Re: Simple route/gateway forwarding
James Smallacombe <[email protected]> Tue, 6 Apr 2010 17:29:40 -0400 (EDT)
| Newsgroups | gmane.org.operators.internet-access |
|---|---|
| Message-ID | <[email protected]> |
For that to work, they'd need another FastEther interface in the 2811. The reason is because the internal 2811 Ether NATs 192.168 in to a Provider A IP out on the External Ether. Obviously, Provider B won't route Provider A's IP. IOS won't NAT to a secondary IP, AFAIK. I just noticed that Cisco has a fairly recent (to me, anyway) way to do good failover using SLAs. http://www.nil.com/ipcorner/SmallSiteMultiHoming/ I assume however, that we are still back to needing another interface with Provider B's IP on the 2811. That adds complexities regarding their already very complex NAT configuration...it has static port and other maps all over the place that all go to the existing FE1. I think we're back to having a simple device to negotiate when Provider A is down to re-route to provider B...the question is which side to put it on. On Tue, 6 Apr 2010, Henry Yen wrote: > Why not just move the CPE-B router to the same segment as CPE-A, and then > let the 2811 do the "hard" work? > > CPE-A CPE-B > | | > +--------------+ > | > 2811 > | > --- i n t e r n a l --- > > Now you don't need to switch default gateways for your internal network, > either. Or, is there something more complex you need to do? > > On Mon, Apr 05, 2010 at 16:31:20PM -0400, James Smallacombe wrote: >> >> Spot on. >> >> On Mon, 5 Apr 2010, Brian Johnson wrote: >> >>> OK... is this a correct diagram? >>> >>> >>> +-----------+ +------------+ >>> | 2811 RTR |-PAT----->| CPE-RTR A | >>> +-----------+ +------------+ >>> | 192.168.7.1/21 >>> | >>> /---\ +-----------+ >>> | LAN |-------------| CPE-RTR B |--PAT--> >>> \---/ +-----------+ >>> | 192.168.7.10/21 >>> | >>> | 192.168.7.x/21 >>> +--------+ >>> | CLIENT | >>> +--------+ >>> >>> >>> - Brian >>> >>> >>>> -----Original Message----- >>>> From: [email protected] [mailto:list-bounces@inet- >>>> access.net] On Behalf Of James Smallacombe >>>> Sent: Monday, April 05, 2010 2:00 PM >>>> To: [email protected] >>>> Subject: RE: Simple route/gateway forwarding >>>> >>>> On Mon, 5 Apr 2010, Brian Johnson wrote: >>>> >>>>> What you are trying to do is definitely possible. How you are >>> stating >>>>> this makes my head hurt. :) >>>> >>>> Sorry...I can see how it looks super-complex, but in reality, it's not >>>> too >>>> bad. >>>> >>>>> You have a LAN using the 192.168.7.0/24 network. This network has >>> two >>>> >>>> Actually, it's using 192.168.0.0/21. Nothing in there is actually >>>> subnetted out, although, for example, 192.168.7.x is set aside for >>>> network >>>> equipment and 192.168.3.x is set aside for workstations, etc. >>>> >>>>> externally facing routers and one internally facing router. The >>>>> internally facing router uses NAP (do you mean PAT, overloaded NAT?) >>>> and >>>> >>>> Yes, like most NAT implementations like this, it is overloaded, not >>>> 1-to-1. >>>> >>>>> uses the 192.168.0.0/21 network internally. >>>>> >>>>> +------------+ +------------+ >>>>> | Provider A | | Provider B | >>>>> +------------+ +------------+ >>>>> | | >>>>> +-----------+ +-----------+ >>>>> | CPE-RTR A | | CPE-RTR B | >>>>> +-----------+ +-----------+ >>>>> 192.168.7.1/24 \ / 192.168.7.10/24 >>>>> \ / >>>> >>>> In the case of provider A, there is no customer access to their CPE >>>> router >>>> and it is not doing NAT. NAT is being performed by the customer's >>>> 2811. >>>> RFC 1918 to the internal Ether and provider A's "real" /26 on the >>>> external >>>> Ether. Provider B's Netgear is on the same LAN as the 2811's internal >>>> Ether and performing NAT to B's upstream network. We DO have access >>> to >>>> this B's Netgear. I gave it 192.168.7.10/21 while the 2811 bas >>>> 192.168.7.1/21. >>>> >>>>> +------------+ >>>>> | LAN SWITCH | >>>>> +------------+ >>>>> | >>>>> | 192.168.7.2/24 >>>>> +----------+ / ip route 0.0.0.0 >>>> 0.0.0.0 >>>>> 192.168.7.1 >>>> >>>> This is a little off. 192.168.7.1/21 is on the 2811's internal Etherm >>>> while a real IP is on the external interface. The Cisco has >>>> >>>> ip route 0.0.0.0 0.0.0.0 real.ip.of.A's.CPE.router >>>> >>>>> | 2811 RTR | NAT/PAT <--< ip route 192.168.3.240 >>>>> 255.255.255.255 192.168.7.10 >>>>> +----------+ \ >>>> >>>> That looks correct, above. >>>> >>>>> | 192.168.0.1/21 >>>> >>>> You mean the 192.168.0.0/21 network above, right? >>>> >>>>> If this diagram is correct, and the CPE routers are configured >>>>> correctly, then packets bound for 192.168.3.240 WILL be forwarded to >>>>> 192.168.7.10. What that router does with it is another question all >>>>> together. >>>>> >>>>> Do you have access to the CPE routers? Are you using a routing >>>> protocol >>>>> or just static routes? You are dealing with all private IP addresses >>>> in >>>>> your example. Are they really all private IP addresses or are there >>>> some >>>>> public addresses in here? >>>> >>>> Just static routes. Want to avoid RIP and