Using Cisco 887 as a "bridge" Device

[javdakker]

Hi,

Is it possible to use a cisco router, in this case a cisco 887, to bridge an external ip address to a device behind the router?

I need this because i only get 1 IP Address from my ISP and i want this IP address on my ASA.

I was thinking of a bridge group, but i'm not sure how to go about it!

I would like to know if this is possible, and if this is, how should i configure it.

                                                    ISP

                                                      |

                                              Router (ATM)

                                                      |

                                       ASA (external ip(NAT))

                                                      |

                                             Local Network

[John Blakley · Accepted solution]

I'm not sure if this will work, but give this a shot and let me know:

bridge irb

On your ATM interface, put "bridge-group 1"

On lan interface: bridge-group 1

create a bvi interface with no ip address: "int bvi1"

And the final touches: "bridge 1 protocol ieee"

HTH,
John

*** Please rate all useful posts ***

[javdakker]

Hi John!

Why would i need to create a BVI? And on a lan interface i can not issue bridge-group one, this has to be stated on the VLAN. So this would be more like:

interface ATM0.1

no ip address

no atm ilmi-keepalive

bridge-group 11

pvc 0/33

encapsulation aal5snap

!

interface FastEthernet0
switchport access vlan 11
no ip address
!

interface Vlan11
no ip address
bridge-group 11
!

bridge 11 protocol ieee

!

And then i would need to do the authentication on the ASA i presume?

I need to test this, not on location right now! Thanks for your input!

[John Blakley]

My test didn't use a vlan interface. What you have above should work. If it's a pppoe account, your authentication would need to be done on the ASA, but you should get the public address to it like you're wanting.

HTH,

John

[javdakker]

Well its a dsl atm connection that means its a pppoa connection. I want to test this configuration with my pc connecting to the interface of the router.

On my pc i can make a pppoe network and use the credentials of the ISP. Would this work or wouldnt it?? As its technically not an pppoe connection...

[paolo bevilacqua · Accepted solution]

Yes, it will work.

[starbuck]

I know this is an old post, but I'm trying to the exact same thing using a rural ADSL2 connection here in New Zealand with my Cisco Meraki equipment which only handles PPPOE authentication.  I have an old Cisco 897 and I think I understand your configuration, but I'm a little unsure how to configure the encapsulation correctly because NZ Telcos use 0/100 and VC MUX and not SNAP.

In this situation, how would I alter your config for aal5mux? Would I do something like this?

encapsulation aal5mux bridge ieee8023

-or-

encapsulation aal5mux pppoe group global

Or do I need to somehow link it to bridge-group 11 (as show in this config example from the OP)?

[javdakker]

This has been solved, thanks alo for the input!