Configure Multiple Public IP Address on Cisco Switch

[Alberth Ruado]

I have 1900 Cisco Router configured by an ISP on a contract which has 5 public IP. I have 2960 Switch which i want to connect to the router. I'm planning to configure those 5 public IPs on the switch in a scenario wherein i 'll be creating 5 different VLANs each connecting to the internet through each of the 5 public IPs. I would like to be doing this without plugging in additional router to the switch,configuring public IP to it and making it a dhcp server for a private network in a vlan that needs access to the internet - say a web server facing the internet. And also to conserve switch 48 ports for 5 different networks. Is this possible, if so how?

[Milos Megis]

If I understand it correctly, then it is not possible.

You have 5 public IP address, so it means that without NAT you can assign address only to 5 devices.
You plan use these 5 address as gateway to 5 different VLANs.
So you don´t have address for devices on these VLANs.

Switch 2960 doesn´t support NAT function. So it is not possible without device which know to perform nat - router for example.

I don´t know if you want this scenario:
configure pool on main router with 5 public IP addresses and then NAT all private IP addresses to these 5 public addresses dynamically.

But without NAT you can have only 5 devices on your network - including network devices.

[Alberth Ruado]

thanks for the reply Milos, appreciate it. the router is own and provided by the ISP so i dont have access to its configuration, i cannot configure a pool inside, i would have to ask them if they will allow that.

I was thinking of trying to make a vlan interface act like a nat router by assigning each a public ip address and connecting the vlan network of devices to it, but i guess it cannot work then. so my only option would be to just create 5 vlans, connect 1 router to one of the interface of each vlan and then loop back the lan interface of each router to the switch to provide private ip addresses to the remaining interface in each vlans.

[Milos Megis]

Also switch 2960 is L2 only, so it can have only one VLAN interface for management.

If you want to have more VLAN interfaces for inter-VLAN routing you need L3 (MLS) switch.

You needn´t connect each LAN to one interface of router. Router usually doesn´t have a lot of ethernet interfaces.
You can ask your ISP to configure scenario "Router on the stick" where you will have only one link (trunk) to the router for saving number of ports.

[Alberth Ruado]

but can i still create 5 vlans on the L2 switch? the network im thinking is 1 ISP router (1900) > switch (5 vlans)> 5 routers (each has 5 IPS).

and then the lan interface of each router would be connected back to the switch to give private ip address to respective vlans. ill allow trunking of 5 vlans on the interface connected to the router and then ask the isp to create and allow sub interfaces on the router for for 5 vlans right?

[Milos Megis]

yes you can create 5 VLANs on switch.

You solution will work but 5 router for each VLAN is expensive solution if you plan use cisco.

Best solution is ask ISP to configure dot1q trunk to your switch and ensure routing according to your request. You pay him so ISP should perform what you need.

Otherwise if you want to buy router you can do following:
ISP_router -- YOUR_router -- SWITCH
where you can everything configure on your router. NAT, DHCP pools, routing between VLANs, etc.

And regarding count of IP address:
if you have 5 public IP addresses it doesn´t mean that if you use 5 routers then each of them will have 5 addresses.
You still have only 5 public addresses so each router would have only one public IP and other would be private IP

[Alberth Ruado]

so in that case, if i chose to not to add any router, ill have to ask the ISP to reconfigure their router with ip nat pool with range of 5 public address, have them configure the LAN subinterfaces (dot1q) with 5 private IPs as gateway, then i can configure the switch with 5 vlans each exiting through respective subinterface.

