cisco router question

[ke6guj]

I've got a cisco 1760 router that we were running with the firewall feature turned on. I need to reconfig the router so that it is only a router and we will be running a separate firewall.

The ISP provides us with a /30 network and a /28 network for the 13 usable IP addresses. Originally, the router was set up with the /30 on the WAN side of the router and 192.168.2.0/24 as the LAN side. We were using ip nat pool and ip nat inside source to use those /28 addresses on the LAN.

I now want to just set up the LAN side of the router with a /28 address directly and then point the WAN side of the new firewall to that address.

at the same time I'll strip out

I'm assuming I can go from this:

interface FastEthernet0/0
description connected to EthernetLAN
ip address 192.168.2.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip policy route-map rmap
speed auto
!
interface Serial0/0:1
description For Telmex
bandwidth 2048
ip address y.y.y.125 255.255.255.252
ip access-group filterin in
ip access-group filterout out
ip nat outside
ip inspect sipphone in
ip inspect sipphone out
ip virtual-reassembly
service-policy output AutoQoS-Policy-UnTrust
auto qos voip
!

router rip
version 2
passive-interface Serial0/0:1
network 192.168.2.0
no auto-summary

!
ip nat pool telmex x.x.x.161 201.x.x.x..161 netmask 255.255.255.240
ip nat inside source route-map nonat pool telmex overload
ip nat inside source static 192.168.2.10 x.x.x.163
ip nat inside source static 192.168.2.11 x.x.x.164

to something like this, removing all the NAT commands, autoQOS, etc. basically going to be able to clean out a lot of obsolete configuration stuff, including old VPN tunnels, FXS/FXO cards, etc.

interface FastEthernet0/0
description connected to EthernetLAN
ip address x.x.x.161 255.255.255.240
ip virtual-reassembly
speed auto
!
interface Serial0/0:1
description For Telmex
bandwidth 2048
ip address y.y.y.125 255.255.255.252
ip virtual-reassembly

and then have the firewall with x.x.x.162 for its WAN address. the firewall's LAN address would be the 192.168.2.1. The firewall would then be able to NAT forward .163-174 to the internal servers as needed, correct? I'm already using ASA's at some of my other locations, so programming the firewall isn't too much of an issue, just need to make sure the router is set up right.

I'm pretty sure I understand it, but when I have to take a flight to Mexico to work on this, I don't have much time to troubleshoot. at least I still have internet access through my MPLS network if I need to google anything.

[jmlivingston]

You don't need the ip virtual-reassembly under the interfaces, that was put in their to support the nat statements. Not sure what your route-map named "rmap"on the Fa0/0 interface is doing, so be cautious with that.

[ke6guj]

cool, thanks. I didnt' think I needed the virtual-reassembly, but wan't sure.

and no problem on the rmap route-map, that is a left over from when we were doing point to point VPN on the router. That's gone so all this router needs to do is just route, no VPN, no firewall, no NAT.

[ke6guj]

this worked out great. I thought it would but just reassurances that I wasn't going at it wrong. thanks.

[Jason95357]

Glad it worked out. That was the "cleanest" way, but there is a hack you could have done to get the "most" public IPs to your ASA:

Change the segment from the router to ASA to 192.168.255.x. Then simply tell the router to route x.x.x.161 255.255.255.240 to the ASA's external 192.168.255.x address. Then you'd get all 16 addresses available for NAT and not lose 4 address to the router, ASA, network and broadcast.

Additionally, you could have the router NAT the ASA's 192.168.255.x address behind your router's address WAN. This gives you 16 total addresses available for NAT at the ASA and the ASA's NAT'd address available for PAT at the ASA.

You probably don't need all the addresses anyway, but if you ever did need more and your ISP won't give you any more, that's a cool hack to have in your back pocket.

[ke6guj]

yah, I should never need all 16 addresses in this case, but I will keep that info in my pocket if there is a time when that does become an issue.

thanks for the info.