871 VPN

[bataviaphil]

Good day all.

I have a simple question and I don't know why it can be done.  I would like to use a 871 as a VPN server along with another router in place. Please look at the attachment for the grand plan.  This is how I see it working but if some one else know a better way of doing it please say so.  I have a total of 5 static IPs so each device can have it's own IP address.  I am looking to access my Mac Server at home while I am out on the road. 

Thank you in advance for all your help.

[ALIAOF_]

Ok so you can put either Air Port Extreme as the first device or Cisco 871.  Not sure why you want two routers, I'm going to assume since you are a MAC user you want to utilize the wireless.  Well you can put Cisco 871 facing the internet.  Setup appropriate ACL's and setup a VPN.  Put Air Port extreme behind the Cisco and use it just as an access point.

[bataviaphil]

I was running into a problem when I was using the 871 with the latest IOS 12-24 I was having poor internt performance with the IOS zone based firewall.  That is the reason behind my thinking of using the 871 as a VPN server only.  I have a internet connection of 25 down and with 871 in the front I was only get 14 down and it was throttling between 8 and 14 down.

[ALIAOF_]

Ok that is fine you can put it behind the Air port extreme, just make sure you open up the ports on the Airport extreme that are required for the VPN and setup a NAT if you want to NAT the Cisco's IP to one of the available IP's.

[bataviaphil]

Great.  Thank you for all yor help.  I know there was a way to use both.  So my design is the right way to do it?  I just need to assign the Vlan on the 871 an IP address that is not in use, if I understand you correctly?  The VPN server in the 871 is far better then the one on the Mac server. 

Thank you again.

[ALIAOF_ · Accepted solution]

Yeah so lets say your LAN is 192.168.1.0/24.  Your Airport is 192.168.1.1.  Your Mac server is 192.168.1.10.  You can give the Cisco 871 192.168.1.2.  Setup a NAT on the Airport to NAT one of the available Public IP address to 192.168.1.2.  Forward appropriate ports to the Cisco router from the Airport and you should be good to go.     

[bataviaphil]

Thank you for all your help.  I will post back and let you know how I did.

[ALIAOF_]

You are welcome that will be great if you can post back your results.  Thank you

[bataviaphil]

Once again thank you for all your help.  It went off without a hitch.