1921 to obtain internet from service provider's router

[Boo]

Need help connecting cisco to ADSL router to obtain Internet connection. Please assume ADSL modem doesn't have any other functionalities than  just simply getting the internet service.

ADSL router contains username and password to connect to ISP via PPoE

1) ADSL router

ADSL WAN IP x.x.x.x/32

ADSL Router's gateway 192.168.1.254

DHCP enabled - 192.168.1.0/24

2) Cisco 1921 - No HWIC's

DHCP enabled - 10.10.10.0/24

No Vlans at present

(Thinking about creating a router on a stick 802.1Q trunking by adding a seperate subnet for voice in the future)

gi0/0 - ip address 192.168.1.250/24 
            ip nat outside

gi0/1 - ip address 10.10.10.254/24

           ip nat inside

gi0/1 - Switch

Switch to end user devices. 

access-list 10 to allow 10.10.10.0/24 & 172.16.0.0/24

ip route 0.0.0.0 0.0.0.0 192.168.1.254 (Next hop being the ISP router)

ip nat inside source list 10 int gi0/0 overload

Does this setup work ?

[Georg Pauwen]

Hello,

you have two options:

1. Put the ADSL router in bridge mode, the interface on the 1921 (GigabitEthernet0/0) will be assigned the public IP address, and you can configure it as the Internet edge device doing the NAT

2. Leave the ADSL router as it is, and add the networks on the 1921 (10.10.10.0/24 and 172.16.0.0/24) to the networks to be translated. This needs to be done in the ADSL router. Simply point the default route on the 1921 to either the next hop address on the ADSL (ip route 0.0.0.0 0.0.0.0 192.168.1.254) or out the connecting interface (ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0).

The second is probably the easier option. If you opt for the first, post the configuration of the 1921, and we can add the necessary bits and pieces...

[Boo]

With reference to option 1, after putting the ADSL router on bridge mode, did you mean that I create a ppp dialer on dialer interface?

Option 2, might not be always feasible because there are some adsl routers out in the world which doesn't support what we need :)
My orginal way of setup worked well

[Georg Pauwen]

Hello,

option 1 indeed includes a dialer interface. As Paul suggested, double NAT works fine, the only thing is, you cannot access any of your devices from the outside. You are fine if that is not a requirement.

As to option 2, what type and brand is your ADSL modem ? I'll check if you can configure it for bridge mode.

[Boo]

With reference to double natting and port forwarding to access devices from outside, I know for the fact that I can setup a port forward on the ISP's Edge ADSL router for port 22 to be forwarded to cisco's gi0/0's ip so that we can ssh into the Cisco from outside.

Please assume that I have a security camera connected to the cisco router and its IP is 10.10.10.100/24 and it uses port 8000.

For me to be able to access the  security camera from outside what If I double port forward? i,e., port forwad tcp 8000 on the ISP router to cisco's IP which is 192.168.1.250 and in the cisco

ip nat inside source  static tcp 10.10.10.100 8000 int gi0/0 8000

Will this setup work ? 

I have got option 2 working as well. I didn't mean about bridge mode when I said that some ADSL modem's might not have that option. A s a matter of fact, most of the ADSL routers can be set to bridge mode, PPPoEthernet or PPPoATM. My statement was pertinent to adding the subnet from cisco into the ADSL router. 

[Georg Pauwen]

Hello,

double NAT and port forwarding (from the 1921 in your case) won't work (at least I have never seen it work). That is why I suggested the bridge mode...

[Boo]

Thats fine. I'll test on Monday.

[paul driver]

Hello

Yes you can static nat to a host on your internal network of the 1921 rtr, it is  possible but will you need to configure not only a static nat entry on that rtr but also on the xDSL rtr.

res
Paul

[paul driver]

Hello

I had some time thought i would lab this up for double nat translation:

Public-router  .4 <10.1.14.0--> .1  ADSL 1. <10.1.12.0--> .2 1921 .2<10.1.23.0->.3 host .101

1) Public router

interface Loopback0
ip address 8.8.8.8 255.0.0.0

2) adsl

ip nat inside source static tcp 10.1.12.2 80 interface FastEthernet0/1 80
Pro Inside global      Inside local       Outside local      Outside global
tcp 10.1.14.1:80       10.1.12.2:80       ---                ---

3)1921
ip nat inside source static tcp 10.1.23.101 80 interface FastEthernet0/0 80
Pro Inside global      Inside local       Outside local      Outside global
tcp 10.1.12.2:80       10.1.23.101:80     ---                ---

4) host
sh ip route
Default gateway is 10.1.23.2

SH IP HTtp Server status | in port
HTTP server port: 80
HTTP secure server port: 443

TEST:

pubilc-router#
telnet 10.1.14.1 80 /source-interface loopback 0
Trying 10.1.14.1, 80 ... Open

ADSL#
sh ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
tcp 10.1.14.1:80       10.1.12.2:80       8.8.8.8:47642      8.8.8.8:47642

1921
#sh ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
tcp 10.1.12.2:80       10.1.23.101:80     8.8.8.8:47642      8.8.8.8:47642

res

Paul

[Boo]

Well done. What is ADSL router's model number?

[paul driver]

Hello

It wasn't on any xDSL router  but the concept of double nat was produced just so you would understand it can work.

res

paul

[paul driver]

Hello

I see no issues with your double natting - simplistic option 

your need to have dhcp somewhere to see in your lan environment for your lan hosts have the 1921 as the hosts default-gateway - lasty have a default route pointing to the SP 

If you need sample config im sure others will be happy to provide it- at present im not in position to do so myself as I'm in transit

res

paul

[Georg Pauwen]

I actually try to avoid double NAT as much as possible, if only because I cannot get to anything from the outside anymore then. If OP doesn't need outside to inside access, I guess it is a viable option...

[Boo]

Double nating worked. Provided 2 way data flow.

[Boo]

Can someone please provide me a sample config?