ISP Routed addressing to loopback adapter

[Piotr Kowalczyk]

Hi,

Just wander if somebody could tell me if following solution is possible and if so if this is good practice.

I’ve got from ISP routed public IP addressing and in normal scenario would use router and firewall so:

ISP ---> 83.78.23.0/32 ---> Router 1 ---> 95.67.43.0/29 ---> Router 2 –NAT (firewall) ---> 192.168.20.0/24

Now is it possible to use following solution with only one router? Or maybe there is much better way to use one router in the scenario?

ISP ---> 83.78.23.0/32 --->Router1 Int1 --->95.67.43.0/29 ---> Router1 loopback int –NAT (firewall) ---> Router1 int2 ---> 192.168.20.0/24

I hope this is clear if not please let me know so I will try to explain it better. I just wonder if this solution has any disadvantage and if somebody could give me example configuration.

Thank you

Piotr

[Edison Ortiz]

You can use one router.

Example configuration:

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080094e77.shtml

[Piotr Kowalczyk]

Edison,

Thank you for your reply.

Unfortunately I can’t find configuration for my scenario on the link, only standard NAT examples. If I’m wrong could you tell me which part of the document is related to my question please?

[jaighobahi]

Piotr, I am just going to ask three questions:

1.  How are you going to connect Router1 Int1 to Router1 loopback Int?

2.  How are you going to connect Router1 loopback Int to Router1 Int2?

3.  95.67.43.0/29 --> Router1 loopback int - (NAT firewall) --> Router1 int2 --> 192.168.20.0/24 means the loopback interface is effectively working as a router.  Is this possible?

95.67.43.0/20 --> Router1 loopback int suggests that you do not really need this network address for connecting to other devices.  In that case, just use ISP --> 83.78.23.0/32 --> Router1 int 1 - (NAT firewall) --> 192.168.20.0/24.

[Piotr Kowalczyk]

Hi jaighobahi

Answering for you question:

1. Routing between loopback adapter and int1

2. NAT outside on loopback and inside on int2

3. why not?

I need this as at 95.67.43.0/29 range I have 6 usable IP and on 83.78.23.0/30 only 1.

I would imagine configuration like following but wander if this has disadvantages like e.g. difficulties using advanced firewall, VPN or security problems. Will it work? Does anybody have used this solution?

interface Loopback100

ip address 95.67.43.1 255.255.255.248

ip nat outside

ip virtual-reassembly

!

interface FastEthernet0/0

ip address 83.78.23.1 255.255.255.252

duplex auto

speed auto

!

interface FastEthernet0/1

ip address 192.168.20.254 255.255.255.0

ip nat inside

ip virtual-reassembly

duplex auto

speed auto

!

ip forward-protocol nd

ip route 0.0.0.0 0.0.0.0 83.78.23.2

ip nat pool overld 95.45.252.177 95.45.252.177 prefix-length 29

ip nat inside source list 7 pool overld overload

access-list 7 permit 192.168.20.0 0.0.0.255

[Edison Ortiz]

The IP NAT Outside command needs to be applied in the egress interface (FastEthernet0/0).

You don't need to have the public subnet in the loopback. The loopback can be removed.

It seems your public IP subnet does not match the pool you've created, typo?

If you have servers and want to assign public IPs to them, you can modify your pool subnet by

removing those IPs and assigning them to the servers via static IP NAT assignment.

[paul driver]

Hello Piotr,

I supose you can use the loopback in a nat on the stick scenario, where your router has only one interface for nat inside/outside, then with a route-map and policy routing use the loopback an an inside source address, but in your case you have a valid inside and outside interface to work with and as edision graciously stated there is no need for you to use the loopback in this case.

If you wish to just use the ISP pool, You can deny the isp interface /32 ip from being natted but nat your inside network with the isp /29 ip pool range.

See Below:

interface FastEthernet0/1

ip address 192.168.20.254 255.255.255.0

ip nat inside

interface FastEthernet0/0

ip address 83.78.23.1 255.255.255.252

ip nat outside

ip nat pool overld 95.45.252.177 95.45.252.182 prefix-length 29

ip nat inside source list 7 pool overld overload

access-list 7 deny host 83.78.23.1

access-list 7 permit 192.168.20.0 0.0.0.255

res

Paul

Please don't forget to rate this post if it has been helpful.

[Piotr Kowalczyk]

Hi Edison,

Thank you for your reply.

Unfortunately I’m not sure what I should do. Could you give me maybe some idea where I should assign IP addresses on the router? I’ve got following details from ISP:

*****************************************CE CONFIG****************************************

interface ge1/0

description Interface ge1/0 Circuit IDXXXXXXXXXX

ip address 83.78.23.2 255.255.255.252

duplex auto

speed auto

no shutdown

! Customer Assigned RIPE Allocation = 95.67.43.1/29

ip route 0.0.0.0 0.0.0.0 83.78.23.1

Note:-

If the access circuit is DSL based the following ATM parameters are applicable.

Interface ATM0.835

pvc 8/35

encapsulation aal5snap

*****************************************************************************************

Now I’m not sure how configuration of the router should looks like. I just thought I need two routers, one will route external IP addresses to pool 95.67.43.1/29 and second which will provide NAT. Or use kind of loopback adapter.

[Edison Ortiz · Accepted solution]

Based on the configuration you provided, it will look like this:

interface FastEthernet0/0

ip address 83.78.23.1 255.255.255.252

ip nat outside

duplex auto

speed auto

!

interface FastEthernet0/1

ip address 192.168.20.254 255.255.255.0

ip nat inside

ip virtual-reassembly

duplex auto

speed auto

!

ip forward-protocol nd

ip route 0.0.0.0 0.0.0.0 83.78.23.2

ip nat pool overld 95.67.43.1 95.67.43.6 prefix-length 29

ip nat inside source list 7 pool overld overload

access-list 7 permit 192.168.20.0 0.0.0.255

[paul driver · Accepted solution]

Pitor/edsion

Apologies for posting incorrect config - I was working with the information initially posted for interface fa0/0 - 95.45.252.177/29
also the deny statement in the ACL wouldnt be of any use either as the interface command isnt being used, but the config would still work regardless

witth the correct isp pool range!

res

Paul

Please don't forget to rate this post if it has been helpful.

[Piotr Kowalczyk]

Thank you very much for your help. I haven’t realized I would be able to use IP address on interface from different network than next hoop, I still can’t believe but actually this is working fine as I set up router.

[Edison Ortiz]

The NAT service creates a pool of virtual addresses that are usable by the router without being associated to an interface.

[paul driver]

Edison that a typo,

Meant to say Interface IP

res

Paul

Please don't forget to rate this post if it has been helpful.