISP one gateway

Richard Burts — Tue, 19 Dec 2023 17:46:23 GMT

Matt

Thanks for trying what I suggested. As I suspected might be the case it shows that your ISP is not routing for the new block of addresses. Just checking assumptions: the new block of Public IP is from the same ISP as your first block?

Assuming that both address blocks are from the same ISP I suggest that you ask the ISP for help in finding why the new block is not working.

Re: Two subnets from ISP one gateway

MHM Cisco World — Tue, 19 Dec 2023 17:53:10 GMT

That not correct, it not issue of ISP.

This case not clear until now

I check your supernet it different

So you can use as @paul driver mentioned secondary IP under interface connect to ISP after you remove IP from other interface

Which lead us to second point

*****Rourer can not accept same subnet in two interfaces so old subner As I see in two interfaces and the only explain is you use BDI, are you use BDI? *****

MHM

Re: Two subnets from ISP one gateway

Richard Burts — Tue, 19 Dec 2023 18:16:34 GMT

MHM

Are you saying that when ping specifying one source is successful and ping to same destination specifying a different source is not an issue of ISP? What do you think the issue is?

Yes the supernet is different. The new address block can be used only in one place. It could be used as secondary address on an interface that has some other subnet as primary, or it could be primary on its own subnet. But the issue in the earlier post appears to be that he was trying to do both.

Re: Two subnets from ISP one gateway

mattmayer — Tue, 19 Dec 2023 19:05:01 GMT

Hi Rick,

Thanks for the help. Yeah it's from the same ISP. I've reached out to them and they weren't very helpful other then saying to look into a "dual gateway set up or something". Also this would need to be on my side since we're not a managed solution.

Matt