0

enter image description here

DS has 7 VLANs and 7 DHCP pools respectively. There are 3 trunk links to 3 access layer switchs to share VLANs. Its VLAN interfaces and DHCP pools:

ip dhcp pool vlan10
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 8.8.8.8
ip dhcp pool vlan20
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1
ip dhcp pool vlan30
 network 192.168.30.0 255.255.255.0
 default-router 192.168.30.1
 dns-server 8.8.8.8
ip dhcp pool vlan40
 network 192.168.40.0 255.255.255.0
 default-router 192.168.40.1
 dns-server 8.8.8.8
ip dhcp pool vlan50
 network 192.168.50.0 255.255.255.0
 default-router 192.168.50.1
 dns-server 8.8.8.8
ip dhcp pool vlan60
 network 192.168.60.0 255.255.255.0
 default-router 192.168.60.1
 dns-server 8.8.8.8
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan10
 mac-address 0060.70dd.1001
 ip address 192.168.10.1 255.255.255.0
!
interface Vlan20
 mac-address 0060.70dd.1002
 ip address 192.168.20.1 255.255.255.0
!
interface Vlan30
 mac-address 0060.70dd.1003
 ip address 192.168.30.1 255.255.255.0
!
interface Vlan40
 mac-address 0060.70dd.1004
 ip address 192.168.40.1 255.255.255.0
!
interface Vlan50
 mac-address 0060.70dd.1005
 ip address 192.168.50.1 255.255.255.0
!
interface Vlan60
 mac-address 0060.70dd.1006
 ip address 192.168.60.1 255.255.255.0
!
interface Vlan100
 mac-address 0060.70dd.1007
 ip address 192.168.100.1 255.255.255.0

I use single OSPF for DS, RT-GW and Internet. All networks are linked but I want to hide private IP addresses when they go outside from RT-GW. How can I do this?

Improve this question

2 Answers 2

Reset to default
0

Your scenario is what Network Address Translation (NAT) is meant to do and would be required in your scenario to reach the internet while using RFC1918 IP addresses anyway.

Improve this answer
11
  • OSPF will not work across NAT, which the question seems to indicate that the OP wants.
    – Ron Maupin ♦
    Apr 13 at 17:31
  • Ah, perhaps. I assumed 'single OSPF for DS, RT-GW' meant OSPF neighbor between DS and RT-GW. Though it could mean between RT-GW and Internet (ISP), I suppose, or perhaps all three, though I don't see any need for OSPF between RT-GW and an ISP connection/router. If NAT is used on RT-GW, then there is only 1 route (default) from the ISP connection. Realistically, in this design, OSPF is not even needed between DS and RT-GW though it may be convenient if the network changes frequently or has more complexity.
    – FrameHowitzer
    Apr 13 at 17:36
  • @FrameHowitzer I use the router named Internet to simulate Internet. If there is not OSPF, do you mean I should use RIP/EIGRP/static instead? Should I use subinterface for inter-VLAN routing in this case?
    – chancuockhanh
    Apr 13 at 17:51
  • @chancuockhanh, routing protocols are broken by NAT. Routing protocols want to advertise the networks, not a NAT.
    – Ron Maupin ♦
    Apr 13 at 18:12
  • @chancuockhanh, remember that NAT is a kludge to extend the life of IPv4 until IPv6 is ubiquitous and restores the IP end-to-end paradigm where every host has a unique public address. You get security from firewalls, not NAT. You need a firewall between your network and the public Internet, otherwise if your RT-GW is compromised, it knows about all the internal networks, and then the attacker has access to all of them.
    – Ron Maupin ♦
    Apr 13 at 18:17
0

I just use NAT on RT-GW:

interface GigabitEthernet0/0/0
 ip address 192.168.1.254 255.255.255.252
 ip nat inside
 duplex auto
 speed auto
!
interface GigabitEthernet0/0/1
 ip address 203.0.113.2 255.255.255.0
 ip nat outside
 duplex auto
 speed auto
!
!
ip nat inside source list 101 interface GigabitEthernet0/0/1 overload
!
access-list 101 permit tcp any host 8.8.8.8

Result:

RT-GW#sh ip nat trans
Pro  Inside global     Inside local       Outside local      Outside global
icmp 203.0.113.2:5     192.168.30.11:5    8.8.8.8:5          8.8.8.8:5
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.