RE: Simple route/gateway forwarding
"Brian Johnson" <[email protected]> Tue, 6 Apr 2010 20:06:45 -0500
| Newsgroups | gmane.org.operators.internet-access |
|---|---|
| Message-ID | <[email protected]> |
Another option would be to use sub-interfaces and dot1q. then plug the outside interface into a trunk port on a vlan aware switch and plug provider a into a vlan A access port and plug provider B into a vlan B access port. - Brian > -----Original Message----- > From: [email protected] [mailto:list-bounces@inet- > access.net] On Behalf Of James Smallacombe > Sent: Tuesday, April 06, 2010 4:30 PM > To: [email protected] > Subject: Re: Simple route/gateway forwarding > > > For that to work, they'd need another FastEther interface in the 2811. > The reason is because the internal 2811 Ether NATs 192.168 in to a > Provider A IP out on the External Ether. Obviously, Provider B won't > route Provider A's IP. IOS won't NAT to a secondary IP, AFAIK. > > I just noticed that Cisco has a fairly recent (to me, anyway) way to do > good failover using SLAs. > > http://www.nil.com/ipcorner/SmallSiteMultiHoming/ > > I assume however, that we are still back to needing another interface > with > Provider B's IP on the 2811. That adds complexities regarding their > already very complex NAT configuration...it has static port and other > maps > all over the place that all go to the existing FE1. > > I think we're back to having a simple device to negotiate when Provider > A > is down to re-route to provider B...the question is which side to put > it > on. > > On Tue, 6 Apr 2010, Henry Yen wrote: > > > Why not just move the CPE-B router to the same segment as CPE-A, and > then > > let the 2811 do the "hard" work? > > > > CPE-A CPE-B > > | | > > +--------------+ > > | > > 2811 > > | > > --- i n t e r n a l --- > > > > Now you don't need to switch default gateways for your internal > network, > > either. Or, is there something more complex you need to do? > > > > On Mon, Apr 05, 2010 at 16:31:20PM -0400, James Smallacombe wrote: > >> > >> Spot on. > >> > >> On Mon, 5 Apr 2010, Brian Johnson wrote: > >> > >>> OK... is this a correct diagram? > >>> > >>> > >>> +-----------+ +------------+ > >>> | 2811 RTR |-PAT----->| CPE-RTR A | > >>> +-----------+ +------------+ > >>> | 192.168.7.1/21 > >>> | > >>> /---\ +-----------+ > >>> | LAN |-------------| CPE-RTR B |--PAT--> > >>> \---/ +-----------+ > >>> | 192.168.7.10/21 > >>> | > >>> | 192.168.7.x/21 > >>> +--------+ > >>> | CLIENT | > >>> +--------+ > >>> > >>> > >>> - Brian > >>> > >>> > >>>> -----Original Message----- > >>>> From: [email protected] [mailto:list-bounces@inet- > >>>> access.net] On Behalf Of James Smallacombe > >>>> Sent: Monday, April 05, 2010 2:00 PM > >>>> To: [email protected] > >>>> Subject: RE: Simple route/gateway forwarding > >>>> > >>>> On Mon, 5 Apr 2010, Brian Johnson wrote: > >>>> > >>>>> What you are trying to do is definitely possible. How you are > >>> stating > >>>>> this makes my head hurt. :) > >>>> > >>>> Sorry...I can see how it looks super-complex, but in reality, it's > not > >>>> too > >>>> bad. > >>>> > >>>>> You have a LAN using the 192.168.7.0/24 network. This network has > >>> two > >>>> > >>>> Actually, it's using 192.168.0.0/21. Nothing in there is actually > >>>> subnetted out, although, for example, 192.168.7.x is set aside for > >>>> network > >>>> equipment and 192.168.3.x is set aside for workstations, etc. > >>>> > >>>>> externally facing routers and one internally facing router. The > >>>>> internally facing router uses NAP (do you mean PAT, overloaded > NAT?) > >>>> and > >>>> > >>>> Yes, like most NAT implementations like this, it is overloaded, > not > >>>> 1-to-1. > >>>> > >>>>> uses the 192.168.0.0/21 network internally. > >>>>> > >>>>> +------------+ +------------+ > >>>>> | Provider