ISR 4431 and 2960x config question

[mr1drful]

Greetings,

I was assigned to take over a project with little to no knowledge transfer. I have a ISR 4431 and a 2960x  - a layer 2 only device. Neither device have been configured. The 2960x has the ISP is connected to port 52 with GI1/0/1 connected to GI0/0/0 on the ISR 4431. The only other info I got from the departing employee was to use vlan1.

I checked the O'Reilly's Cisco Cookbook with no success. After searching for several hours it is clear that I am not asking the questions, and need some help getting useful information from the Cisco knowledge base and internet in general. Can someone point me in the right direction?

As an FYI, the hard configuration is not my choice.

Many thanks in advance.

[Reza Sharifi]

Hi,

What are you trying to accomplish? Do the users connect to the 2960x switch?

Do the users need access to Internet? Do you have public IPs from the provider or you have your own?

If VoIP, Is the switch POE?

Is this a brand new install or existing?

HTH

[mr1drful]

Sorry for the ambiguity.

• Users connect to internet through the 2960x,
• The ISP also connects with a cat6 gigE to the 2960x via gi1/0/52,
• The router connects to the 2960x as well via gi1/0/1 to gi0/0/0,
• The ISP provides a /29 IPv4 network,
• No VoIP,
• No POE,
• Brand new install.

[Reza Sharifi]

The 2960x is not capable of doing NAT. So, if you need NAT, you would have to connect the router to the ISP and then the switch to the router and users to the switch. Have a look at this link on how to configure NAT.

https://www.networkstraining.com/configuring-nat-on-cisco-routers/

HTH

[Martin L · Accepted solution]

Normally ISP connects to a router then end-users to router or in case you need more ports for more users, L2 switch to router then PCs to switch.  as mentioned above, none of switches can do NAT'ing which is needed for end-users to share 1 public IP among many.  

If your ISP-Switch-router setup is not remote office connecting to HQ via ISP or Internet, my guess is Internet traffic gets to router via switch and that your router still doing NAT for all end-users and router-on-a-stick if needed. If end-user needs to reach other end-user, traffic goes just via switch; but in case end-user needs to reach the Internet, traffic goes to router first , then via your l2 switch to ISP.

I always thought that such setup is only a tricky exam question but it may not be after all. 

Regards, ML
**Please Rate All Helpful Responses **

[mr1drful]

Thank you! Your explanation has given me the mental toe hold necessary to move forward.

[Squozen_EU · Accepted solution]

I've done this before when connecting an HA pair of firewalls to a WAN link. The VLAN you use is not important. All you need to do is ensure that you tag the 2960X ports going to the ISP and the 4431 with the same VLAN ID and the traffic will pass right through as if you had the ISP device connected directly to the 4431. Then you ensure that any LAN traffic uses a different VLAN to the WAN VLAN on the 2960X.

If you don't have a backup 4431 or another device that needs to see the WAN, I'd just connect the ISP directly to the 4431 - it makes things less confusing for the next person that comes along.