About Richard Burts

Richard Burts · ‎01-15-2019

You ask if it matters if you have changed the real ip addresses. I have experienced examples where clumsy efforts to change the addresses have made it much more difficult to understand the problem. I do understand the need to protect your network and that disguising the address may be needed. So I suggest some approaches to changing addresses in posting your problem: - prominently proclaim that addresses have been changed and that addresses in the post are not really the correct addresses. - keep it in the same class of address (class A changes to some other class A, class B to class B, class C to class C). - if the address is a public IP change it to some other public IP. If the address is a private address - then why change it at all. The message that you have included is quite interesting. NEXT_HOP is on same subnet as the bgp peer What can you tell us about the topology of this network, and especially what can you tell us about 172.16.1.1 ? HTH Rick

Richard Burts · ‎01-15-2019

The situation of the original poster is challenging. He wants to protect his network and does not have any firewall or other security device other than his router. I thought about the approach that is suggested in the original post (permit web browsing (HTTP and HTTPS) and permit the vpn traffic (ISAKMP is udp 500 and 4500 and esp which is the ip protocol for ipsec encrypted traffic) and deny every thing else) and quickly realized that this approach is flawed. For example in this approach DNS would not work. I suspect that there are some other services that his network needs which could be impacted by this approach. Then I thought about his follow up which was to deny ping. And I thought that perhaps we could come up with other things that they probably do not want coming into their network from the Internet. Probably they do not want incoming telnet or SSH, or SNMP, or what else? HTH Rick

Richard Burts · ‎01-15-2019

I did not understand correctly the mention early in this discussion about /24 subnet. Thank you for clarifying that the ISP has provided 1 IP address, 1 Gateway address, and 2 DNS addresses. Here is a link about Zone Based Firewall which I hope you will find helpful. https://community.cisco.com/t5/security-documents/ios-zone-based-firewall-step-by-step-basic-configuration/ta-p/3142774 HTH Rick

Richard Burts · ‎01-15-2019

Satheesh I misunderstood what you were saying about /25. Thanks for the clarification. So you will use the new address block similar to what you do with the existing block. HTH Rick

Richard Burts · ‎01-15-2019

There appears to be some confusion about the addressing. In your recent response you tell us that GW is 111.111.111.12 IP is: 111.111.111.14 which is different from what was in your original config which showed .12 as the address and .14 as the gateway. If this recent information is correct it would be easy to change the config to match this. I have something else that you may want to think about. If this router will be connecting your client devices to the Internet there may be some question about providing security for those devices as they access the Internet. One possibility is that the ISP might provide that security. Another possibility is that you might be providing some firewall to protect their traffic as it goes to the Internet. The other possibility is that you might configure access lists (or Zone Based Firewall) on the router to protect the traffic. HTH Rick

Richard Burts · ‎01-15-2019

The behavior you describe of receiving a routing update via EBGP and advertising those received prefixes back to the originator of the advertisement is quite unusual. It suggests that something is hiding or is changing the AS of the advertising router. Without seeing the BGP configuration it is difficult to know what might be doing that. Is it possible to post output of show ip bgp identifying that prefixes involved? HTH Rick

Richard Burts · ‎01-15-2019

I am sure that there are things in the discussion that I do not understand well. But one thing I am clear about. The attempt to use a route map for prepending was applied to redistribution. And it was rejected because you prepend on route maps that are applied to what you advertise to a neighbor and not applied on how you learned the route. I agree with Jon that we need a better understanding of the environment and clarity about what you are trying to achieve. HTH Rick

Richard Burts · ‎01-15-2019

OK. If that is the gateway that we are talking about then the static default route is how you use that GW. Let me ask a question about your ISP and the addresses that they have given you. Did they give you 2 subnets (one to use on your WAN interface which subnet includes the GW address and a second subnet to use for clients inside your network) or did they give you just one subnet (which would be used both for your WAN and for your clients)? HTH Rick

Richard Burts · ‎01-15-2019

Let me try again. The GW provided by your ISP is used in your static default route. Just to be sure is this the GW that you are talking about ip route 0.0.0.0 0.0.0.0 111.1111.111.14 If this is the GW you are talking about then this route is how you use it. Let me try to explain something else. You have mentioned several times wanting to configure DNS and gateway on your WAN interface. But you do not configure DNS or gateway on an interface. On the interface you configure an IP address and a mask. You might configure some DNS that uses the WAN interface but you do not configure that DNS on the interface itself. Similar you might configure a gateway that uses the WAN interface. But you do not configure the gateway on the interface. HTH Rick

