1

I'm looking for a router / switch that will allow me to share a single external internet connection between two completely separate networks, which want to be totally isolated from each other.

IE one internet connection modem connected to the 800 WAN socket, a switch connected to the LAN port 1 with a bunch of machines on, and another switch connected to LAN port 2 with another bunch of machines on.

I want all machines to be able to see out to the internet (and ideally set up some port forwarding back in), but I don't want the two groups of machines to be able to see each other at all.

There will be a DHCP server running on each group, and I want no leakage between them at all.

I think from what I've read that a Cisco series 800 router should support this using VLANS (internet on vlan 0, machines on vlans 1 and 2, and routes between 1>0 and 2>0)

However, before I go and actually buy one I was wondering if anyone with some real Cisco experience could confirm if this will work in reality.

Specifically considering either an 851 or 871, unless someone can suggest something more effective.

Thanks in advance.

Greg.

Improve this question
3
  • The Cisco 800 series is a great little SOHO home router and we have some for our remote offices where the number of remote users doesn't exceed 2 to 3. It does have limitations with throughput and/or some user decides to torrent/download something substantial. Few questions to you are; how many users expected per subnet/vlans/sites? and do you have remote shares where your users access files by using cifs, nfs, etc via vpn? This file "prod_brochure0900aecd8070826d.pdf" may also provide some figures to assist.
    – user4565
    Apr 19, 2016 at 20:08
  • zone-based firewall, VRF, or ACLs. ACLs are by far the simplest solution, and will be supported by any IOS license level.
    – Ricky
    Apr 19, 2016 at 20:20
  • Thanks for the input everyone, it looks like ACL's are going to be the way to go :-) Cheers
    – Fix
    Apr 20, 2016 at 9:30

2 Answers 2

Reset to default
1

Yes it will work with VLANs with the proper ACL that deny all traffic between VLAN 1 and 2, but I'm not sure that VLANs are supported on the 851 models.

This datasheet for the 851 doesn't list VLAN or 802.1q in the feature list (except in the Wireless part)

This datasheet for the 871 model does explicitly say it supports VLANs but only with the Advanced IP Services Feature Set

So you have to be careful about the licenses that are included with the router you choose.

Improve this answer
2
  • Hi JFL, Thanks for the info. How do I found out what licences are included with a router? Are they lifetime licences once purchased ? Cheers
    – Fix
    Apr 19, 2016 at 13:52
  • 1
    The command "show version" will give you the information about the IOS image loaded or features that are activated. They are lifetime, except for some specific features (for example IDS, intrusion detection systems) that require regular updates to be efficient (similarly to anti-virus products). Such updates require active contract. Also there's no free software update in Cisco world, with the sole exception of demonstrating that you are impacted by a bug in the software, on a currently supported product.
    – JFL
    Apr 19, 2016 at 14:07
0

I think you want to get the IOS license with the zone-based firewall in the router. You can set up different security zones, and prevent communications between the zones. Also, the Internet connection should not use a VLAN, it should be a routed link.

...unless someone can suggest something more effective.

You asked about these specific models, and that is on-topic, but product and/or resource recommendations are off-topic here.

Improve this answer
2
  • Hi Ron, Thanks for the info. I'm not familiar (yet) with Cisco equipment. Are you saying that as well as purchasing the hardware (I was looking for a second hand unit) I will also need to purchase a license from Cisco to go with it? Thanks Greg.
    – Fix
    Apr 19, 2016 at 13:51
  • All Cisco equipment needs a license, and there are different license levels. If you buy a second-hand router, you have the license that came with it, and you can get a different license for what you need, assuming it is still a supported product. You should also look into SmartNet, which will allow you access to newer IOS versions for bug fixes and new features.
    – Ron Maupin ♦
    Apr 19, 2016 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.