1

We use Cisco Catalyst 3850 Switch (with Cisco One Foundation) as aggregation Switch for multiple Lines and connect it to a ISR 4451 for routing.

Now we search for a solution to use the Interfaces of the Cisco Catalyst as Interfaces of the ISR. I heard that should be possible to use the interfaces as virtual interfaces on the ISR. Anybody knows about this task and can give me some links for documentation?

The main task is that we want to use BGP for one Connection on the catalyst. Maybe we can add this line directly to the ISR but we want do the aggregation on the catalyst and the routing on the ISR, is this possible?

Update

In the following Picture you can see the given infrastructure. There is a stack with two Cat3850 und each has a fibrelink to the ISR. Each Carrier is connected to a Interface on one of the catalyst and has a route to the isr. For example the Carrier 1 is connected to catalyst Gi1/0/1 and Carrier 2 to catalyst Gi2/0/1 each Port is a routed port with a IP Address as transfer Net and routed a IP Range to the ISR. Is there a possibility to address the Gi1/0/1 from the ISR as something like a virtual device.

enter image description here

Improve this question
  • I'm not 100% sure if I understand the question, especially the part about "use the Interfaces of the Cisco Catalyst as Interfaces of the ISR". I think what you may want to do is to turn off routing (L3 switching) on the switch, remove the SVI interfaces, create a trunk between between the switch and the router, and create vlan subinterfaces on the router's interface. But I realize I'm guessing now, which we're not allowed to do here ;-). Can you please post the config of your switch and your router, and try to clarify a bit more what you want to do? A topology drawing could help as well. – hertitu Nov 10 '16 at 10:52
  • I add a picture and a litte example as update of the original post. – kockiren Nov 10 '16 at 13:33
2

No, the switches cannot be configured as part of the ISR. The switch stack can be configured as if it were a single switch, but the switch stack and the ISR are going to be two separate network devices, and each is configured separately.

I'm not sure why you would ever do it the way your drawing depicts. By connecting your switches directly to the ISPs, you are leaving them vulnerable to attack from the Internet. The ISR has NIM slots for modules you use to connect to the WAN. That is what you should be using for ISP connections.

Edit:

Based on your comments, this is an example of the router-on-a-stick method of connecting to a switch trunk:

interface GigabitEthernet0/0/0
 no ip address
 no shutdown

interface GigabitEthernet0/0/0.10
 description Subinterface for VLAN 10
 encapsulation dot1Q 10
 ip address 10.0.10.1 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no shutdown

interface GigabitEthernet0/0/0.20
 description Subinterface for VLAN 20
 encapsulation dot1Q 20
 ip address 10.0.20.1 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no shutdown

interface GigabitEthernet0/0/0.30
 description Subinterface for VLAN 30
 encapsulation dot1Q 30
 ip address 10.0.30.1 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no shutdown

If these are separate customers, and you do not want them to be able to get to each others' networks, you will need to create ACLs to block that. For instance, if your LAN interface has an IP address of 10.11.12.13, you could have an ACL that only allows a customer's traffic to get to that network:

ip access-list 10
 permit any 10.11.12.0 0.0.0.255

You apply the access list inbound on all the customer sub interfaces.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.