the Netgear doesn't do >>> OSPF. >>>> >>>>> - Brian >>>>> >>>>>> -----Original Message----- >>>>>> From: [email protected] [mailto:list-bounces@inet- >>>>>> access.net] On Behalf Of James Smallacombe >>>>>> Sent: Monday, April 05, 2010 9:33 AM >>>>>> To: Inet-Access Mailing List >>>>>> Subject: Simple route/gateway forwarding >>>>>> >>>>>> >>>>>> This is really basic, but since I've never tried it before (and >>> it's >>>>>> not >>>>>> working), I want to see if it's possible, one way or another: >>>>>> >>>>>> customer has a network hooked up to provider A using provider's CPE >>>>>> router. They also have a 2811 doing NAT, which is the default >>>> gateway >>>>>> for >>>>>> the NAT'd network 192.168.0.0/21. The 2811 then has a default >>> route >>>>> to >>>>>> the CPE router and a typical "internal" Ethernet on 192.168.7.1 and >>>> an >>>>>> "external" Ethernet on Provider A's static IPs. >>>>>> >>>>>> To this, they add a second connection, a business broadband >>>> connection >>>>>> using a typical broadband router (NetGear, I believe) to provider >>> B. >>>>>> They know their provider A static IPs, won't route through provider >>>>> B's >>>>>> network, but certainly the NATed 192.168. network will. I stick >>> the >>>>>> Netgear on the same Ether as the 2811's internal interface and give >>>> it >>>>>> 192.168.7.10. All workstations use a default gateway of >>>> 192.168.7.1. >>>>>> The >>>>>> idea is to be able to switch them over to 192.168.7.10 without >>>> having >>>>>> to >>>>>> change their settings, by just re-routing some networks on the >>> Cisco >>>>> to >>>>>> provider B. I tried this as a test: >>>>>> >>>>>> ip route 192.168.3.240 255.255.255.255 192.168.7.10 >>>>>> >>>>>> Similar to a ppp /32 route. However, all traffic from >>> 192.168.3.240 >>>>>> still >>>>>> goes out the default route to provider A via the default route. Is >>>>>> there >>>>>> a way to make this work without subnetting 192.168.3.0 and putting >>>>>> aliases >>>>>> of it on one or both routers? >>>>>> >>>>>> James Smallacombe PlantageNet, Inc. CEO and Janitor >>>>>> [email protected] >>>>> http://3.am >>>>>> >>>>> >>>> >>> ======================================================================= >>>>>> == >>>>>> -- >>>>>> Eat sushi frequently. - Avi >>>>>> [email protected] is the human contact address. >>>>>> [email protected] is the list posting address. >>>>>> See below URL for subscribe/unsubscribe and list options: >>>>>> http://inet-access.net/mailman/listinfo/list >>>>> >>>>> CONFIDENTIALITY NOTICE: This email message, including any >>>> attachments, is for the sole use of the >>>>> intended recipient(s) and may contain confidential and privileged >>>> information. Any unauthorized review, >>>>> copying, use, disclosure, or distribution is prohibited. If you are >>>> not the intended recipient, please >>>>> contact the sender by reply e-mail and destroy all copies of the >>>> original message. Thank you. >>>>> -- >>>>> Eat sushi frequently. - Avi >>>>> [email protected] is the human contact address. >>>>> [email protected] is the list posting address. >>>>> See below URL for subscribe/unsubscribe and list options: >>>>> http://inet-access.net/mailman/listinfo/list >>>>> >>>> >>>> James Smallacombe PlantageNet, Inc. CEO and Janitor >>>> [email protected] >>> http://3.am >>>> >>> ======================================================================= >>>> == >>>> -- >>>> Eat sushi frequently. - Avi >>>> [email protected] is the human contact address. >>>> [email protected] is the list posting address. >>>> See below URL for subscribe/unsubscribe and list options: >>>> http://inet-access.net/mailman/listinfo/list >>> -- >>> Eat sushi frequently. - Avi >>> [email protected] is the human contact address. >>> [email protected] is the list posting address. >>> See below URL for subscribe/unsubscribe and list options: >>> http://inet-access.net/mailman/listinfo/list >>> >> >> James Smallacombe PlantageNet, Inc. CEO and Janitor >> [email protected] http://3.am >> ========================================================================= >> -- >> Eat sushi frequently. - Avi >> [email protected] is the human contact address. >> [email protected] is the list posting address. >> See below URL for subscribe/unsubscribe and list options: >> http://inet-access.net/mailman/listinfo/list > > -- > Henry Yen Aegis Information Systems, Inc. > Senior Systems Programmer Hicksville, New York > -- > Eat sushi frequently. - Avi > [email protected] is the human contact address. > [email protected] is the list posting address. > See below URL for subscribe/unsubscribe and list options: > http://inet-access.net/mailman/listinfo/list > James Smallacombe PlantageNet, Inc. CEO and Janitor [email protected] http://3.am ========================================================================= -- Eat sushi frequently. - Avi [email protected] is the human contact address. [email protected] is the list posting address. See below URL for subscribe/unsubscribe and list options: http://inet-access.net/mailman/listinfo/list