My ultimate goal is to run a VPN through my Cisco Router, which to me means getting the Comcast Gateway out of the way. To this end, I would like to place my Cisco Router (and/or Switch) logically closer to the WAN and remove my Comcast Modem as a logical device. I cannot really remove the modem (it provides the WAN access, after all), however, I do not need its DHCP, NAT or firewall services. I'd like configuration advice.
Here's my current network setup:
Comcast Gateway - Cisco Router - Cisco Switch < LAN & Wifi (Ruckus)
- Comcast Modem: TC8305C
- Cisco Router: 1941-sec/k9 + ehwic-4esg
- Cisco Switch: 2960S 48TS-L (Multi-layer switch, VLANs, etc.)
Modem runs as DHCP Server, NAT and firewall with inside address 10.0.0.1/24. The Router's WAN port is connect to it with a dynamic address (DHCP client). On the Router's LAN side, it is also running NAT (yes, double NAT'ed, for now), DHCP Server, DNS, NTP.
My thoughts on options are:
- Run Modem in Bridge Mode.
- Place Router in Modem's DMZ.
- One variation on 1&2 is to connect Modem to switch.
Modem In Bridge Mode
I tried to set the Modem into Bridge mode and had a very unpleasant 90 minute period where my internet access was down and had to endure some very angry users. I'm guessing I failed to configure the Router WAN port correctly. Probably because it was in DHCP mode. I'd like to try to set it to a static address (e.g. 10.0.0.2/24), however I'm a little gun shy about Bridge Mode, right now. Google generates plenty of hits when searching for "Comcast Bridge Mode", however I haven't been able to make much use of what I found. I haven't been able to find a good incantation for Router WAN port configuration with Comcast Bridge mode.
As an aside, the Comcast bridge isn't entirely transparent, the Modem retains its IP address (10.0.0.1) to which I can connect via http and reconfigure (fortunately) when I attach a laptop directly to it Port 1 on the Modem. So, my laptop understands how to deal with the Modem in bridge mode, even if the Router does not.
I'm also confused how in Bridge Mode the Router gets dynamic settings from Comcast ISP (for DNS and default Gateway, etc.) like it would with DHCP. Or, if these are not really dynamic and I should just hard code them in the Router configuration file.
I believe this is the best option for the network because the Modem steps out of the way completely and the Router can run security, VPN, DDNS, etc.
What should I be doing to make this work?
Router in Modem DMZ
Here, I can finese whatever configuration problems I might be having and just drop the Router (with a static IP of, say, 10.0.0.2/24) into the Modem's DMZ and let all internet traffic be forwarded to this. There's not a whole lot different between this configuration and the one above, except that the Modem is still acting like a Layer 3 device (well, even more like a Layer 3 device). I'm fairly certain I can get this working and I see no reason why I couldn't get VPN working through the Router.
The one drawback here is that the Modem only provides for dyndns.org for running Dynamic DNS. I have no opinion about this organization as a DDNS provider, however, I'd like a choice of vendors, something the Router would allow. Also, the engineer in me wants as little unnecessary processing on the WAN path, so bridging the Modem just feels better.
Run Modem through Switch
When I chatted with a Network Engineer a while back, he suggested that I could run the Modem directly into the Switch. We didn't go into details regarding the configuration. My assumption is that either of the above scenarios (Bridge or DMZ) could work just as well into the Switch directly with the following provisions:
- Proper ACL set up on the Switch/Modem Port to prevent external attacks.
- Separate VLAN for Modem & Router communication to forward incoming DMZ traffic to the Router. Incoming traffic should be limited to VPN traffic. All other traffic (TPC, UDP, ICMP) would be blocked for security purposes. The same ACLs that would be on WAN side of Router.
I'm guessing he recommeneded this set up because by placing the Modem on the Switch directly, you take advantage of the Switch's ability to short cut IP packets after connection establishment. That is, once an internal device connects through the Modem (presumably, connection establishment started with VLANs on the Router), the Switch recognizes this and routes all relevant IP packets directly between the internal device and the modem, skipping the Router. This cannot occur in the physical configuration under which the Modem and the Switch are on Router ports.
- What should my Router's WAN Port configuration look like to ensure it works with a Comcast Modem in Bridge mode? Are there any other config options I should look out for (like DNS servers)?
- Alternatively, should I settle for placing the Router in the DMZ?
- Is it worth reconfiguring and moving the Modem to a Switch Port for either #1 or #2?