Trying to get internert through router

[koltl]

I recently purchased a tactical kit which includes a Cisco phone, Cisco 819 router, and an Aruba access point which is between the phone and the router.  The issue I need help with is I need the router to pass through internet to the other Ethernet ports.  As of right now, the WAN gigabitethernet of the Cisco router is connected to my switch (which is behind another router) and has an IP of 192.168.1.48 which I can access using my local network connected to the switch (I can access the GUI through my desktop).  I have my laptop connected to a LAN port of the Cisco router and I am trying to get internet to it through the Cisco router. 

Here is a picture of the GUI

My laptop is connected to FastEthernet0.  Any way to get the internet to that interface.

Also I should point out that I am not big into enterprise networking including Cisco so something like this I am easily confused about but this is the only think I need to get working.

Thank you.

[balaji.bandi]

It bit confusing your explanation here.

do you have small diagram how each other connected so we can help to resolve your issue.

as per my understnading

Internet (ISP) ---cisco 819--switch--your laptop ? is this way you connected. 

why i have asked clarification is --since  you described another router ? "As of right now, the WAN gigabitethernet of the Cisco router is connected to my switch (which is behind another router) " 

[koltl]

It does seem a little confusing from my explanation, sorry for that. Here is a a diagram

So main router -> dumb switch -> Cisco Router - > Laptop

The gigabitethernet0 (wan I think) has an IP of 192.168.1.48 which I can ping and access the GUI throughout the network.  However my laptop connected to a fast ethernet LAN interface does not get a connection to the rest of the local network or the internet - I can't even ping the Cisco router it's connected to.

[balaji.bandi]

Thanks for a high-level picture - You nee some Static route required to work your setup, not sure what is the config in place for now on Sophos Router.

1. IP address you mentioned Sophos inside or outside IP address? (if it outside what is an inside address)

2. post cisco router config " show run "

[paul driver]

Hello
At present the laptop is attached the the lan facing interface of the cisco router so it isn't connected to the same network that runs between the sophos and cisco router that is unless you have the configured the cisco rtr to bridge it wan connection.

If you can administer the sophos rtr and it performs the network translation you can tell the sophos router how to reach the network that connects between the cisco rtr and laptop (a simple static route would do it) and also add this network on the sophos rtr to be natted you should then be able to reach the internet.

Sophos rtr
ip route 172.16.1.0 255.255.255.0 192.168.1.48  < change the 172.16.1.0 to the network that you have running on the laptop

Cisco rtr
ip route 0.0.0.0 0.0.0.0 192.168.1.x

[koltl]

Thank you very much, this information worked.  I am able to connect to the rest of the local network and the internet through my laptop.  Another question to complete this setup, how can I configure it so I can ping my laptop or any other device behind the Cisco router from the general network beyond the Cisco router.

For example, my laptop is given an IP address of 192.168.2.3 from the Cisco router's DHCP.  On my desktop, 192.168.1.45, I am unable to ping my laptop's address.  Is there a way where I can have any client communicate to the network established on the Cisco router.

Thank you

[balaji.bandi]

For example, my laptop is given an IP address of 192.168.2.3 from the Cisco router's DHCP.  On my desktop, 192.168.1.45, I am unable to ping my laptop's address.  Is there a way where I can have any client communicate to the network established on the Cisco router.

BB - Route should have enabled the routing between this subnet  ( by default windows 10 has FW, so disable to testing)

you can verify from the router you able to ping or learn ARP address in the router for this device?

tracert command on windows.  tell you where it stopped in the path.

[koltl]

Here are my configurations on both the Sophos XG and the Cisco router.

This is the static unicast route configured on the Sophos XG

My static routing configuration on the Cisco router.  I have multiple here because I was not quite sure what to do use for the IP so I just made a couple of them.

And this is my DHCP configuration on my Cisco router.

And the tracert.

Would the issue lie within my main (Sophos XG) router you think?

Thank you

Also my IP changed from 192.168.2.3 to 192.168.2.2 to clear up confusion.

