Need help with setting up network

[briangreig]

Hello,

To start I am experienced in networking and studying for my CCNA, but I am not a pro at all things Cisco when it comes to setting up from scratch.  I live mostly in an environment where things are already up and running.

I am trying to build a small network for a local business, helping out the owner I know.  I have a 1841 router and 3650 switch, both with ios 15.  I have been looking over the manuals for the 1841 and trying to get it setup like so:  Centrylink Modem > 1841 > 3650 > computers.

I currently have the 1841 set to fe0/0 192.168.12.69 for the outside access to the modem, and fe0/10.0.1.254 for the inside network.  I have the ip route set to 0.0.0.0 0.0.0.0 192.168.2.1 <(the ip of the centrylink modem).  I am unable to ping outside the modem, I can ping the modem from the router, but not past it.  I am also not able to ping the modem from my laptop.  I can ping the internal address of the router, but nothing past fe0/1.

I tried setting up my dhcp pool to 10.0.1.0 255.255.255.0 as well, no change.

Next I set the nat for fe0/0 to outside, fe0/1 to inside.

I also set the nat ACL to 100 any.

Been going at this till about midnight now, so Im going to try again in the morning.  I am new to doing this from scratch so any advice would be great.  Been reading manuals and searching the forums and google, but I think my brain is toast and need some direction as well.

Thank You

Brian

[Georg Pauwen]

Hello Brian,

most likely the Centurylink modem is doing the NAT, so you won't have to configure anything NAT related on the 1841.

If 192.168.2.1 is the IP address of the modem, your 1841 Fe0/0 needs an I address from the same range, e.g. 192.168.2.2/24. Try and set the interface connecting the 1841 to the modem to DHCP (ip address dhcp), and check which address is assigned.

[briangreig]

George,

Should I turn off NAT in the modem or just let it do all the NAT work?  Trying to also treat centrylink as a separate entaty that I am hooking up my network to, rather than it being apart of my network.  Want to use the 1841 as a border router and have fe0/0 a different subnet than fe0/1.

This is for a friend who needs tighter security for there office. Other wise I just would have hooked up a different and been much easier.

I will give the settings a try that you have given me, thank you for your help.

[Georg Pauwen]

Brian,

let the Centurylink do that NATting for now and see if you can get everything to work. What do you need to implement with regard to security ?

[briangreig]

Georg,

I will try that.  The office is for medical records and needs to have security for protecting that information from the outside world.  I have a firewall as well that I am going to put between the router and the switch, but wanted to get the router and switch working before introduce more issues with the firewall.  Taking it one step at a time.  I want to make sure that the main routing and switching works then put in the firewall and work out those issues if there are any.

When finished this it what the network will look like, hopefully.

ISP Modem > Router > Firewall > Switch > Network

My biggest hurddle is getting the addressing from the Modem, 192.168.2.1/24, to the internal addressing, 10.0.1.1/24. I also want to enable unicast and set up some ACL list to limit the outside from getting in except for applications that need it. 

Once I get that done I can handle the rest I think.

Thanks,

Brian

[rafael.alves]

I can see two mistakes in your set up.

1 - Router and modem interconnected interfaces are in different subnets. (192.168.2.0/24 ans 192.168.12.0/24).

2 - Probably the modem does not have a route back to the network 10.0.0.0.

If you are trying to NAT from 10 to 192 and back and forward, it's technically right, but it's not a good practice. 

Actually, if the 3650 has a IP-Based software, the 1841 is useless, you can connect the switch directly to the modem.

[briangreig]

Rafael,

I did a typo on the subnets, they are both in the 192.168.2.x subnet.  I typed to fast and added the 1.

What would be a better practice for passing traffic over the two subnets, 192.x.x.x to the 10.x.x.x?  Im up for anything better if nat isnt the best for this.

I am using the 1841 after the modem because I am trying to keep the customers equipment separate from the centrylink equipment.  This is a HIPPA situation in a small business and they are requesting that I put in an edge router between there equipment and the ISP.  Is there a possible better way to accomplish this part as well?

Thanks,

Brian