How to use IPs from the same network on two separate Cisco interfaces, and other IP trickery

Question

I am new to Cisco in general and have the following setup:

GigabitEthernet0/0 contains an IP address that is connected to our provider/BGP drop; GigabitEthernet0/1 contains various IP addresses assigned ending in .1 for the IP prefixes we announce to the Internet; this is also the Interface that all of our devices are plugged into via our switch <--> GigabitEthernet0/1 connection.

We want our primary IP address on GE0/0 to be on our primary assigned IP network, such as a.b.c.252 while keeping .1 on GE0/1 for a gateway for our local machines/equipment. Currently when traceroutes or the like come into the network, they get responded to with the IP assigned from our uplink to GE0/0. We'd like this instead to be an IP from our own assigned prefix for identification/notification/consistency sake. (We'll keep the IP from our uplink as a secondary IP).

When I try to assign .252 to GE0/0 and .1 to GE0/1, I get the usual errors about the subnet already existing on another interface.

How do I go about doing this? How do I assign IP in A.B.C, such as A.B.C.252 to GE0/0 as the primary IP address while assigning A.B.C.1 to GE0/1 so that clients on the network can use it as a gateway?

Or, is there a way to allow those on the LAN to use IPs on GE0/0 even though they're plugged into GE0/1, without borking anything too bad? And more to this point even more so, and going a bit off the rails but curious to know if it's possible - if we have three distinct prefixes assigned from RIPE, and wanted to have traceroutes and what-have-you respond with the .1 IP from the beginning of each subnet to the requestor, would this be possible? I am imagining something to do with NAT and matching response with a given source IP for certain ICMP packets (but this wouldn't work for, say, UDP traceroute?). Any ideas there either?

Thanks in advance!

Answer 1

How do you have this set up at the moment? Are you using a private range or another of you public subsets on G0/0?

You can't have the same subnet on different interfaces as it would break routing. The router wouldn't know which hosts were reachable through each of the interfaces.

There are a couple of workarounds if you want to have your BGP peering on the same network as your public address space:

It is possible to create a bridge-group consisting of G0/0 and G0/1. You can then assign a BVI to the group with your public addresses. This would give you a single IP interface with traffic from G0/0 and G0/1 L2 forwarded to the IP interface. Another option would be to connect your BGP connection into the LAN and put your IPs on G0/1 only.

This isn't the usual way to peer with a provider. It would be much better to use separate IP interfaces for the LAN and peering so that policies and ACLs can be applied. What is your reasoning for wanting it set up like this? Is it just so your trace routes show your public address?

Answer 2

This would be manufacturer depended as it not really standards based, but we do see it implemented, namely in Cisco IOS.

Understanding and Configuring the ip unnumbered Command

The ip unnumbered configuration command allows you to enable IP processing on a serial interface without assigning it an explicit IP address. The ip unnumbered interface can "borrow" the IP address of another interface already configured on the router, which conserves network and address space.

Answer 3

First, I think you misunderstand how traceroute works. The IP address you see in traceroute is the router address of the interface where a packet enters the router. This is because the TTL of the packet is 1 when it enters the interface, and the interface decrements the TTL to 0. When that happens, the router generates an ICMP message and sends it back the way the packet came in. The source address of that message is the interface where the ICMP message is leaving the router (your G0/0 WAN interface). The interface to which the router would send the packet if the TTL was not 0 (your G0/1 LAN interface) plays no part in this.

A router routes between networks, not from an interface in one network to an interface in the same network. The routing table would not work correctly if you had two interfaces in the same network, and that is why routers don't let you assign the same network to two different interfaces.

Another consideration is that you may want to disable ICMP and traceroute at the router as a security measure. Hackers use this to try to discover you internal network structure. Traceroute is a good tool for use within your own network, but on the Internet, you can get false information. Some ISPs along the path will drop or reroute ICMP and/or traceroute to other paths in order to obfuscate their internal networks.