s.nasheet wrote:
Hi ,
I have to configure Cisco 3550 switch L3 that will allow 30 offices all within the same big building to share internet. Each office will have around 5-10 Pc's/Servers. Severs'( Email/Web) need to accessiable from internet. Pc's from one office should not be able to talk to the Pc's in other offices. Each office will have there own router/switch ( for NATing ) which will be connected to Cisco 3550 via Ethernet cable.
10MB Internet will be terminiated on Cisco 3350's fastethernet interface and from there it will be distributed to each office. I have more than 30 public IP address available to support this desing.
I was thinking to create 30 VLANS's ( one for each office ) and assign a public IP to each vlan interface but form that point onward, I can't think how to configure of the network ?
Please see the attached diagram to undestand what I am trying to achieve.
All I need is to provide a ethernet socket to each office with internet connection( one public IP is needed to each office) where each office will plug there own router/switch for Internet connectivity and LAN.
Can you think of the easites way to configure this network ?
Many thanks for your advise.
Regards,
The 3550 will not do NAT. If you allocate the public IP for each customer on your 3550 then how will you NAT the customer addresses.
The customer will need the public IP to NAT their internal addressing and their web/e-mail servers. So you will need to create private addressed connections from the 3550 to each customer. Personally i would make each port on the 3550 connecting to a customer a routed port. So as an example lets do customer 1
Allocate one of your public IPs to customer 1 eg. 195.17.17.1
on the 3550
========
int gi0/1
no switchport
ip address 192.168.5.1 255.255.255.252
ip route 0.0.0.0 0.0.0.0 <-- this is for the 3550 to route to the Internet.
ip route 195.17.17.1 255.255.255.255 192.168.5.2 <-- this is for the 3550 to be able to route return traffic to the correct customer
on the customer router
================
interface that connects to 3550
int fa0/1
ip address 192.168.5.2 255.255.255.252
they will then need to use their public IP to NAT internal hosts and for their servers. Note the public IP does not need to be allocated to any interface on the customer router and actually with this setup they can't allocate it to any interface.
Note also that you will need to agree an addressing scheme for all customers so that the network you use to connect their router to the switch does not overlap with their addressing or any of the other customers networks.
Then you can apply standard acls to the routed ports on the 3550 to make sure each customer can only go to the Internet.
If you had enough public addressing to have 2 IPs per customer then you don't really need the above private addressed link between 3550 and customer router but it sounds like you don't.
You are also totally reliant on the customer being able to do NAT because you can't.
Jon