A | | Provider B | > >>>>> +------------+ +------------+ > >>>>> | | > >>>>> +-----------+ +-----------+ > >>>>> | CPE-RTR A | | CPE-RTR B | > >>>>> +-----------+ +-----------+ > >>>>> 192.168.7.1/24 \ / 192.168.7.10/24 > >>>>> \ / > >>>> > >>>> In the case of provider A, there is no customer access to their > CPE > >>>> router > >>>> and it is not doing NAT. NAT is being performed by the customer's > >>>> 2811. > >>>> RFC 1918 to the internal Ether and provider A's "real" /26 on the > >>>> external > >>>> Ether. Provider B's Netgear is on the same LAN as the 2811's > internal > >>>> Ether and performing NAT to B's upstream network. We DO have > access > >>> to > >>>> this B's Netgear. I gave it 192.168.7.10/21 while the 2811 bas > >>>> 192.168.7.1/21. > >>>> > >>>>> +------------+ > >>>>> | LAN SWITCH | > >>>>> +------------+ > >>>>> | > >>>>> | 192.168.7.2/24 > >>>>> +----------+ / ip route 0.0.0.0 > >>>> 0.0.0.0 > >>>>> 192.168.7.1 > >>>> > >>>> This is a little off. 192.168.7.1/21 is on the 2811's internal > Etherm > >>>> while a real IP is on the external interface. The Cisco has > >>>> > >>>> ip route 0.0.0.0 0.0.0.0 real.ip.of.A's.CPE.router > >>>> > >>>>> | 2811 RTR | NAT/PAT <--< ip route > 192.168.3.240 > >>>>> 255.255.255.255 192.168.7.10 > >>>>> +----------+ \ > >>>> > >>>> That looks correct, above. > >>>> > >>>>> | 192.168.0.1/21 > >>>> > >>>> You mean the 192.168.0.0/21 network above, right? > >>>> > >>>>> If this diagram is correct, and the CPE routers are configured > >>>>> correctly, then packets bound for 192.168.3.240 WILL be forwarded > to > >>>>> 192.168.7.10. What that router does with it is another question > all > >>>>> together. > >>>>> > >>>>> Do you have access to the CPE routers? Are you using a routing > >>>> protocol > >>>>> or just static routes? You are dealing with all private IP > addresses > >>>> in > >>>>> your example. Are they really all private IP addresses or are > there > >>>> some > >>>>> public addresses in here? > >>>> > >>>> Just static routes. Want to avoid RIP and the Netgear doesn't do > >>> OSPF. > >>>> > >>>>> - Brian > >>>>> > >>>>>> -----Original Message----- > >>>>>> From: [email protected] [mailto:list-bounces@inet- > >>>>>> access.net] On Behalf Of James Smallacombe > >>>>>> Sent: Monday, April 05, 2010 9:33 AM > >>>>>> To: Inet-Access Mailing List > >>>>>> Subject: Simple route/gateway forwarding > >>>>>> > >>>>>> > >>>>>> This is really basic, but since I've never tried it before (and > >>> it's > >>>>>> not > >>>>>> working), I want to see if it's possible, one way or another: > >>>>>> > >>>>>> customer has a network hooked up to provider A using provider's > CPE > >>>>>> router. They also have a 2811 doing NAT, which is the default > >>>> gateway > >>>>>> for > >>>>>> the NAT'd network 192.168.0.0/21. The 2811 then has a default > >>> route > >>>>> to > >>>>>> the CPE router and a typical "internal" Ethernet on 192.168.7.1 > and > >>>> an > >>>>>> "external" Ethernet on Provider A's static IPs. > >>>>>> > >>>>>> To this, they add a second connection, a business broadband > >>>> connection > >>>>>> using a typical broadband router (NetGear, I believe) to > provider > >>> B. > >>>>>> They know their provider A static IPs, won't route through > provider > >>>>> B's > >>>>>> network, but certainly the NATed 192.168. network will. I stick > >>> the > >>>>>> Netgear on the same Ether as the 2811's internal interface and > give > >>>> it > >>>>>> 192.168.7.10. All workstations use a default gateway of > >>>> 192.168.7.1. > >>>>>> The > >>>>>> idea is to be able to switch them over to 192.168.7.10 without > >>>> having > >>>>>> to > >>>>>> change their settings, by just re-routing some networks on the > >>> Cisco > >>>>> to > >>>>>> provider B. I tried this as a test: > >>>>>> > >>>>>> ip route 192.168.3.240 