2

enter image description here

I'm planning to enable the connectivity with our access points as shown in the Diagram.

I would like to understand how can I enable the routing between 192.168.1.1/25 (FE4)and 10.140.134.0/25(FE1). The Cisco Router allows the interface configuration only on the FE4 port.Hence I configured all the AP's IPsec destination as FE4.

Goals:

  1. Enable connectivity from Application server to Acces point 1,2 and 3
  2. Enable connectivity from Desktop (D01) to Application server( Already enabled by configuring intervlan routing on Router R2)
  3. Enable IPv6 connectivity between application servers and the three access points.

Note: Connectivity from Access points to Router R1 is already on IPsec and 6in4 tunnels.

Can you guide me to achieve the goal #1 and #2?

If possible I would like to avoid adding static route on Router R2.

Can a static route in Router R1 alone can enable #1 and #2 requirements?

Router Config:

!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
 ip address 192.168.1.1 255.255.255.0
 duplex auto
 speed auto

!
interface Vlan1
 ip address 10.140.134.40 255.255.255.0
 ipv6 address FDB7:5CB7:B0E8:947D::/64 eui-64
 ipv6 enable
!
ip forward-protocol nd
ip route 192.168.2.0 255.255.255.0 FastEthernet4
no ip http server
no ip http secure-server
!
!
!
ip access-list extended AP_001350FFFE11B666_ACL
 permit ip host 192.168.1.1 host 192.168.1.10
!
ipv6 route FDC9:CCBE:1DC7:A6::/64 Tunnel100
!
!
!
!
!
control-plane
!
!
line con 0
 no modem enable
line aux 0
line vty 0 4
 login
!
scheduler max-task-time 5000
end

Router#

Adding IPSEC and 6in4 tunnel configuration

crypto ipsec transform-set MANUAL_TRANSFORM_SET01 esp-aes esp-sha-hmac
 mode transport
!
crypto map LAB_MAP 100 ipsec-manual

 set peer 192.168.1.10 default
 set session-key inbound  <Key Removed intentionaly>
 set session-key outbound <Key Removed intentionaly>
 set transform-set MANUAL_TRANSFORM_SET01
 match address AP_<MACCHANGED>_ACL
!
archive
 log config
  hidekeys
!
!
!
!
!
interface Tunnel100

 no ip address
 ipv6 address FDC9:CCBE:10C0:A6:BF22:7825:C8F6:7257/64
 ipv6 enable
 tunnel source 192.168.1.1
 tunnel destination 192.168.1.10
 tunnel mode ipv6ip
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
 ip address 192.168.1.1 255.255.255.0
 duplex auto
 speed auto
 crypto map <CHANGED>
!
0
1

It appears that interface FastEthernet4 is a router interface, and you should use that to connect to the other router. If interface FastEthernet1 is a switched interface, then you should use it to connect to your switch.

Your routers will automatically route between directly connected networks, so you do not need to add routes for that, but you will need to add routes for networks on the other router.

Something like this for R1:

interface FastEthernet0
 description Connection to Switch1
 switchport access vlan 1
 switchport mode access
!
interface FastEthernet4
 description Connection to R2 FastEthernet4
 ip address 10.11.12.13 255.255.255.252
!
interface Vlan1
 description WAP VLAN
 ip address 192.168.1.1 255.255.255.0
!
no ip route 192.168.2.0 255.255.255.0 FastEthernet4 !*** remove the route to directly connected network ***
ip route 10.140.133.0 255.255.255.128 10.11.12.14 !*** add route to Desktop network ***
ip route 10.140.134.0 255.255.255.128 10.11.12.14 !*** add route to Server network ***
!

Something like this for R2:

interface FastEthernet0
 description Connection to Desktops
 switchport access vlan 1
 switchport mode access
!
interface FastEthernet1
 description Connection to Servers
 switchport access vlan 2
 switchport mode access
!
interface FastEthernet4
 description Connection to R1 FastEthernet4
 ip address 10.11.12.14 255.255.255.252
!
interface Vlan1
 description Desktop VLAN
 ip address 10.140.133.1 255.255.255.128
!
interface Vlan2
 description Server VLAN
 ip address 10.140.134.1 255.255.255.128
!
ip route 192.168.1.0 255.255.255.0 10.11.12.13 !*** add route to WAP network ***
!
2
  • Thanks for your inputs Ron. If I change the interface towards the AP, then I may also need to change the IPSEC and 6in4 tunnel configurations as well. The communication from AP towards the Router is expected to be via IPsec & 6in4 tunnel. How should I configure the destination IP address for the IPSEC and 6in4 tunnel? I'm not able to assign IP for the Switched Interfaces from Fe0 to Fe3. This is the sole reason I chose FE4 WAN interface for connecting the AP to router. I will also update the 6in4 and IPsec tunnel configurations for your quick reference. – Maverick Dec 22 '17 at 2:45
  • You can use the SVI interface for what you want. You are connecting the interface to a switch, so it doesn't need to be a routed interface. – Ron Maupin Dec 22 '17 at 6:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.