Migrating from HPE JG411A to Cisco 8200L router

[juggs]

Hi, As we now have a new Cisco 8200L we are trying to configure the same and need to replace it as a primary router.

Is there any tool for migrating the configuration from HPE to Cisco? If not what steps should we take to prepare a plan for this activity, Scenario: ISP line is directly connected to GE 0/0/0 of HPE router and from GE 0/0/1 LAN is configured and connected to Sophos firewall.

We are fairly new, so please don't bully us.

Thanks in advance.

[Richard Burts]

I am not aware of any tool that would migrate from HPE to 8200L. The steps to take would include understanding the various functions performed by HPE, using configuration guides for 8200L figure how to configure those functions on 8200L, configure those functions on 8200L. I am not clear whether it would be feasible to do some testing prior to cutover, then cutover from HPE to 8200L.

Am I correct in assuming that GE0/0/0 connecting to ISP has a Public IP? Does GE0/0/1 connecting to Sophos have Public or Private IP? And related to that does HPE do address translation or is that done on Sophos? Any other things done on HPE?

[juggs]

Yes  GE0/0/0 have public ip, and I'm not sure GE0/0/1 have public ip or not but seems like public, I checked but I'm not sure if NAT is present there in HPE, how to verify if NAT is present in hpe or not ?

[liviu.gheorghe]

Another question to be asked - how is the ISP link configured?

Is it:

1. a plain IP link? In this case migration of the IP address from the ISP link and configuring a static default route pointing to the ISP should be enough

2. in case your ISP link is a PPP over Ethernet (PPPoE) link, you should obtain the username and password for the PPP authentication from your ISP

Hope this helps.

[juggs]

When I asked ISP provided us with only wan ip mask and gateway with DNS and some usable public ip pools

I checked running config on hpe and it seems so scenario 1 is there with no pppoe.

As I have configured web ui I will try to fill details from that and test it out but I'm afraid of removing wires from the production line directly to test out the cisco router.

[liviu.gheorghe]

If only plain IP routing is configured on HPE, then you should take care to configure:

- same IP address on interface to your ISP

- same ip routes that you have on the HPE

- same NAT that you have on the HPE

Can you share the config of the HPE after redacting the passwords? Maybe we can answer the question regarding the NAT.

Regarding the migration from HPE to Cisco 8200L, as long as you do it in a scheduled maintenance window you should be fine. If it doesn't work switch back the cables in the HPE.

[juggs]

I have attached hpe router running config

And below I got from ISP

Wan ip
Ip 172.24.178.169
Mask 255.255.255.252
Gw 172.24.178.170

DNS 218.248.114.193

Usable Public ip pool
117.239.115.145 to 158

Can you please share with me the running config for cisco 8200L

I will then test out.

[Richard Burts]

I am surprised at how much like Cisco this posted config is. Based on what is posted here these are the things you will need to do on your 8200L

- an outside interface, which has an IP address with /30 mask, specify nat outside. In the config there is an access list applied for this interface. But the acl permits everything. So I question the value of it. An acl like this is to prevent unwanted traffic. Either figure what traffic you do not want to allow in and write an acl for that. Or just don't have the acl on the interface.

- an inside interface which has an IP address with /29 mask which is the pool of addresses specified by the ISP, specify nat inside.

- there is a static default route with the ISP neighbor on the outside interface as the next hop.

- there is configured address translation using an access list to identify which traffic to translate. I must admit that I am surprised by this part of the configuration. The addresses given for the inside interface are already Public IPs. So why are they being translated?

And I am a but puzzled about the relationship of this to the Sophos firewall and the network inside of it.

[liviu.gheorghe]

I was thinking the same thing - how similar the config is to a cisco device. In my opinion, the config posted is not from the HPE device. I think @juggs posted the config from the new 8200 router (how he thinks it should be). In this case we are working with the wrong information.

If I'm wrong in my assumption, I apologise in advance. 

[juggs]

My bad let me come up with the hpe config. 

[juggs]

Please find attached hpe rtr config.

[juggs]

I have shared the hpe rtr config just now, Can you please check if anything is missing or wrongly putted in the cisco config that I have shared previously. Or can I directly do it from the web UI please assist on same. 

[liviu.gheorghe]

From the config of the HPE you provided, there is a thing I'm not clear about - in the GigabitEthernet0/0 interface you have outbound NAT configured

nat outbound address-group 1
nat outbound 2001 address-group 1

but there is no configuration for address-group 1 and ACL 2001.

Another thing is about routing - I see a default route pointing to the ISP, but I do not see a route pointing to your LAN.

Can you explain these two issues?

[Richard Burts]

I agree with LG that there are some strange things in the HPE config. On the interface connecting to ISP is a /30 which provides 2 usable addresses, and this is fairly common when connecting to ISP. The addresses on this interface are Private IPs, which is perhaps surprising but not a problem. On the other interface is a /29 which provides 6 usable addresses. These addresses are Public and appear to be a block of Public addresses provided for the customer to use. What really puzzles me is that the configuration appears to be translating those Public addresses into Private address. 

[juggs · Accepted solution]

Hi Everyone,

I just went off to do the config and kept it simple stupid, I Listened to Eminem's "Guts over Fear" and did the config,

After swapping cables tested the connectivity everything seems perfectly working with zero issues.

Thanks to everyone for engaging with me on this activity.