Solved: Two Subnets One Interface

kevenpenner · ‎08-21-2011

Hi guys,

I have two public subnets one a /28 and a /29. They come to me on one ethernet cable from the ISP. Currently I have the ethernet cable plugged into a switch and have two 1700's running each network. I have two seperate private networks NAT'ed behind each router.

I want to use a single 1841 router to do the same thing if possible. I have added all the IP addresses to FE0/0 using the secondary command, I added both Private networks the same way to FE0/1 (192.168.0.1, 192.168.1.1 secondary). Nated the interfaces and set permit access list for both private network ranges to be nat'ed.

I am wondering what else I need to do or is it as simple as that? Do I add two IP routes? ie

0.0.0.0 0.0.0.0 Network1.Gateway.IP

0.0.0.0 0.0.0.0 Network2.Gateway.IP

Please let me know if you need more info. And thanks in advance!

K

Edison Ortiz · ‎08-22-2011

kevenpenner wrote:
Hi guys,
I have two public subnets one a /28 and a /29. They come to me on one ethernet cable from the ISP. Currently I have the ethernet cable plugged into a switch and have two 1700's running each network. I have two seperate private networks NAT'ed behind each router.
I want to use a single 1841 router to do the same thing if possible. I have added all the IP addresses to FE0/0 using the secondary command, I added both Private networks the same way to FE0/1 (192.168.0.1, 192.168.1.1 secondary). Nated the interfaces and set permit access list for both private network ranges to be nat'ed.
I am wondering what else I need to do or is it as simple as that? Do I add two IP routes? ie
0.0.0.0 0.0.0.0 Network1.Gateway.IP
0.0.0.0 0.0.0.0 Network2.Gateway.IP
Please let me know if you need more info. And thanks in advance!
K

If the ISP is providing a single handoff and they aren't 802.1q tagged, it means they configured the primary/secondary on their router end. Matching their setup with a single router it is possible. As far as the default route, just point the default to the primary next hop IP address as the packet will go to the same physical router.

If you create Vlans as recommended before, it may not work as you would send tagged traffic to the connected router and this configuration would need to match in both ends.

Consult your ISP and ask them how they are configured.

Regards,

Edison

View solution in original post

RAMACHANDRA R · ‎08-22-2011

Hi

Instead of going secondary ip address for ISP and Local LAN you can have sub interface with diffrent vlan for the same ( provided the switch sholud support VLAN configuration/manegable switch).

You need to have policy routing to send your traffic out on Indivdual ISP based on /28 and /29 subnet to ensure that you or not doing asymmterical routing and ending up loosing both the internet when one ISP goes down.

Rgds

Rama

kevenpenner · ‎08-22-2011

Thanks for the reply. My switch is a managed layer 3 supporting vlans. I dont actually need both the private netoworks; I could combined them into one if that would be easier. Also it's the same ISP so if one subnet goes down they both would anyway.

Is vlan still a better way to go on the outside ip blocks?

ISP block 1

ISP block 2

|

1841 FE0/0

|

1841 FE0/1

|

Nat'ed local LAN

(Have servers using both blocks of IP's)

Edison Ortiz · ‎08-22-2011

kevenpenner wrote:
Hi guys,
I have two public subnets one a /28 and a /29. They come to me on one ethernet cable from the ISP. Currently I have the ethernet cable plugged into a switch and have two 1700's running each network. I have two seperate private networks NAT'ed behind each router.
I want to use a single 1841 router to do the same thing if possible. I have added all the IP addresses to FE0/0 using the secondary command, I added both Private networks the same way to FE0/1 (192.168.0.1, 192.168.1.1 secondary). Nated the interfaces and set permit access list for both private network ranges to be nat'ed.
I am wondering what else I need to do or is it as simple as that? Do I add two IP routes? ie
0.0.0.0 0.0.0.0 Network1.Gateway.IP
0.0.0.0 0.0.0.0 Network2.Gateway.IP
Please let me know if you need more info. And thanks in advance!
K

If the ISP is providing a single handoff and they aren't 802.1q tagged, it means they configured the primary/secondary on their router end. Matching their setup with a single router it is possible. As far as the default route, just point the default to the primary next hop IP address as the packet will go to the same physical router.

If you create Vlans as recommended before, it may not work as you would send tagged traffic to the connected router and this configuration would need to match in both ends.

Consult your ISP and ask them how they are configured.

Regards,

Edison

kevenpenner · ‎08-22-2011

Thanks guys for all your help.

kevenpenner · ‎08-24-2011

So it all worked except for one thing. I cant route between the two public subnets. Is there an easy fix?

ie.

MailServer01 on 192.168.0.1 sends out through 209.143.23.2 --->

209.143.36.4 incomming to MailServer02 192.168.1.1

209.143.23.2

209.143.35.4 secondary

|

1841 FE0/0

|

1841 FE0/1

|

Nat'ed local LAN

192.168.0.254 /24

192.168.1.254 /24

|

Switch with both MailServers plugged in.

kevenpenner · ‎08-24-2011

If I used sub interfaces like Rama suggested would that allow for traffic to leave one private network and arrive on the other?

RAMACHANDRA R · ‎08-25-2011

Hi

We assume that accessing both mail server on local subnet working ie 192.168.0.1 to 192.168.1.1 and vice versa, but you are not able to reach mail servers on their nated public ip address from the server 192.168.0.1 to 209.143.36.4. and 192.168.1.1 to 209.143.23.2 .

are you doing port forwarding on router ? can you post nat config for us to analyze.

Rgds

Rama

kevenpenner · ‎08-25-2011

yes they are nated and port forwarded.

Current configuration : 9866 bytes

!

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

service password-encryption

!

hostname Router

!

boot-start-marker

boot system flash c1841-adventerprisek9-mz.124-25e.bin

boot-end-marker

!

enable password 7 xxxxxxxx

!

no aaa new-model

ip cef

!

ip auth-proxy max-nodata-conns 3

ip admission max-nodata-conns 3

!

username xxxxx privilege 15 password 7 xxxxxxxxxxxx