Accepted Solutions
Hmm, I still haven't managed to work this one out. I created a BDI interface:
cisco.bsmt-rt2#sh run int BDI1
Building configuration...
Current configuration : 98 bytes
!
interface BDI1
ip address 192.168.3.1 255.255.255.0
encapsulation dot1Q 1 second-dot1q 2
end
I want to bridge my switched ports
cisco.bsmt-rt2#sh running int GigabitEthernet0/1/0
Building configuration...
Current configuration : 53 bytes
!
interface GigabitEthernet0/1/0
no cdp enable
end
With my WAN interface:
cisco.bsmt-rt2#sh running int Ethernet0/2/0
Building configuration...
Current configuration : 381 bytes
!
interface Ethernet0/2/0
description Internet Interface
ip dhcp client request classless-static-route
ip address dhcp
no ip redirects
no ip proxy-arp
ip nat outside
ip access-group WAN4_IN in
no negotiation auto
ipv6 address dhcp
ipv6 address pd-ipv6 ::1/64
ipv6 address autoconfig default
ipv6 enable
ipv6 dhcp client pd pd-ipv6
ipv6 traffic-filter WAN6_IN in
end
But I haven't figured out how to add them to the BDI.
Ideally then I could get rid of most of the configuration for Ethernet0/2/0 and this could be done on the first router. The first router does a few things the Cisco router cannot do, for example OpenVPN. While I have a configuration at the moment that uses NAT, the issue is I want to use IPv6 prefix delegation with my ISP on my separate VLANs on the second router, ie for admin, server, guest VLANs.
Sure. I'm trying to bridge the VDSL WAN (Ethernet 0/2/0) port on the Cisco C1117-4P to one of the Ethernet interfaces (Gi0/0/0).
The plan is to then request a DHCP lease on the OPNSense router and get the global IP address, and do the NATing there. This would allow me to do my prefix delegation on the OPNSense box, which I can't if it's not directly connected to the ISP. Also means I don't need to have double-nat.
There are a few reasons for wanting to do this:
- DHCP on each VLAN is already configured on the OPNSense router
- I can actually have a firewall which drops packets as opposed to rejecting, for example when doing a shieldsup test with OPNSense directly connected to the internet all ports are dropped as opposed to "closed" with the ACL method, this is what I see when the Cisco directly connects to the internet.
- One of my VLANs currently routes into an OpenVPN tunnel, using match - something a the Cisco ISR cannot do.
Someone mentioned, so why did I buy an expensive Cisco ISR if I was just going to bridge it, well there are a couple of reasons:
- It was cheap, - yes new these devices are expensive, but I think in Australia there's a lot of businesses which have flogged them off on Ebay because of FTTP/FTTC being in their area (those connections in Australia come with a NTD - Network Termination Device, provided by NBNCo (the national backhaul provider). Seems you can get a good deal from refurbished IT companies.
- The VDSL chipset uses a quality Broadcom controller which matches my Nokia DSLAM and produces a stable sync rate on my long line (700 meters).
- I can have a separate management port for SNMP, SSH etc. When I did bridging on my old TP-Link modem I was finding the MAC address of whatever was on the other end of the DSL link would periodically replace that of my modem meaning that it was not accessible via LAN.
- The C1117-4P supports SNMP, which means I can easily get sync rate, and periodically graph it as I did with my Cisco 877/w ADSL2+
Stats like this over a period of time are very helpful when raising issues with the retail service provider and getting them to escalate issues to the back haul provider who manages the line.
I have looked at other modems such as AVM's FritzBox and TP-Link's other devices. The main issue with them is you cannot create a static route to a specific port or interface for management. The only one I have seen that you can is from Draytek in bridge mode, and it does support SNMP, however they cheap out on the chipset, and preferring MediaTek's EcoNet and Lantiq. Reports I've ready about these is they are less reliable.