Richard Burts · ‎01-15-2019

OK if you do want to use the router as DNS server then leave the command ip dns server in the config and add at least one DNS server for the router to use with ip name-server command. I tried to explain the GW definition for the router but apparently was not clear. So let me try again. You specify the gateway address provided by the ISP in the static default route that you configured ip route 0.0.0.0 0.0.0.0 111.1111.111.14 that gateway address does not go into your DHCP pool configuration. Do I understand correctly that the devices connected in your LAN will all have public IP addresses? If so then you do not need address translation configured on your router. HTH Rick

Richard Burts · ‎01-15-2019

One more thing to point out. This line from the config ip dns server sets up the router to act as a dns server, which clients might use. If the router is being set up to act as dns server itself then it is even more important that the router be configured with a dns server to use. It might look something like ip name-server 8.8.8.8 If you do not intend for clients to use the router as a dns server then remove the ip dns server command from the config. HTH Rick

Richard Burts · ‎01-15-2019

I am not clear what you are really asking when you say how can i assign GW & DNS in WAN Interface Since you have configured a static default route whose next hop is out the WAN interface I would interpret that as assigning GW for the WAN interface. Did you mean something else? I see that you have DNS configured in the DHCP pool (and note that it is different from the DNS that you mention in asking your question). So that DNS would be used by clients who obtain their address using DHCP. It would not be used by the router itself. If you want the router to use DNS you would need to configure a DNS server for the router to use. There is an issue in the DHCP pool in your config. You have this default-router 111.111.111.14 But the DHCP default router should be the router in the subnet used by DHCP. So for your config the default router should be 192.168.2.1. HTH Rick

Richard Burts · ‎01-15-2019

The question in the original post was about failure in login for the web interface but success in login for telnet and ssh. The partial config posted shows that the web interface should authenticate using the locally configured user ID and password. So the users cisco and Admin should be able to login to the web interface. Are you telling us that these IDs do work or do not work for the web interface? We have no information about authentication for telnet and ssh and so can not yet address differences in login success or failure. Can you post more of the config (most especially all of the aaa config and the config of the vty lines - complete config would be nice). HTH Rick

Richard Burts · ‎01-15-2019

Satheesh I agree with BB that if you will be using the new address block for address translation similar to what you are doing with the current address block that you can do the same things with the new address block that you do with the existing address block. I do have a question and perhaps a suggestion. You mention ISP1 and ISP2. Are these 2 connections to the same ISP or are they really separate ISPs? The reason for asking is that in general advertising a /25 to an ISP will not be accepted. When you implement the new address block perhaps it would be better to advertise the first /24 to one ISP and the new /24 to the second ISP. HTH Rick

Richard Burts · ‎01-15-2019

Beeri The answer to your question of whether anything would be redistributed if you configure redistribution for RIP or EIGRP without configuring a seed metric depends on what you are redistributing. If you are redistributing from another dynamic protocol then nothing gets redistributed because your receiving protocol has no way of understanding the associated metric from the sending protocol. But if you were redistributing connected I believe that the connected subnets would be redistributed because your receiving protocol can understand the associated metric. I agree with you that it is better to just always specify a seed metric when you configure redistribution. HTH Rick

Email	rburts@netcraftsmen.com
Date Registered	‎08-08-2003 08:54 AM
Date Last Visited	‎01-09-2019 06:00 AM
Total Messages Posted	21,966
Total Helpful Votes Received	16455

Re: Route announcements by BGP

Re: Recommended Access List On Dialer

Re: Business Case for Cisco Intelligent...

Re: Configuring new Public IP pool in e...

Re: Business Case for Cisco Intelligent...

Re: Route announcements by BGP

Re: Route static and MP-BGP , change th...

Re: Business Case for Cisco Intelligent...

Re: Business Case for Cisco Intelligent...

Re: Business Case for Cisco Intelligent...

Re: Business Case for Cisco Intelligent...

Re: Business Case for Cisco Intelligent...

Re: Can't login web interface but can l...

Re: Configuring new Public IP pool in e...

Re: Route Redistribution Seed Metrics