I inherited a rather overly complex setup. They used to have an ASA 5505 that just died to provide POE and phone/internet access to just a security desk that the previous team decided was best to exclude from the main 10.1.x.x network. The problem is that security desk has to be on 192.168.0.x since the elevators, cameras, door access, etc all live on it internally.
Call Manager is on 10.1.6.2 with the ASA they set up a nat first for 192 to the 10 network as it passed to the egress router. The ASA died and I am trying to duplicate all this with just the router and switch left. Internet is working fine now, but I cannot reach the call manager and never in my 20+ years did something like this.
The old config from the asa looked like this:
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address PUBLIC_IP.166 255.255.255.252
!
interface Ethernet0/0
description to router
switchport access vlan 2
!
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 10.0.0.0 255.0.0.0
access-list INBOUND extended permit ip any any
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
access-group INBOUND in interface outside
route outside 0.0.0.0 0.0.0.0 PUBLIC_IP.165 1
This is what is working for internet on the Router alone without the ASA:
interface GigabitEthernet0/0.168
description Security Desk
encapsulation dot1Q 168
ip address 192.168.0.1 255.255.255.0
ip flow ingress
ip flow egress
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/2.423
description Causeway Sec_desk Handoff
encapsulation dot1Q 423
ip address PUBLIC_IP.162 255.255.255.252
ip nat outside
ip virtual-reassembly in
!
ip nat inside source route-map SECURITY_DESK interface GigabitEthernet0/2.423 overload
route-map SECURITY_DESK permit 10
match ip address 168
ip route 192.168.0.0 255.255.255.0 PUBLIC_IP.161
access-list 168 permit ip 192.168.0.0 0.0.0.255 any
Is it possible to give Call Manager a 192.168.0.x secondary address? or do I have to do something else way different?
