Cisco 891f-k9; Able to act as a PPPoE + Gateway routing 5 Static Ip’s

[fbeye]

I am becoming overwhelmed with the task at hand.

I have vDSL service with 8 Static IP’s (1 Gateway, 1 Netmask 1 DNS (5 usable)). My DSL Router is in bridge mode connecting to my TP-Link. I want to remove that from the equation and use my 891 as the PPPoE Router and use the Gateway as the device/wan IP and assign the 5 static ips to the selected LAN Ports. 

2 IP’s will be going straight to my Linux Box on eth0 and eth1 (leaving on separate LAN Ports), 1 will be going to my TP-Link which will then Subnet 192.168.x.x for Home device use, 1 will be for Network Printer and 1 will be unused. 

Is is what I am wanting able to be done?

[Georg Pauwen]

Hello,

you should be able to accomplish this. Below is the basic setup. Make sure that the Linux boxes and anything else with a public IP addresses uses the static IP of the WAN interface as their default gateway. The default route should point to the other side of the WAN link as the next hop. In the config below, your router serves as DHCP server for your LAN, if you don't need this, you can leave that part out.

ip dhcp excluded-address 192.168.1.1
!
ip dhcp pool LAN
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 8.8.8.8 8.8.4.4
!
interface FastEthernet0
description to Linux1
!
interface FastEthernet1
description to Linux2
!
interface FastEthernet2
description to TPLink
!
interface FastEthernet3
!
interface FastEthernet 4
description WAN Link

ip nat outside
ip address x.x.x.x
!
interface Vlan 1
ip address 192.168.1.1 255.255.255.0
ip nat inside
!
ip nat inside source list 1 interface FastEthernet4 overload
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
ip route 0.0.0.0 0.0.0.0 y.y.y.y

[fbeye]

Thank you so much! This response was so clear and has built confidence in myself of what I can accomplish.

I will try this when I get home and will let ya know. 

[fbeye]

Alright so, I can now ping outside of my Cisco Router but just can’t seem to get success on the LAN side.

I do not want any DHCP as my TP-Link will be handing those IP’s out. I just want my Cisco to hand out Static IP’s. 

It seems my FastEthernet has a 0-0 option range, but my Gigabit has a 0-8 Range (I used 8 as WAN as described and apparently works) so i set up 4-6 as your intended 1-3.

I just get confused with the LAN stuff and the y.y.y.y comment ;) and 192.168.0.0 etc.

I did NOT set up vlan as I assumed it was part of the dhcp you said i didn’t need, or do I?

i have come a lot rather than I thought and truly appreciate your patience.

matt

[Georg Pauwen]

Hello,

can you post the configuration you have so far ?

[fbeye]

Good Morning

So I reset it all to default except PPPoE.

Also, these are my IP's (and where I want them to go) if it helps:

207.108.121.176 - Reserved

207.108.121.177 - TP-Link

207.108.121.178 - Unused

207.108.121.179 - To Linux

207.108.121.180 - To Linux

207.108.121.181 - To Linux

207.108.121.182 - Gateway

207.108.121.183 - Broadcast

And I am still uncertain, do I want to hardcode the LAN ports so that whatever pl;ugs in gets the static of that port, or have all ports "open" and the devices grabe what they are wanting?

I know this was answered but I myself am unsure whats best.

Current configuration : 2214 bytes
!
hostname Router
!
boot-start-marker
boot-end-marker
!
aqm-register-fnf
!
no aaa new-model

!

ip cef
no ipv6 cef
!
multilink bundle-name authenticated
vpdn enable
!
vpdn-group 1
!
license udi pid C891F-K9 sn FGL212791GJ

!

interface BRI0
no ip address
encapsulation hdlc
shutdown
isdn termination multidrop
!
interface FastEthernet0
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0
no ip address
!
interface GigabitEthernet1
no ip address
!
interface GigabitEthernet2
no ip address
!
interface GigabitEthernet3
no ip address
!
interface GigabitEthernet4
description TP-Link
no ip address
!
interface GigabitEthernet5
no ip address
!
interface GigabitEthernet6
no ip address
!
interface GigabitEthernet7
no ip address
!
interface GigabitEthernet8
no ip address
duplex auto
speed auto
pppoe enable
pppoe-client dial-pool-number 1
!
interface Vlan1
no ip address
!
interface Async3
no ip address
encapsulation slip
!
interface Dialer1
ip address negotiated

ip mtu 1492
encapsulation ppp
ip tcp adjust-mss 1452
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname {username}
ppp chap password 0 {password}
ppp pap sent-username {username) password 0 {password}
ppp ipcp route default
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!ip nat inside source list 1 interface Dialer1 overload
ip route 0.0.0.0 0.0.0.0 Dialer1
ip route 207.108.121.182 255.255.255.255 Dialer1
!
dialer-list 1 protocol ip permit
no cdp run
!
access-list 1 permit 207.108.121.0 0.0.0.183
!
control-plane
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default

line con 0
no modem enable
line aux 0
line 3
modem InOut
speed 115200
flowcontrol hardware
line vty 0 4
login
transport input all
!
scheduler allocate 20000 1000
!
end

[Georg Pauwen · Accepted solution]

Hello,

your configuration is just missing a few things. Vlan 1 needs to have an IP address, and this IP address needs to be the default gateway for your LAN clients (those with 192.168.x.x. addresses). 

Your clients need to have the IP address of the Dialer interface as their default gateway.

