Connecting branch office via Cradlepoint CBA850 in passthrough mode and Cisco 891 router. Help needed

[Faust]

Hello all!

Recently, our network admin of 23 years left the employment of the business I work for. As a result, I am tasked with connecting an off site location to our network via a 4G/LTE aircard provisioned on our Verizon private network build out. The static IP address assigned to the aircard is 172.17.20.162 255.255.255.252. I am using a Cradlepoint CBA850 in passthrough mode to provide the Cisco 891-k9 V01 router WAN connectivity. When I connect the Cradlepoint CBA850 to a PC I am able to ping devices on our private network without issue. However, when I connect the Cradlepoint CBA850 to the Cisco 891-K9 V01 GigabitEthernet 0 interface I cannot ping any devices on our network. I tried to set a static route out of interface GigabitEthernet 0 but that didn't resolve the issue. Does anyone have any idea of what I'm missing? Any help would be appreciated! 

[Richard Burts]

There are several things that I notice in this description. First is that connecting a PC worked ok. But the router that you are connecting is not simply using the interface as the PC did but is using an encrypted tunnel. So the first question is whether the connection on your side of the network is expecting an encrypted tunnel? And if so are you sure that the parameters for encrypting and for tunneling match on both ends?

Also I question the use of DHCP excluded addresses in the config. I do not see anything in the config about DHCP other than the fact that the router uses DHCP to learn its address. If you are planning to use DHCP for something then show it to us. If you are not going to use DHCP for something then remove the excluded address config.

I am surprised at the configuration of the vlan sub interface on Gig0. Is the Cradlepoint expecting to receive and transmit vlan tagged frames? And the subnet assigned to this sub interface includes the address of the remote peer 172.26.1.1. Is this really how you expect to reach the remote peer?

HTH

Rick

[Faust]

The Cisco 891 router was previously setup to pass traffic over a microwave link in transparent bridge mode. The microwave link at the branch office failed, and instead of repairing the link we would like to use an air card. That being said, if I connect the Cisco 891 router with interface Gig0 to the switch servicing the wireless segment of the network, the tunnel comes up without issue. 

As for the DHCP config, I assume it is a leftover configuration. On the LAN side of the Cisco router both PCs are assigned Static IP addresses.

The Cradlepoint is configured for IP Passthrough (Transparent bridge mode). I do not think that the Cisco router is going to reach the remote peer through the 172.26.1.1 address. Currently, there is no network topology map or documentation of the network layout so I do not know what router the traffic from the Verizon connection connects to our internal network on. If the traffic from the Cradlepoint/Verizon network enters our network from a different subnet/IP address than the 172.26.1.1 address. How should I proceed?

[Richard Burts]

We can only deal with the information that is provided in the post. Your original post indicated that connecting a PC to the Cradlepoint the PC was able to access resources in your private network and did not mention any setup of encrypted tunnels in your network. So I thought that it was reasonable to question the encrypted tunnel. I was puzzled about your statement that the tunnel did come up without issue. Then I realized that you were connecting it into your network and not to the air card. It is quite possible that the vlan sub interface did work when connected to a switch. The question is what happens when it connects to Cradlepoint?

If the encrypted tunnel came up does EIGRP run over the tunnel? Are you seeing an EIGRP neighbor? Are you seeing EIGRP routes learned over the tunnel?

The DHCP excluded address may very well be related to an old configuration. My point is that if they are not used then they should be removed.

We do not know how your network is set up or exactly what the Cradlepoint will do. In general connecting an 891 router to an air card will transmit its data over the Internet to the Internet facing routing of your network. That may be the case in your network or it may not. You need to find out more about how your network is set up before we can do effective troubleshooting of the 891.

HTH

Rick

[Faust]

First off, thank you for taking the time to respond to my plea for help. I reached out to our Verizon Wireless rep to get a better understanding of our private network build out. Once I receive this info I will be able to investigate the rest of our internal network and how the data from Verizon (the air card) will traverse our internal network. Hopefully, this will illuminate any issues I am currently facing.

[Richard Burts]

Thanks for the update. Yes getting a better understanding from your Verizon rep is an excellent start. Once you have that and have become more familiar with your network setup feel free to post back here with additional questions. I sympathize with the difficulty of being put into things that are not your area of expertise. When you have a better understanding of the network we will be glad to try to help you.

HTH

Rick

[Eahwar34]

I think , you can just connect the LAN2 ( POE ) to your network device console . This makes sure the Cradlepoint Internet is passed through the ethernet of network device.