Additionally, it seems that my laptop connected to the Cisco router can only ping and access  the main router (192.168.1.1) of the network but not any other devices on that same subnet

EDIT:  It appears that if I have no static routes applied on the Cisco router, I can only ping 192.168.1.1 and nothing else (not even connect to the internet).  If I add a static route of 0.0.0.0 0.0.0.0 192.168.1.0 results in the same thing, I can only access 192.168.1.1 and not other local devices on that same subnet or the internet. If I add the the route of 0.0.0.0 0.0.0.0 192.168.1.1 it results in me connecting to the internet but not access local devices on 192.168.1.x except for the router 192.168.1.1

I am very confused

[paul driver]

Hello

So just to confirm the below is the correct routing 

Sophos rtr
ip route 192.168.2.0 255.255.255.0 192.168.1.48 

Cisco rtr
ip route 0.0.0.0 0.0.0.0 192.168.1.1 < remove any other static routing from this rtr

As for the communication between hosts 192.168.2.0/24 and 192.168.1.0/24  would only work if:
192.168.1.x hosts reside on the outside interface for the cisco rtr
192.168.2.x hosts reside on the inside interface for the cisco rtr

Is this correct?

[koltl]

This is correct.  192.168.1.x hosts are outside of the Cisco router interface while 192.168.2.x hosts are inside Cisco interface.

I just cleared all static IP routes on the Cisco router and entered in the following through CLI ("ip route 0.0.0.0 0.0.0.0 192.168.1.1") which my laptop immediately starting receiving internet (I was able to ping google.com).  Still I cannot ping anything local beyond the Cisco router (192.168.1.x) with the exception of 192.168.1.1 - my Sophos XG - I am able to access only that on the outside local network.

My static route showing within Cisco router's web GUI.

Also, below is a static IPv4 unicast route on my Sophos XG (main router)

So again, I cannot access my laptop from my 192.168.1.x network and I cannot access my local 192.168.1.x network from my laptop with the exception of 192.168.1.1, my Sophox XG.  I should also mention that through my Sophos XG, I can ping 192.168.2.1 (The Cisco router gateway IP on 192.168.2.x subnet) but not my laptop at 192.168.2.2.

I hope this makes sense.

Thank you

[Georg Pauwen]

Hello,

instead of the GUI, can you try to access the command line of the Cisco router, and post the output of 'sh run' ?

Also, what is the exact model/type of your Sophos XG (e.g. 86, 125) ?

[paul driver]

Hello

If both hosts can on either subnet can reach internet it sounds like your routing is fine - The failed ping just maybe because of a firewall restriction not allowing icmp reply’s from either host - Just for testing have you tried disabling any software firewall on those hosts or on the sophos rtr itself.

[koltl]

I attached my Cisco router running-config if that helps.

But you seem to be right, I have looked at my firewall and have seen that the firewall blocks connections to the second subnet.

My trying to access 192.168.1.17 on my laptop (192.168.2.2):

And when I try to access the Cisco router (192.168.2.1) on my desktop (192.168.1.45):

I have posted on Sophos's community forums to figure how a correct firewall rule as I made one that didn't seem to work.

Thank you

[balaji.bandi]

High level i do not see any errors in the config cisco device side.

you need to do 2 steps :

1. Sophos - add static routing back to cisco router for 192.168.2.X subnet

2. Allow NAt for this subnet to go to the internet.

3. Make necessary FW rules to allow ping internal IP addresses.

[koltl]

I already made a static route as screenshotted above. Also as stated, the subnet receives a internet connection.

The only issue is making the firewall rule which I have already made one which doesn't seem to work.

EDIT:

On my desktop (192.168.1.45), I should mention I can ping 192.168.2.1, the gateway IP for the 192.168.2.0 subnet.

However trying to access it through my web browser, it will not load.  It gets denied in my firewall,

On the console of the Cisco router, I have success ping 192.168.1.45

When I try to ping an IP on the 192.168.2.0 subnet that is not assigned to anything, my firewall rule allows it.