Unique Cisco problem/situation to solve...

Question

At work we have 5 engineers that all have the same test bench setup in their area. Each test bench has 10 modules, each of which have an ip address "burned/assigned in firmware by the manufacture. Each model of module all have the same IP and can not be changed. So only one engineer at a time can have their test bench connected to the network at a time or else they all interfere/control each others test bench. There is one Ethernet jack (from company network) in each area for their laptop (the laptop gets an IP via DHCP). The laptop needs to connect to the test bench and the rest of the company network for internet, servers, printers, email, etc. The test bench only needs to have communication to the laptop. Currently they unplug the laptop from the company network and plug it into a switch on the test bench but have to go back and forth when they need to access documentation and internet. They have tired adding a USB NIC to the laptop and the software for the modules doesnt ever work with 2 NICs (it looks for the modules out the wrong NIC due to the addressing scheme). I have purchased a Cisco 1811 Router/Switch combo for the solution. Should cover the task and be budget friendly. I have a block of static IP's set aside for this. I have thought of a half a dozen different ways to try this. I am perhaps overthinking the configuration on the 1811 for this so i am asking for help. The IP address of the modules are 192.168.81.6, 7,8,9,20,56,60,61,76,86. Our company network uses the 192.168.80 and 192.168.81.

Thank you for your help in advance, I appreciate your time.

Answer 1

So - I'm assuming that the 192.168.81.x network is set aside for the labs while 192.168.80.x is your production gear? If so, then you're looking for vrf NAT. This article is a great example that hits most of your use cases. The solution will look something like this-

1. Each test bench will have a physical connection to the router/switch and will be assigned to its own VLAN.

2. The L3 interfaces in the VLAN will be configured with identical IP's but will each be placed in a separate vrf.

3. An additional link from the router will connect to your internal network. This interface will be in vrf "production" and have an IP on the existing internal network.

4. Within each vrf you'll need a default route via the production interface.

There are a few ways you can do the NAT, but the most universal is likely just a static subnet translation.

For sake of example let's say that the test benches are each put in vrf's bench-A through bench-E and then make another vrf called "production". Within vrf A we'd have a NAT statement mapping 192.168.80.0/24 to 192.168.0.0/24 in the vrf "production" while in vrf B we'd have a NAT statement mapping 192.168.80.0/24 to 192.168.1.0/24 in vrf "production." The 1811's "production" interface would need an L3 link to the existing infrastructure - likely with a default route. The existing router would, in turn, have routes to 192.168.0.0/24 through 192.168.4.0/24 (the 5 test benches) via the 1811.

The other way to do this would be via a NAT range or overload - general info is here but this likely gets into a bunch of special use-cases where the full network translation will allow for fairly simple bidirectional connectivity.

In the subnet translation case all of the engineer's laptops could be put in the standard internal network and would be able to connect to the bench network via the translated subnet. So, for example, if they wanted to communicate with 192.168.81.6 in the first bench they might instead point to 192.168.0.6 while the second bench would be 192.168.1.6, etc.

So - if instead the situation is that 192.168.81.x also contains a bunch of other production systems then things are going to get a lot more complicated as you'd need to do some kind of hack involving proxy arp and NAT that I'm not at all convinced would work. If this is, in fact, the case then consider clearing out anything else in 192.168.81.x.

Answer 2

You can run 2 NICs on PC/laptop simultaneously. The trick is that DHCP can only be enabled on one at a time (bcs only 1 default gateway). Also, you may need to add some host routes if resources reachable through the second NIC are on a different subnet.

See https://serverfault.com/questions/100011/windows-7-route-single-ip-over-different-interface-wlan