3

I'd like to set up a little network environment. We have bought 2 different subnet from our ISP.
The WAN internet connection : xx.yy.81.61/26
WAN gateway: xx.yy.81.1
First subnet : xx.yy.81.80/30 (this has the same first 3 octet as the WAN, probably doesn't count, because it is a different subnet)
Second subnet : zz.uu.156.48/29

As you can see in the first diagram, the xx.yy.81.61/26 is assigned to the CISCO's outside(WAN) interface, the internet connection is alive, all hosts in LAN have internet connection. We want to assign some hosts with public IP address (for webserver sake). I'm not familiar with networking, so please forgive me if I make some silly questions. In brackets, I make the cisco router setup with the "Cisco Configuration Professional" PC program.

      |     
      |     ADSL or Optical cable (fiber link)
      |
   +-----+
   |     |   modem
   |     |
   +-----+
      |
      |        WAN (xx.yy.81.61/26)
      |     Gateway(xx.yy.81.1)
      |
 +----------+
 |          |
 |          |    CISCO 881 (router/firewall)
 |          |    IOS 15.2(4)M6
 |          |
 +----------+
      |
      |
 -----+-------------   our local LAN segment (vlan)
  10.10.10.1/24


I want to set up the CISCO:
- The question is, that how can i make my subnets alive? I just want to transmit(NAT) some public IP from subnet to specific HOST computer(or inverse?). I have made the NAT rules (zz.uu.156.50 <- 10.10.10.xxx), but no result, the public IP is unreachable(no ping, no traceroute).
- Do I have to assign a second IP(virtual) address from subnets to the outside interface(WAN). If yes, than how?

The truth is that the original setup was different, as you can see in the second diagram. In this case the both subnet was alive. Based on this I think the subnets is being routed through the WAN IP address(xx.yy.81.61). Now, I unmounted the ISP owned HP router and I attached the CISCO directly to the modem output(first diagram), because we had some DNS issues and I think it is unnecessary to be 2 router sequentially. Please indicate if i was wrong.
I mention, that by the original setup, I could access the HP router (just the login interface) from internet with first IP of the subnets (xx.yy.81.81 from the first subnet and zz.uu.156.49 from the second subnet).

      |     
      |     ADSL or Optical cable (fiber link)
      |
   +-----+
   |     |   modem
   |     |
   +-----+
      |
      |
      |
  +-------+
  |       |    blackbox, no acces
  |       |    ISP owned HP router
  |       |
  +-------+
      |
      |        WAN (xx.yy.81.82/30)    or      WAN (zz.uu.156.50/29)
      |     Gateway(xx.yy.81.81)            Gateway(zz.uu.156.49) 
      |
 +----------+
 |          |
 |          |    CISCO 881 (router/firewall)
 |          |    IOS 15.2(4)M6
 |          |
 +----------+
      |
      |
 -----+-------------   our local LAN segment
  10.10.10.1/24
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 2:56
2

To clarify, normally in this situation you will have your /30 subnet being where your /26 and /29 subnet are routed to by upstream. You bring up your side of the /30, eg xx.yy.81.82/30 and there being only one other available address the gateway is xx.yy.81.81/30 on the provider end.

The ISP will typically route xx.yy.81.61/26 and zz.uu.156.48/29 via xx.yy.81.82/30 (aka your side) because its a predictable address. All internet traffic then asks the device which has xx.yy.81.82/30 how to get to the /26 and the /29 if im not mistaken.

So, you have three options:

a) If you want to map a public IP address directly to a server you will need to use one-to-one nat -> http://ciscoskills.net/2011/01/21/configuring-nat-one-to-one-mapping/

b) If you want to do port forwards, put each ip address as a sub-interface on your wan nic and do normal PAT.

c) If you want to put the public IP address directly on your internal devices and avoid nat altogether you will need to put an ip address on a second nic or a vlan interface on the cisco and plug it into a switch, and connect your servers from there. You may have to exclude these addresses from getting natted perhaps and depends how many nics your cisco has.

Hopefully this helps you come to a solution :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.