I have marked the important parts in bold:

Current configuration : 2214 bytes
!
hostname Router
!
boot-start-marker
boot-end-marker
!
aqm-register-fnf
!
no aaa new-model
!
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
vpdn enable
!
vpdn-group 1
!
license udi pid C891F-K9 sn FGL212791GJ
!
interface BRI0
no ip address
encapsulation hdlc
shutdown
isdn termination multidrop
!
interface FastEthernet0
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0
no ip address
!
interface GigabitEthernet1
no ip address
!
interface GigabitEthernet2
no ip address
!
interface GigabitEthernet3
no ip address
!
interface GigabitEthernet4
description TP-Link
no ip address
!
interface GigabitEthernet5
no ip address
!
interface GigabitEthernet6
no ip address
!
interface GigabitEthernet7
no ip address
!
interface GigabitEthernet8
no ip address
duplex auto
speed auto
pppoe enable
pppoe-client dial-pool-number 1
!
interface Vlan1
--> this needs to be the default gateway for your LAN clients
ip address 192.168.x.x y.y.y.y
ip nat inside
!
interface Async3
no ip address
encapsulation slip
!
interface Dialer1

ip address 207.108.121.182 x.x.x.x
ip mtu 1460
encapsulation ppp
ip tcp adjust-mss 1420
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname {username}
ppp chap password 0 {password}
ppp pap sent-username {username) password 0 {password}
ppp ipcp route default
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!

ip nat inside source list 1 interface Dialer1 overload
ip route 0.0.0.0 0.0.0.0 Dialer1
!
dialer-list 1 protocol ip permit
no cdp run
!
access-list 1 permit 192.168.x.x  
--> this needs to match the network assigned to Vlan 1
!
control-plane
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
line con 0
no modem enable
line aux 0
line 3
modem InOut
speed 115200
flowcontrol hardware
line vty 0 4
login
transport input all
!
scheduler allocate 20000 1000
!
end

[fbeye]

So when we talk about DHCP/LAN (192.168.x.x) is this aside from the 207.108.x.x Addresses I am going to use? I ask because none of my devices are going to be set in a 192.168.x or 10.0.x.x fashion...
or is this how it is set regardless and when I set each [machine] with a Static it will use the Gateway (207.108.121.182) and grab it?
I understand the concepts of DHCP and STATIC but always got confused when they crossover.
Also I know it’s annoying when there is “google” but I do hope you know I truly tried the best I could before asking about this and getting “carried” as they say.

Ignorant question; <example> does ‘interface Dialer1 IP address 207.108.121.182 x.x.x.x’ literally mean I type x.x.x.x? I know that when there is a 0.0.0.0 0.0.0.0 it’s like a scope between the 2 but am unsure what the 2nd ip is... 255.255.255.255?
And..... what does y.y.y.y refer to? 255.255.255.255, again?

Sorry, when I get confused it like a mess of anxiety and chaos in my head.
Spending all morning reading the manual...

[Georg Pauwen]

Hello,

the Dialer1 ip address 207.108.121.182 needs a subnet mask, it is probably something like 255.255.255.248.

If you are not using any private IP addresses (192.168.x.x or 10.x.x.x) addresses, you do not even need the NAT. Either way, try the configuration I posted, and make sure your client machines with 207.x.x.x IP addresses use 207.108.121.182 as their default gateway...

[fbeye]

Hello

Just got home and started off making the changes you recommended, until I got to the Vlan part.

I went into “interface vlan 1” and typed “ip address 207.108.121.182 255.255.255.248” and it shot back

”207.108.121.176 overlaps with Dialer1”

Now, no where have I set the IP 207.108.121.176 but in the block assigned, x.x.x.176 states that it is Unused  by my ISP in their Static IP Spreadsheet that I have.

 What’s weird (to me) is that Dialer 1 is acting as PPPoE [auth only?] and is specified to grab IP 207.108.121.182 and it clearly does as ‘show Ip interface brief’ clearly states to me. 

Here is is my question.... Should I not use the “Broadcast” IP as the IP assigned to Dialer 1 or even GigabitEthernet 8 [my routers Wan] or am I thinking too much?

[Georg Pauwen]

Hello,

the broadcast IP is in general not one you can use, the same as the subnet address. In your case, you have (I think) been assigned network 207.108.121.176/29. So the below applies;

207.108.121.176 --> subnet address (not usable)

207.108.121.177 - 207.108.121.182 --> host range (usable)

207.108.121.183 --> broadcast address (not usable)

[fbeye]

Good Morning

That is correct, .176 specifically (in spreadsheet) says “Reserved” , .182 is the Gateway (also the IP of the WAN device and is usually in that respect, .183 is broadcast (still not sure what even does) and as you says .177-182 are indeed usable.

Just sort of interested how “negotiated” and setting a static ip (.182) give me two different results.... Negotiated allows me to set up each device it’s own static (via Gateway) and I can surf. Setting the WAN staticly allows me to ping from WAN to the Internet but not assign any internal IP’s to my devices. Clearly something I am missing in that regard but as I said with negotiated everything is working spot on. All my devices are working with their independent IP’s.

All the help I have received here has been a blessing. Thank you.

[fbeye · Accepted solution]

Got it working.... I was messing around and changed the IP to Negotiated for Dialer 1 and then it worked.

[fbeye]

I never know if it’s appropriate to reopen an existing [closed] thread or start a new one, but it really does regard the topic at hand.

here is my dilemma. Everything works fine.... The Cisco functions fine and any device plugged it will be whatever IP I want it to be if I manually input it on the device. What I am concerned about is security. By default, do I even have any enabled? Do I enable as a whole on the Router? Do I specify which IP’s get what security? If so, would I need to associate the specific LAN ports with the specific IP? Currently the only IP configured in the router is itself, which acts as the Gateway. The Cisco has no idea it’s even hosting Static IP’s.

[Georg Pauwen]

Hello,

if your current configuration is still the same as the last one you posted, no, there is no security employed. You might want to look into Zone Based Firewall, but what exactly you need depends on your requirements.