Help needed with ISR - ISP required 2 subnets with 1 WAN interface

[seanwaite]

I have been given 2 subnets from the ISP, one subnet (/30) for the interface connecting to their equipment and another subnet (/28) to NAT our servers. The router is a ISR 4331 with right now just 1x SFP (connecting to ISP) and 1x GE (connecting to switch for internal usage). The ISP intends us to route to the /28 subnet ourselves

I had thought this not to be an issue at first as I would just make a virtual interface and assign that /28 subnet. Our 2nd 1xGE interface is setup for VRRP with another 4331 that is connecting to our primary ISP (different one).  

On our primary 4331 with a different ISP, the configuration is simple:

Internet > 5x.xx.xx.0 /27 (GE 0/0/0) > 10.1.1.1/24 (GE 0/0/1) - VRRP 10.1.1.10 & 10.1.1.15

But on the other 4331 with the backup ISP I have....:

Internet > 72.xx.xx.0 /30 (GE 0/0/0) > 10.1.1.2/24 (GE 0/0/1) - VRRP 10.1.1.10 & 10.1.1.15 - For the primary router I do not have this problem as I just assigned 1 host address to the router, and then NAT the remaining IPs that belong to our allocated IP block. For this other ISP, I need to have 3x subnets with just 2x interfaces as I do not seem to be able to create a VLAN or any virtual type of interface...

[Francesco Molino]

Hi

let's concentrate on your backup router. 

You'll be connected with your ISP using /30 subnet. The /28 they given to you will be routed by them or by you?

Normally it should be routed by them. 

If you're routing it to them, which protocol are you using?

you can't create vortual interface but you can create subinterfaces. 

For that, you can create specific vlan and the physical connection of your isp router and your ISR will be done through your switch.

Thanks

PS: Please don't forget to rate and mark as correct answer if this answered your question 

[seanwaite]

Yes, the /28 they leave it up to me to route from /30 interface to /28. This would not be a problem for me if I had another router to use to assign the /28. But with my very limited experience and knowledge, I am lost on how or where to put this /28 IPs that I can nat to the servers. Now my second problem occurs with figuring out nat. I did as you suggested and created sub interfaces, and assigned IPs to each in their respective subnet. I have tested and can SSH into each IP.

But the nat entry for 62.10.8.182 does not seem to work, as I can not access the test device which is specifically configured at the moment to use this router as default gateway. Would I add 'ip nat outside" on just 0/0/0.1 and leave 0.2 alone? 

interface GigabitEthernet0/0/0.1
encapsulation dot1Q 1 native
ip address 35.55.120.130 255.255.255.248
!
interface GigabitEthernet0/0/0.2
encapsulation dot1Q 2
ip address 62.10.8.177 255.255.255.240
!
interface GigabitEthernet0/0/1
ip address 10.1.1.5 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip nbar protocol-discovery
negotiation auto
vrrp 1 ip 10.1.1.10
vrrp 1 timers advertise 3
vrrp 1 timers learn
vrrp 5 ip 10.1.1.15
vrrp 5 timers advertise 30
vrrp 5 timers learn
vrrp 5 priority 200
!
interface GigabitEthernet0/0/2
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
shutdown
no negotiation auto
no vrrp 100 preempt
!
interface Vlan1
no ip address
shutdown
!
ip nat inside source static 10.1.1.101 62.10.8.180
ip nat inside source static 10.1.1.102 62.10.8.181
ip nat inside source static 10.1.1.105 62.10.8.182
!
ip route 0.0.0.0 0.0.0.0 35.55.120.129

[Francesco Molino]

Ok. How do you plan to route your /28 with your ISP? which protocol?

with that config, you can reach both public IP from internet?

with a design it would be helpful to better understand.

For your nat issue, I don't see ip nat outside on the interface outside.

Do those 2 sub interfaces are connected to your ISP router?

Please share a design and I'll be able to help you.

Thanks

[seanwaite]

I can ssh to both IPs 35.55.120.130 and 62.10.8.177.i.e the 2 sub interface IPs I have assigned

In the bottom of the diagram in grey box is how I would ideally solve this given my knowledge on the subject. But in the real world here, I have just 1 router to work with that includes not 1, but 2 unique subnets that I need to route to the internal 10.1.1.0/24

On router 1, I have 1 subnet to work with. I nat a host address 75.10.10.5 to 10.1.1.5 which in turn is picked up by the firewall and nat'd to the actual server IP. It works.

Right now on GE 0/0/0 (directly connected to the ISP) I have 2 sub interfaces 0.1 and 0.2 with GE 0/0/1 being my 'inside' interface. 

I am wondering if I should change the 'inside' interface to 2x sub interfaces?

As for any routing protocols like BGP, OPSF...that would be beyond me. I have 0 experience with OPSF and BGP. All I know is the ISP gave me the /30 subnet and said that is what I need to assign to my router interface directly connected to their on premise switch, and from there "I need to route to the /28 myself". 

[Francesco Molino · Accepted solution]

Hi

Based on your design and explanation, I don't see you announcing your /28 to your provider and I'm quite confident that your ISP has a route to forward all traffic to your /28 to IP 35.55.120.130.

For a test purpose, can you remove your G20/0/0.2 and create a loopback with the same IP? After that, test if you can still access this IP 62.10.8.177.

On Internet, you can do a traceroute of your /28 subnet and normally it should be routed through your /30. Is it clear?

On your grey box, if you have 2 routers, you don't need to nat a public behind a new public. it's just a matter of routing and everything will work.

Please test the loopback just to ensure that your ISP is already routing /28 to your /30 interconnection subnet. That should be the case. I've never seen any ISP asking to announce yourself small subnets like yours for public use.

Thanks

[seanwaite]

I did as you suggested, and it worked! I simply never knew I could use a loopback interface for this purpose. 

I created a static route on the firewall to use this 2nd router's VRRP IP to a test firewall at another location, and sure enough I got a site to site tunnel established without problem

Thank you supportlan, this was really appreciated!!

[Francesco Molino]

You're very welcome