2

I have a Cisco 877 router, running IOS Version 12.4(24)T3, with 4 Ethernet ports and multiple external IP address attached to the internet connection.

I usually just nat the external addresses to internal ones but I have to install a Juniper Firewall for a third party which must connect directly to the web as the external ip needs to be configured on the wan interface of the firewall.

So my question is can I bind/bridge a single external IP to one of the Ethernet ports on the router so the firewall thinks its connected directly to the internet ?

    show version 
Cisco IOS Software, C870 Software (C870-ADVIPSERVICESK9-M), Version 12.4(24)T3, RELEASE SOFTWARE (fc2) Technical Support: cisco.com/techsupport Copyright (c) 1986-2010 by Cisco Systems, Inc. Compiled Tue 23-Mar-10 18:21 by prod_rel_team 

ROM: System Bootstrap, Version 12.3(8r)YI4, RELEASE SOFTWARE richadsl 
uptime is 6 weeks, 1 day, 12 hours, 1 minute System returned to ROM by power-on System image file is "flash:c870-advipservicesk9-mz.124-24.T3.bin"
Cisco 877 (MPC8272) processor (revision 0x200) with 118784K/12288K bytes of memo ry. 
Processor board ID FHK1123161T MPC8272 CPU Rev: Part Number 0xC, Mask Number 0x10 4 FastEthernet interfaces 1 ATM interface 128K bytes of non-volatile configuration memory. 
28672K bytes of processor board System flash (Intel Strataflash)
  • Can you update your question with the router model and IOS version? – JFL Sep 23 '16 at 9:35
  • #show version Cisco IOS Software, C870 Software (C870-ADVIPSERVICESK9-M), Version 12.4(24)T3, RELEASE SOFTWARE (fc2) Technical Support: cisco.com/techsupport Copyright (c) 1986-2010 by Cisco Systems, Inc. Compiled Tue 23-Mar-10 18:21 by prod_rel_team ROM: System Bootstrap, Version 12.3(8r)YI4, RELEASE SOFTWARE richadsl uptime is 6 weeks, 1 day, 12 hours, 1 minute System returned to ROM by power-on System image file is "flash:c870-advipservicesk9-mz.124-24.T3.bin" – Cisco-Noob Sep 23 '16 at 9:38
  • Cisco 877 (MPC8272) processor (revision 0x200) with 118784K/12288K bytes of memo ry. Processor board ID FHK1123161T MPC8272 CPU Rev: Part Number 0xC, Mask Number 0x10 4 FastEthernet interfaces 1 ATM interface 128K bytes of non-volatile configuration memory. 28672K bytes of processor board System flash (Intel Strataflash) – Cisco-Noob Sep 23 '16 at 9:39
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 15 '17 at 3:00
2

The ports on that are like switch ports. You'd have to create an svi then give the port the vlan. Svi is switched virtual interface. Basically give a vlan an ip address.

interface vlan 10
ip address 10.10.10.10 255.255.255.0
exit
interface FastEthernet0
switchport access vlan 10
exit
vlan 10
state active 
exit
1

You may wan to have a look at Integrated Routing and Bridging (IRB) but I'm not sure if (a) you can configure the LAN interfaces on a 877 separately and (b) if your existing NAT would still work (as you would need to move it to the BVI interface).

A possible alternative exists if the 3rd party can configure the Juniper to have a private IP address (from the range you currently use on the inside) as primary ip address on its WAN interface, and the public IP address as a secondary address (or loopback address, or whatever works). In that case you just add a static host route on your router like

ip route 200.201.202.203 255.255.255.255 192.168.1.66

where 192.168.1.66 is the (private) primary ip address of the Juniper and 200.201.202.203 is the (public) secondary ip address.

The only other solution I can think of is the most common one, using a dedicated public /30 subnet from which you assign one ip address to the Juniper and one to your router.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.