255.255.255.255 192.168.7.10 > >>>>>> > >>>>>> Similar to a ppp /32 route. However, all traffic from > >>> 192.168.3.240 > >>>>>> still > >>>>>> goes out the default route to provider A via the default route. > Is > >>>>>> there > >>>>>> a way to make this work without subnetting 192.168.3.0 and > putting > >>>>>> aliases > >>>>>> of it on one or both routers? > >>>>>> > >>>>>> James Smallacombe PlantageNet, Inc. CEO and > Janitor > >>>>>> [email protected] > >>>>> http://3.am > >>>>>> > >>>>> > >>>> > >>> > ======================================================================= > >>>>>> == > >>>>>> -- > >>>>>> Eat sushi frequently. - Avi > >>>>>> [email protected] is the human contact address. > >>>>>> [email protected] is the list posting address. > >>>>>> See below URL for subscribe/unsubscribe and list options: > >>>>>> http://inet-access.net/mailman/listinfo/list > >>>>> > >>>>> CONFIDENTIALITY NOTICE: This email message, including any > >>>> attachments, is for the sole use of the > >>>>> intended recipient(s) and may contain confidential and privileged > >>>> information. Any unauthorized review, > >>>>> copying, use, disclosure, or distribution is prohibited. If you > are > >>>> not the intended recipient, please > >>>>> contact the sender by reply e-mail and destroy all copies of the > >>>> original message. Thank you. > >>>>> -- > >>>>> Eat sushi frequently. - Avi > >>>>> [email protected] is the human contact address. > >>>>> [email protected] is the list posting address. > >>>>> See below URL for subscribe/unsubscribe and list options: > >>>>> http://inet-access.net/mailman/listinfo/list > >>>>> > >>>> > >>>> James Smallacombe PlantageNet, Inc. CEO and Janitor > >>>> [email protected] > >>> http://3.am > >>>> > >>> > ======================================================================= > >>>> == > >>>> -- > >>>> Eat sushi frequently. - Avi > >>>> [email protected] is the human contact address. > >>>> [email protected] is the list posting address. > >>>> See below URL for subscribe/unsubscribe and list options: > >>>> http://inet-access.net/mailman/listinfo/list > >>> -- > >>> Eat sushi frequently. - Avi > >>> [email protected] is the human contact address. > >>> [email protected] is the list posting address. > >>> See below URL for subscribe/unsubscribe and list options: > >>> http://inet-access.net/mailman/listinfo/list > >>> > >> > >> James Smallacombe PlantageNet, Inc. CEO and Janitor > >> [email protected] http://3.am > >> > ======================================================================= > == > >> -- > >> Eat sushi frequently. - Avi > >> [email protected] is the human contact address. > >> [email protected] is the list posting address. > >> See below URL for subscribe/unsubscribe and list options: > >> http://inet-access.net/mailman/listinfo/list > > > > -- > > Henry Yen Aegis Information > Systems, Inc. > > Senior Systems Programmer Hicksville, New York > > -- > > Eat sushi frequently. - Avi > > [email protected] is the human contact address. > > [email protected] is the list posting address. > > See below URL for subscribe/unsubscribe and list options: > > http://inet-access.net/mailman/listinfo/list > > > > James Smallacombe PlantageNet, Inc. CEO and Janitor > [email protected] http://3.am > ======================================================================= > == > -- > Eat sushi frequently. - Avi > [email protected] is the human contact address. > [email protected] is the list posting address. > See below URL for subscribe/unsubscribe and list options: > http://inet-access.net/mailman/listinfo/list -- Eat sushi frequently. - Avi [email protected] is the human contact address. [email protected] is the list posting address. See below URL for subscribe/unsubscribe and list options: http://inet-access.net/mailman/listinfo/list