1

I would like to combine private and public addressing to PPPoE clients from a Cisco BRAS.

Do you think is possible to do it using the same virtual template?

If I define ip nat inside in the PPPoE enabled interface and an access-list that will match only the addresses want, would this impact clients with public IP address?

I am sure that using different templates would work, but I would like to try using the same VLAN and not to separate some clients in a different VLAN.

Improve this question
3
  • I'm not quite sure I understand. Normally, you only use a single network on each VLAN. Having multiple networks (public, private, or both) on a single VLAN is problematic. It is possible to have only some of the addresses in a network be translated, even if the interface for that network is marked as an inside interface, but the interface will be specific to a single network. How would you propose to have clients in a different network than is assigned to your interface use your interface as a gateway?
    – Ron Maupin ♦
    Sep 10, 2016 at 17:42
  • I have the gateway addresses defined in the loopback interface, and an addressing scheme of /30 between de PPPoE Server and my border router to get the internet. This way i have multiple prefix working at the same time with one virtual-template . I would like to create an access-list to translate only the clients that receive a private IP from radius authentication. And keep the rest exactly as they arre working now.
    – RS1983
    Sep 11, 2016 at 7:41
  • You will need to be much more specific. You should edit your question to include your (sanitized) configuration.
    – Ron Maupin ♦
    Sep 11, 2016 at 12:43

1 Answer 1

Reset to default
2

From NAT perspective you wont have problems, as long as your are using correct access-lists. So for example, permit only private ip range in acl and use this acl in ip nat inside source list (private range acl) pool blabla overload. NAT will be created only for those packets that match acl. Public ip addresses will use normal routing.

Improve this answer
3
  • Now i have one additional problem. This works in a Cisco router which does ppp termination by software but in a 7609 not. I think that as it pppoe sessions are hardware managed...ACL doesn't apply...Any idea to solve this? Thanks
    – RS1983
    Sep 14, 2016 at 11:24
  • I do not think that it has anything to do with hardware software part. Could you please share relative configuration parts.
    – Nuran Afrasiyabov
    Sep 14, 2016 at 13:32
  • I doubt about SPA5x1GE used to PPP and ACL. Configuration is a common PAT configuration, with the unique difference is that ip nat inside command is on the template interface (i also tried at loopback). ACL matching counters and in consecuence ip nat translation is empty in the 7609. The same configuration is working in a 7206VXR
    – RS1983
    Sep 14, 2016 at 14:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.