Cisco 2811 FE0/0 and 0/1 as transparent bridge ports

[stabako64]

Hello all, first post here on the forums.  I was hoping someone more knowledgeable than I might be able to give me some ideas on how to get a setup to work.  We have a block of static IPs through CenturyLink.  We purchased a 2811 and are looking to use with a DSL WIC.  We have been trying to use FE0/0 and FE0/1 to just pass traffic to two other routers that represent their own networks WITHOUT assigning an IP to the interfaces.

We are having problems getting the 2811 to pass traffic to FE0/0 and FE0/1 without assigning the interfaces an IP.  We can't do an IP for each as it will consume IPs in our block that are already assigned.  Basically, see below as to what the end result would look like.

                     WAN

                        |

                        |

2811 DSL WIC (x.x.x.174)

                        |

                   Cisco 2811 Router

         |                                                      |

      FE0/0 (NO IP)                FE0/1 (NO IP)

         |                                                        |

Cisco 800  with static IP        SonicWall With static IP

   x.x.x.172                                                    x.x.x.171

        |                                                                      |

LAN 1                                                              LAN 2

Is this even possible or are we chasing our tails?

[stabako64]

I am also very curious as to why it is not an endorsed setup.  If there are particular reasons why it is not a good idea, I'd definitely like to know why.

[Richard Burts]

I agree with Jon that an Ether switch module in the router will not be a workable solution. If you could put the external (DSL) connection into the Ether switch along with the 800 router and the SonicWall then it might be a good solution. But the external (DSL) needs to plug into a router interface. And the router interface can not communicate with the vlan on the switch without bridging. And if you need bridging on the router then you need IRB. And if you need IRB then the switch module does not buy you much.

The reason why I would generally not endorse IRB solutions is that IRB takes a router and turns it into an Ethernet bridge (note it is bridge and not switch). And in general you want a router to router rather than bridge. This case is a bit different. You want the router mostly as a protocol translator. You need something to take the DSL and make it into Ethernet (and Ethernet into DSL). I would say that this is probably one of the situations which motivated Cisco to come up with IRB.

HTH

Rick

[Jon Marshall]

Just to clarify.

When I said move the NAT to the 2800 I didn't mean just use the existing public IP on the router because then you would get an overlap.

I meant move the public IPs given to the 800 and the Sonicwall to the 2800 as well.

Jon

[Richard Burts]

Note that the original post says that they have tried to implement this without assigning an IP address to the FE interfaces. If a router layer 3 interface does not have an IP address then it will not pass IP traffic. This explains why their attempts have not been successful.

It is not something that I usually would endorse but I believe that the original poster could achieve what they describe by implementing Integrated Routing and Bridging. With IRB all of the interfaces would be in a bridge group, none of the physical interfaces on the router would have IP addresses, and there is a BVI interface on the router which would have the IP address for the router. It would allow all three devices to have IP addresses in that subnet. Whether it would achieve the other things that they need is impossible to know without more information about their network and its requirements. (for example this solution would effectively have the 800 router and the SonicWall talking directly to the WAN device)

HTH

Rick

[stabako64]

Rick,

What you described is basically what we were trying to achieve.  However, I have little experience with bridges and using IRB.  I attempted this but was unsuccessful, probably due to an improper config.  I love learning through trial and error, but since this brings our company WAN connection down each time I need to test it, it makes things difficult (small business, but still).

So would FE0/0, FE0/1 and dialer0 all be part of the BVI, with the WAN IP of .174 assigned to the BVI?

[Jon Marshall]

Rick

The WAN interface is DSL, can you just simply bridge that to the other interfaces ?

Jon

[Richard Burts]

If you try to do this with bridge groups (without IRB) then you need to disable IP routing (no ip routing) which is a point that many people miss when they try to use bridge groups on a router. With IRB then the three interfaces would all be assigned to the bridge group and the BVI would have the IP address.

Jon

Which ever WAN interface gets the IP address should be able to be assigned to the bridge group. Suspect that it would be the dialer interface rather than the physical DSL.

HTH

Rick