3

My current setup is the following:

ATT ISP ---- ATT wireless router ---- cisco 890 wireless router

My cisco 890 is for internet and remote VPN access from home to my company, however, I don't have access/priv to modify or look at the running config of the router. I could however, connect to some of the ethernet port of the 890 for non-corporate traffic, which I'm allowed 1 or 2 ports for this access.

So I use the cisco router for corporate access mostly, but use the ATT wireless router for regular home use (for my wife actually).

I'm in the process of acquiring 4 cisco 3560 switches and setting up a server with GNS3 for CCIE R/S studying.

My goal is to set up a secure remote connection from the internet to my home server with GNS3, but not sure where to set up or terminate the connection, that is on the ATT or Cisco router or even on the server.

I've heard it can be done via port forwarding, but not recommended. Instead use SSH or VPN. I'm sure my IP from the ISP is via DHCP, so somehow I need to get it static or find other way to still work even if via dhcp.

Is it better to use SSH and terminate at the server? If so, how would I handle this via the att/cisco routers as intermediary devices?

Or is it better to use VPN? I guess I would need to terminate the VPN at the cisco router, but this assumes my company allows me to modify the config. If so, how could I handle this from the ATT router as an intermediary device?

appreciate the help!

Improve this question
3
  • How do you plan on accessing the console? Via the server? Will you be using a breakout switch or quad NIC in your server?
    – Daniel Dib
    Jun 9, 2013 at 18:20
  • I'll be using a server with GNS3 and quad-core NIC card for GNS3 to cisco switches. My intention is to access the server remotely, then within the server, telnet to loopback via built in console ports of the dynamips/gns3 setup. I do this now with my dynamips server at work, but have been wanting to set up my own home network to allow for friends in their studying.
    – user1609
    Jun 9, 2013 at 18:48
  • just realized, i may get additional nic cards for com port access to the switch consoles. other option i'm considering is a terminal server with an octal to the switches. If i can't get the com ports for switch console access, i'll just have to pre-configure the switches on the console and use the quad-nics for connecting gns3 to the switches in the lab topology setup.
    – user1609
    Jun 9, 2013 at 18:57

2 Answers 2

Reset to default
4

I would pick up a cheap Cisco router/ASA/pix device and set it up with port forwarding/DMZ on the ATT router so all packets going to your public IP that aren't receiving traffic for connections like your wife, go to the router/ASA/pix. Then I would configure it as a remote VPN termination point.

An ASA5505 will probably set you back $200. But you might be able to find an 1800/2800 series router to work with for less. If you get an ISR like those, make sure it has the security IOS or you have a way to get the security or better IOS on it.

As you most likely have a dynamic public address, I would use something like no-ip.com or another dynamic DNS service to have a domain that points to your public IP and updates when it changes. This might be configurable on the ATT router or you may need to run software on a computer in the network.

This would allow secure access to your private network. Once on the VPN, you could connect to your lab equipment via SSH/HTTP/Console depending on how you setup the internal side.

EDIT: If you're already doing port forwarding/DMZ to your company router, then you would need to ask them to allow you to have a VPN termination point on it for your private network.

Improve this answer
3
  • Awesome! this is in part of what I needed to understand. I forgot to mention in my previous post that I have an idle ASA5505 sitting there, but haven't configured it yet. It's running the base license version. I know with the base license, it can do webssl, ssh and vpn. by the way, i noticed you mentioned to use port forwarding on the att router. so to make it secure, I'm sure I can setup some filtering on the ASA via inbound, perhaps only allow SSH access, but is there anything specific on the ATT router i should consider as well for inbound security?
    – user1609
    Jun 9, 2013 at 18:50
  • No, I would have it so all packets sent to your public IP go to the ASA. The ASA by default will block anything on the lower security interface (outside network) from going to the higher security interface (inside network). Essentially the ASA would act like it had the public IP address (even though it would be a private IP on the outside interface).
    – some_guy_long_gone
    Jun 9, 2013 at 19:53
  • I see what you mean. but doing this implies I need to set up my topology so that my att router connects to the asa then from the asa to the 890 router. the 890 router is already secure and configured by corporate, I didn't want to have this as my inside net behind the asa. I think a similar approach to what you suggest is to connect the asa outside to one of the att ethernet ports (keep it as a separate connection from the 890 router) and direct all traffic to public ip on a fixed port to the asa but allow all other traffic to other ports, if destined to the network behind the 890 router.thks!
    – user1609
    Jun 10, 2013 at 14:33
5

You can use an application called ser2net to make use of USB to serial cables. There is a 4x serial -> one USB available which would cover 4x switches. That way you get virtual USB ports like ttyUSB0, ttyUSB1, ttyUSB2, ttyUSB3. You can then map these USB ports to TCP ports like:

2001:telnet:600:/dev/ttyUSB0:9600 8DATABITS NONE 1STOPBIT banner
2002:telnet:600:/dev/ttyUSB1:9600 8DATABITS NONE 1STOPBIT banner
2003:telnet:600:/dev/ttyUSB2:9600 8DATABITS NONE 1STOPBIT banner
2004:telnet:600:/dev/ttyUSB3:9600 8DATABITS NONE 1STOPBIT banner

Then you would telnet to ports 2001-2004 to connect to the switches. If you want to support this remotely then you could port forward on the ATT router for these ports or simply forward SSH only to your server and then connect to switches from there.

If you want to be more secure there's always the possibility of doing some sort of VPN to the server as well.

There's also the option of getting a 2500 and using it as an access server.

Improve this answer
3
  • ah, interesting. I like this approach better and may be easier/most cost effective. Thanks for sharing.
    – user1609
    Jun 9, 2013 at 19:44
  • and to expand on this - you could even run that on a RasberryPi! small, cost efficient and energy efficient (less heat & noise)....well you already have switches with fans in them - but might as well eliminate as much as you can. I'm in the process of making a few to run around when a terminal server isn't easily accessible nearby
    – knotseh
    Jun 9, 2013 at 21:17
  • I've heard of the raspberry pi computer. small and pretty cheap. I didn't consider using this, but sounds possible. Question: do you mean to use the raspberry pi as the gns3 host setup? not sure how this would work given the ram requirement for GNS3 or even dynagen. I've found that having more ram is better, especially for windows since its more sensitive.
    – user1609
    Jun 10, 2013 at 4:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.