1

I am new to Cisco in general and have the following setup:

GigabitEthernet0/0 contains an IP address that is connected to our provider/BGP drop; GigabitEthernet0/1 contains various IP addresses assigned ending in .1 for the IP prefixes we announce to the Internet; this is also the Interface that all of our devices are plugged into via our switch <--> GigabitEthernet0/1 connection.

We want our primary IP address on GE0/0 to be on our primary assigned IP network, such as a.b.c.252 while keeping .1 on GE0/1 for a gateway for our local machines/equipment. Currently when traceroutes or the like come into the network, they get responded to with the IP assigned from our uplink to GE0/0. We'd like this instead to be an IP from our own assigned prefix for identification/notification/consistency sake. (We'll keep the IP from our uplink as a secondary IP).

When I try to assign .252 to GE0/0 and .1 to GE0/1, I get the usual errors about the subnet already existing on another interface.

How do I go about doing this? How do I assign IP in A.B.C, such as A.B.C.252 to GE0/0 as the primary IP address while assigning A.B.C.1 to GE0/1 so that clients on the network can use it as a gateway?

Or, is there a way to allow those on the LAN to use IPs on GE0/0 even though they're plugged into GE0/1, without borking anything too bad? And more to this point even more so, and going a bit off the rails but curious to know if it's possible - if we have three distinct prefixes assigned from RIPE, and wanted to have traceroutes and what-have-you respond with the .1 IP from the beginning of each subnet to the requestor, would this be possible? I am imagining something to do with NAT and matching response with a given source IP for certain ICMP packets (but this wouldn't work for, say, UDP traceroute?). Any ideas there either?

Thanks in advance!

  • 1
    Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 14 '17 at 22:06
3

How do you have this set up at the moment? Are you using a private range or another of you public subsets on G0/0?

You can't have the same subnet on different interfaces as it would break routing. The router wouldn't know which hosts were reachable through each of the interfaces.

There are a couple of workarounds if you want to have your BGP peering on the same network as your public address space:

It is possible to create a bridge-group consisting of G0/0 and G0/1. You can then assign a BVI to the group with your public addresses. This would give you a single IP interface with traffic from G0/0 and G0/1 L2 forwarded to the IP interface. Another option would be to connect your BGP connection into the LAN and put your IPs on G0/1 only.

This isn't the usual way to peer with a provider. It would be much better to use separate IP interfaces for the LAN and peering so that policies and ACLs can be applied. What is your reasoning for wanting it set up like this? Is it just so your trace routes show your public address?

| improve this answer | |
  • On G0/0, the two IP addresses are two addresses provided by our uplink with whom we peer with BGP. The addresses are used for communicating to the BGP session on the uplink's router. The reason we want it like this is like you inferred - we want the traceroutes to show our public addresses instead of the uplink. I was able to assign the .1 address from one of our public IP prefixes to G0/0, but then the machines on the LAN were not able to use that .1 address as a gateway. – Brendan Jul 17 '16 at 9:16
  • (I couldn't add more characters to the last one) - If I were to create this BVI interface and bridge G0/0 and G0/1, would I just assign all IPs I currently have on both G0/0 (the two IPs assigned by our uplink, that are used for BGP to their routers) and the IPs I have on G0/1 (the .1 IP of each public prefix we have, of which we have 5, so there are 5 x.y.z.1 addresses on it) to the BVI interface? I would then have the primary IP of the BVI set to the address I want for the traceroutes (a.b.c.1) so responses come from that? – Brendan Jul 17 '16 at 9:20
  • OK, so going down this route just to change what appears in traceroute is a bad idea. The address shown in traceroute will be the outgoing interface's IP address towards the source of the traceroute, so in order to have your .1 network show up, it would have to be the network you peered with your ISP on. You would have to use that address only on the BVI and you and your ISP would have to change your BGP neighbour addresses to be on that network. Not ideal really. You could hide the G0/0 hop using no ip unreachables, but again not ideal. Best to leave traceroute as it is if you can. – Karl Billington Jul 17 '16 at 9:51
  • When I had added my .1 address as primary G0/0, I set the address my ISP communicates for BGP as secondary and everything worked fine. A traceroute showed my .1 address and everything was harmonious, and everything with BGP was going a-okay. Is there no way to do that with BVI? – Brendan Jul 17 '16 at 10:51
  • Should be possible with a BVI, make sure you enable "bridge irb" in the global config. When you assign a bridge-group to G0/0 and G0/1 they become L2 ports, so remove the IPs and add them to the BVI, as you did on G0/0 before. Not a normal setup, but should work if you need it to be that way – Karl Billington Jul 17 '16 at 10:55
1

This would be manufacturer depended as it not really standards based, but we do see it implemented, namely in Cisco IOS.

Understanding and Configuring the ip unnumbered Command

The ip unnumbered configuration command allows you to enable IP processing on a serial interface without assigning it an explicit IP address. The ip unnumbered interface can "borrow" the IP address of another interface already configured on the router, which conserves network and address space.

| improve this answer | |
0

First, I think you misunderstand how traceroute works. The IP address you see in traceroute is the router address of the interface where a packet enters the router. This is because the TTL of the packet is 1 when it enters the interface, and the interface decrements the TTL to 0. When that happens, the router generates an ICMP message and sends it back the way the packet came in. The source address of that message is the interface where the ICMP message is leaving the router (your G0/0 WAN interface). The interface to which the router would send the packet if the TTL was not 0 (your G0/1 LAN interface) plays no part in this.

A router routes between networks, not from an interface in one network to an interface in the same network. The routing table would not work correctly if you had two interfaces in the same network, and that is why routers don't let you assign the same network to two different interfaces.

Another consideration is that you may want to disable ICMP and traceroute at the router as a security measure. Hackers use this to try to discover you internal network structure. Traceroute is a good tool for use within your own network, but on the Internet, you can get false information. Some ISPs along the path will drop or reroute ICMP and/or traceroute to other paths in order to obfuscate their internal networks.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.