[Milos Megis]

exactly

[Alberth Ruado]

sounds like a good place to start. i hope you don't mind correcting me Milos. I'm actually running a simulation on that setup, but i can't seem to get out to the next hop of router <WAN IP> facing the outside network. My router and Switch config are below, provided i have access to the ISP router:

ISP ROUTER

interface GigabitEthernet0/0
no ip address
!
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address <VLAN 2 PRIVATE IP GATEWAY> <NETMASK>
ip nat inside
!
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address <VLAN 3 PRAVATE IP GATEWAY > <NETMASK>
ip nat inside

interface Serial0/1/0
ip address <NEXT HOP IP> <NETMASK>
ip nat outside
clock rate 9600
!
ip nat pool TEST1 <RANGE OF 5 PUBLIC IP> netmask <NETMASK>
ip nat inside source list 10 pool TEST1 overload
!
access-list 10 permit any

WHERE GigabitEthernet0/0 = router interface connected to the switch

SWITCH

interface FastEthernet0/1
switchport trunk allowed vlan 3
switchport mode trunk
!
interface FastEthernet0/2
switchport access vlan 2
switchport mode access
!
interface FastEthernet0/3
switchport access vlan 3
switchport mode access
!
interface Vlan2
ip address <VLAN 2 PRIVATE IP GATEWAY> <NETMASK>
!
interface Vlan3
ip address <VLAN 3 PRIVATE IP GATEWAY> <NETMASK>

WHERE FastEthernet0/1 = interface connected to the Router

anything wrong with config?

[Milos Megis]

You have few mistakes. I will copy your previous post and highlight and comment what is bad.

ISP ROUTER

interface GigabitEthernet0/0
no ip address
!
interface GigabitEthernet0/0.10   !this number 10 is usually same as VLAN tag but it needn´t to be. Just for better overview in config
encapsulation dot1Q 10   ! this number 10 means VLAN tag, so you must use VLAN 10 tag on trunk
ip address <VLAN 2 PRIVATE IP GATEWAY> <NETMASK>   ! it´s OK, just use range for VLAN 10
ip nat inside
!
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address <VLAN 3 PRAVATE IP GATEWAY > <NETMASK>   !as previous interface but this time use VLAN 20
ip nat inside

interface Serial0/1/0
ip address <NEXT HOP IP> <NETMASK>   !you must assign IP address for your interface (ISP should provide this IP address), next_hop address you will use in default route
ip nat outside
clock rate 9600
!
ip nat pool TEST1 <RANGE OF 5 PUBLIC IP> netmask <NETMASK>
ip nat inside source list 10 pool TEST1 overload
!
access-list 10 permit any

WHERE GigabitEthernet0/0 = router interface connected to the switch

SWITCH

interface FastEthernet0/1
switchport trunk allowed vlan 3   !you use VLAN tags 10 and 20 so you need to allow both these VLANs
switchport mode trunk
!
interface FastEthernet0/2
switchport access vlan 2   !assign interface into VLAN 10
switchport mode access
!
interface FastEthernet0/3
switchport access vlan 3   !assign interface into VLAN 20
switchport mode access
!
interface Vlan2   !because you perform routing on router you don´t need interfaces for each VLAN, you just need one interface for management purposes. Also it is only L2 switch so you can have only one VLAN interface
ip address <VLAN 2 PRIVATE IP GATEWAY> <NETMASK>
!
interface Vlan3
ip address <VLAN 3 PRIVATE IP GATEWAY> <NETMASK>

WHERE FastEthernet0/1 = interface connected to the Router

[Alberth Ruado]

Your comment looks more like it. changed some things now, and it's working in simulation !!

My only problem now would be this: the current setup is that each of the 5 public IP addresses is to be assigned to an end device right - like a web server or a wireless router connected to the switch.

With the setup using NAT POOL, wouldn't there be a problem when a webserver is assigned a private IP in a VLAN and not a public IP? What issues could possibly arise with these and if there's any advance configuration to be done on router and/or switch

[Milos Megis]

If you have web server behind NAT with private address and you want to face it to the internet then you must configure static translation with command on router (router which performs NAT):
ip nat inside source static tcp PRIVATE_ADDRESS_OF_SERVER PORT_ON_WHICH_SERVER_LISTEN PUBLIC_ADDRESS PORT

Then you can access server from internet through http(s)://PUBLIC_ADDRESS:PORT

[Alberth Ruado]

Thanks a lot for your replies in here  Milos. Appreciate it a lot. More power to you.

[Milos Megis]

you´re welcome