Configuring interfaces on Cisco 2951 Router

[Vishal.Seetal]

Hi all,

I would really appreciate any help for configuring my Cisco 2951 router. There are three routed interfaces that I need to configure: one for the internal LAN, the second for another private subnet that connects to a Data Centre and the third for the WAN connection.

I have configured the Ge0/0 interface as the LAN interface with the internal network 10.17.0.0/24. I have also configured my WAN interface Ge0/1 for internet connectivity. Now, I need to configure the third interface Ge0/2 that will connect to the Data Centre. This will be a private point to point switched ethernet link. The Data Centre will host a secondary domain controlller. So, I want it to be on the same network as the internal LAN, i.e., 10.17.0.0/24. I want to be able to see all other devices that will be located at the Data Centre just like I would see all devices connected to the internal LAN.

The problem I am facing is that Cisco 2951 does not allow me to configure two routed interfaces to be on the same subnet. Is there any way to work around this problem and configure both the internal LAN and the Data Centre private network to be on the same subnet.

Thank you all. Your help will be really appreciated.

[Leo Laohoo]

The problem I am facing is that Cisco 2951 does not allow me to configure two routed interfaces to be on the same subnet. Is there any way to work around this problem and configure both the internal LAN and the Data Centre private network to be on the same subnet.

You don't need a router.  You need a switch. 

[Vishal.Seetal]

Hi Leo,

Thank you very much for your reply. Won't there be any security concerns using just a switch? I wanted all traffic to go through the firewall.

While my ISP reassured me that the point to point link is secure, I still think that just to be on the safe side, the router will be a safer option than just a switch.

What do you think Leo?

Thanks.

[Leo Laohoo]

Thank you very much for your reply. Won't there be any security concerns using just a switch? I wanted all traffic to go through the firewall.

You mean you want to create a DMZ for your servers?

[Vishal.Seetal]

Thanks for replying Leo.

Well, by firewall I meant the Cisco 2951 router. If I create a DMZ and put my Data Centre devices in it, they will still be on a different subnet, won't they?

I want them to be on the same subnet so that I can see them on Windows. The reason is that the Data Centre will host the secondary Domain Controller and Network Attached Storages which will be configured as shares on the network. So, I need to be able to see them, store and retrieve files from these storage devices.

Can I configure the router so that both the interfaces Ge0/0 and Ge0/2 can be on the same subnet?

Thank you.

[Reza Sharifi]

You can configure both interface and put them in the same subnet, but it is not a recommended configuration.  You should put each interface in its own network.  Bridging the two interface does not make the connection any more secure then the routed connection.

Here is the link to configure the intefaces as bridge:

http://www.cisco.com/en/US/products/hw/switches/ps5304/products_configuration_guide_chapter09186a00800f0a86.html#xtocid3

HTH

[Vishal.Seetal]

Thank you for your reply Reza.

What I thought is that I would put both the interfaces on the same subnet so that devices on the internal LAN could talk to devices located at the Data Centre and vice versa. Moreover, like I said above, I need to be able to see the devices at the Data Centre for accessing network shares that will be configured on the storage devices. These network shares will actually be backup shares that would be used only when the primary network shares on the internal LAN fails. Although, they will be used rarely, they need to be configured as such.

So, after configuring the interfaces to be on the same subnet, I thought I could control network traffic between them using the firewall on the router.

What is the reason you say that configuring two interfaces to be on the same subnet is not recommended?

Thank you.