New to Cisco enterprise products, could use some advise regarding the Cisco router 1941.

[KanadaGuy]

I have questions as this my first enterprise level cisco router 1941.  I purchased it orginally due to the intigrated security features such as the ability to span ports and run a sniffer as well as some of the other features.  However I realized after buying it that some security features require you to buy a additional security upgrade.  I intend to buy this however at the moment I don't have the extra cash and am relaunching my buisiness shortly.  My questions are as follows;

1)  Can I setup the box and then add the security upgrade later or does it need to be applied when I deploy it orginally?

2)  If I don't purchase the security upgrade does it have any firewall functionality and what features come with it straight out of the box I can't seem to find that information anywhere..? 

3)  Does it have NAT it will be used as a router on my wan side so I want to make sure it doesn't respond to pings or have open ports when I hook it up or do I have to set that up manually and if so is there a resource that explains how to do this easyily and quickly just so I can deploy it and get my networkup up and running?

Thanks for your time and I hope to get some kind of answers to my questions and I am sorry for asking such noob questions.....

[Reza Sharifi]

1)  Can I setup the box and then add the security upgrade later or does it need to be applied when I deploy it orginally?

You can always get the router and than purchase and add security features you want. It is all software.  So you can load a different image that has all the security as long as you have valid service contract.

2)  If I don't purchase the security upgrade does it have any firewall functionality and what features come with it straight out of the box I can't seem to find that information anywhere..? 

Usually out of the box the router comes with basic security feature i.e access-list, NAT, etc..

If you need more advanced security features i.e IPSEC/VPN, SSH, you just need to load the image that has the features.

3)  Does it have NAT it will be used as a router on my wan side so I want to make sure it doesn't respond to pings or have open ports when I hook it up or do I have to set that up manually and if so is there a resource that explains how to do this easyily and quickly just so I can deploy it and get my networkup up and running?

Aceess-list and NAT usually comes with most images.

HTH

[KanadaGuy]

Thanks for your prompt response!

Ok I think I have the k9 version which should include the firewall and nat as you mentioned.

I have another issue I bought a 4 port hewic card for this device and I am not sure how to route the traffic from the wan port I setup as ge0/1.  The 4 ports do not connect to the wan connection...

Could you please shed some light on that?

[Reza Sharifi]

What is the part number for the card?

[KanadaGuy]

Hello again thanks for the prompt response.. I am not sure about the part number but this was the name of it.. Cisco EHWIC-4ESG= Gigabit EHWIC Switch - 4 ports - managed

Is this what you where looking for?

[Pawan Sharma]

Hi,

You can very well ports from 4ESG as WAN ports but there is a small trick to use it with SVI. If you are still struggling with your configuration let know, would ask someone from my team to set it up for you through a Webex session. 

Just post a Cisco Technical Support Request here and would get it done.

HTH.

[KanadaGuy]

Hey thanks again for the response and I might just do that it would be helpful...

I have a few other questions if you don't mind answering please.

First I have 2 avail wan side ip's.  My setup currently consists of the modem to a switch that then goes to two routers one for home one for work to keep them seperated.  What I would like to do if this router is capable of is... Have the modem goto two wan side ports on the router (it has two wan side ports correct?  I can get two wan side ip's correct?) and add another switch card and use one switch card for home and the other work.  If the router has 2 wan ports and has two different mac's for 2 different wan ip's is there a way I can quickly and easyily spoof the mac so I can force my isp to change my ip as I tend to change my ip's on a regular basis with this method...?

Thanks again.

[KanadaGuy]

Also what cert explains how to set the router via cli?