Duplicate IP address in two machines

[john-kelsey]

Dear All,

The machines we manufacture have several Programmable logic Controllers (PLC's) and other Ethernet devices. For the ease of software updates and the complexity of changing the IP addresses within the devices we keep the same IP addresses for each machine.

What Cisco product could we use to view these machines from a single computer? And some tips in setting it up.

We are not able to change the port numbers of the programming software we use (Allen-Bradleys RSLogix).

I have been able to route from two IP addresses using an ASA5505 with policy rules, saying one IP address would route thru to machine one and another IP address routes thru to machine two. But I don't know how to do it from one IP address.

Each machine does not need to communicate with another.

I have attached a drawing.

Thanks in advance.

[5220]

Hi,

You need to have two network devices( routers, ASAs and so on). Connect each network device to each PLC, and NAT the address of the PLC to one unigue address. The network devices can communicate to each other, but not on the interfaces that are connected to the PLCs.

From the PC you will connect to the PLCs using the NAT addresses.

You can do this with only one ASA if you configure it in multimode (virtual firewalls on the same device) and assign each PLC to a different virtual firewall within the ASA.

Please rate if this helped.

Regards,

Daniel

[john-kelsey]

Thanks Daniel,

When you say NAT, this is where I get confused.

If the PC wants to communicate with PLC 1 (192.168.100.180) machine 1, how does the ASA know to allow traffic thru to it and not PLC 1 on machine 2?

What sort of NAT do you use?

Regards,

John

[5220]

Hi John,

As I said, you either need to use two devices, or an ASA in multi context mode (creating two virtual firewlls completely independent of each other).

So, on each network device you NAT the IPs of Machine1 and so on with unique IPs, while the other network device, maps the Machine2 IPs with different NAT IPs.

ASA1 virtual firewall behind Machine1

192.168.100.180 - NAT to 192.168.1.180

192.168.100.184 - NAT to 192.168.1.184

192.168.100.173 - NAT to 192.168.1.173

192.168.100.174 - NAT to 192.168.1.174

ASA2 virtual firewall behind Machine2

192.168.100.180 - NAT to 192.168.2.180

192.168.100.184 - NAT to 192.168.2.184

192.168.100.173 - NAT to 192.168.2.173

192.168.100.174 - NAT to 192.168.2.174

The PC will connect to Machine1 and 2 using the NAT addresses:

192.168.1.180

192.168.1.184

192.168.1.173

192.168.1.174

192.168.2.180

192.168.2.184

192.168.2.173

192.168.2.174

The trick is to configure the vitrual firewalls so that each Machine will be associated to a different virtual device.

http://cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00808d2b63.shtml

Also, you can use two small routers for this instead of multimode ASA.

Please rate if this helped.

Regards,

Daniel

[john-kelsey]

Daniel,

Thank you very much.

I shall set this up using my ASA5505 and look forward to getting it working.

Regards

John.

[AHMAD_MAAN]

I have the same environment in our domain will use this and replay back if working good.