05-12-2007 04:44 AM - edited 03-03-2019 04:57 PM
Hello,
I try ton configure one 878 Cisco router as a transparent router behind a dualwan Linksys router.
I've added these in the configuration of the 878 :
no ip routing
!
interface Vlan1
no ip address
no ip directed-broadcast
bridge-group 1
!
interface ATM0.1
no ip address
no ip directed-broadcast
pvc 8/35
encapsulation aal5snap
!
bridge-group 1
!
ip classless
!
bridge 1 protocol ieee
In the dualwan router, I've set the interface to auto-ip. But this interface never gets the SDSL public ip address.
What is going wrong?
Thanks in advance for help,
Kind regards,
Guy
05-12-2007 06:20 AM
Hi,
change the atm like this:
int atm0.1
no pvc 8/35
no bridge-group 1
int atm 0/1.1 point-to-point
pvc 8/35
bridge-group 1
encapsulation aal5snap
You can also give the router an IP addres if you configure "ip routing", "bridge irb", and "interface bvi1".
Can I ask you why do you need the linksys router at all ? The 878 has many ports and can probably do all what the linksys does.
05-12-2007 11:25 PM
Thank for your help.
The command int atm 0/1.1 point-to-point was refused at char /. I replace it by int atm 0.1 point-to-point. Is it right ? The encapsulation aal5snap then gives also an error. What is going wrong ?
Answer to your 2nd question : We intend to install a dualwan configuration, with use of a specific interface for specific port (ex. SMTP always to interface 1) Our ISP (easynet.be) promised to help us configure this router, but they now drop us.
Guy
05-12-2007 11:30 PM
Hi,
As Paolo said, but i think that the bridge group should be under the interface:
interface atm 0.1 point-to-point
bridge-group 1
pvc 8/35
encapsulation aal5snap
Make sure that you are entering the "encapsulation aal5snap" under the PVC.
HTH,
Mohammed Mahmoud.
05-13-2007 12:11 AM
Under the PVC the command succeed. But the bridge still refuses to work. I've reloaded the default config from my ISP and added these commands :
no ip routing
!
interface Vlan1
no ip address
no ip directed-broadcast
bridge-group 1
!
interface atm 0.1 point-to-point
no ip address
no ip directed-broadcast
bridge-group 1
!
interface atm 0.1 point-to-point
pvc 8/35
encapsulation aal5snap
!
ip classless
!
bridge 1 protocol ieee
but it is still down.
Any solution ?
Guy
05-13-2007 12:18 AM
Hi,
I've tested it and it worked fine:
interface atm 0.1 point-to-point
bridge-group 1
bridge-group 1 spanning-disabled
pvc 8/35
encapsulation aal5snap
Please make sure that it is done as above.
HTH,
Mohammed Mahmoud.
05-13-2007 12:37 AM
How is possible to verify that the bridge is OK ?
Could it be that the ISP check the MAC-Adress ? Do i have to clone the mac address in the dualwan router ?
Here is the full config. Perhaps something else conflicting ?
version 12.3
no service pad
service timestamps debug datetime localtime show-timezone
service timestamps log datetime localtime show-timezone
service password-encryption
service linenumber
service sequence-numbers
!
hostname ineo-21029
!
boot-start-marker
boot-end-marker
!
no logging buffered
enable secret 5 ...
!
username ...
username ...
username ...
aaa new-model
!
!
aaa authentication login default local
aaa authorization exec default local
aaa session-id common
ip subnet-zero
no ip routing
no ip cef
no ip dhcp use class
!
!
ip name-server 212.x.x.51
ip name-server 212.x.x.52
ip port-map ms-sql port 1433
no ftp-server write-enable
isdn switch-type basic-net3
!
!
!
!
controller DSL 0
mode atm
line-term cpe
line-mode 2-wire line-zero
dsl-mode shdsl symmetric annex B
line-rate auto
!
!
!
!
interface BRI0
no ip address
no ip route-cache
shutdown
isdn switch-type basic-net3
!
interface ATM0
description === to PE/Router ====
no ip address
ip accounting output-packets
no ip route-cache
load-interval 30
no atm ilmi-keepalive
!
interface ATM0.1 point-to-point
description $ES_WAN$
no ip route-cache
pvc 8/35
oam-pvc manage 5
oam-pvc manage cc end direction both
oam retry 3 3 1
oam retry cc end 3 3 30
encapsulation aal5snap
!
bridge-group 1
bridge-group 1 spanning-disabled
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface Vlan1
description $FW_INSIDE$
no ip address
ip nat inside
ip virtual-reassembly
no ip route-cache
bridge-group 1
!
interface Dialer1
description $FW_OUTSIDE$
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
no ip route-cache
dialer pool 1
dialer-group 1
no cdp enable
ppp chap hostname ineo-21029@ull.easynet.be
ppp chap password xxx
ppp pap sent-username ineo-21029@ull.easynet.be password 7 ....
!
ip classless
!
ip http server
no ip http secure-server
!
access-list 113 remark ... VTY access restriction ...
access-list 113 remark SDM_ACL Category=17
access-list 113 permit ip 212.x.x.0 0.0.0.255 any
access-list 113 permit ip host 207.162.193.254 any
access-list 113 permit ip host 212.100.160.37 any
access-list 113 permit ip 192.168.2.0 0.0.0.255 any
access-list 113 deny ip any any
dialer-list 1 protocol ip permit
!
control-plane
!
bridge 1 protocol ieee
banner login ^CINEO SDSL router.
Any intrusion will be prosecuted.^C
!
line con 0
exec-timeout 120 0
no modem enable
transport preferred all
transport output all
stopbits 1
line aux 0
transport preferred all
transport output all
line vty 0 4
access-class 113 in
exec-timeout 0 0
transport preferred all
transport input all
transport output all
!
scheduler max-task-time 5000
end
05-13-2007 03:42 AM
Hi,
the configuration seems right. You can do "show interfaces", "show bridge-group 1" to check the router is passing packets. There is no need for MAC cloning, as the router in this case is passing them unchanged already. Also do "show controllers" and "show atm pvc" to check on these things.
It seems like the ISP does PPPoE, why don't you terminate that on the 877 with NAT? Then you can do more or less do what you wanted, with static NAT configuration.
05-13-2007 04:17 AM
The original config of the ISP was
interface ATM0
description === to PE/Router ====
no ip address
ip accounting output-packets
load-interval 30
no atm ilmi-keepalive
!
interface ATM0.1 point-to-point
description $ES_WAN$
pvc 8/35
oam-pvc manage 5
oam-pvc manage cc end direction both
oam retry 3 3 1
oam retry cc end 3 3 30
encapsulation aal5mux ppp dialer
dialer pool-member 1
I think it says the ISP does PPPoA and not PPPoE. Is it right ?
In the bridge config, should i use "encapsulation aal5snap" or "encapsulation aal5mux ppp dialer" ?
Guy
05-13-2007 04:38 AM
Hi,
Yes from the configuration above it appears that ISP is using PPPoA and not PPPoE. Does this configuration work ?
The thing is that you cannot bridge PPPoA to the ethernet, it must be terminated in the router, as the configuration you was given indicates.
You can probably have things working terminating the PPP in the 877 and doing NAT there as I was saying before, else ask the ISP to change encapsulation to rfc1481, if you want to bridge to the LAN (I would not reecomend this as you would need another router anyway).
05-13-2007 06:05 AM
Yes, i do confirm that de 878 acting as a router with the PPPoA config works fines.
The problem with NAT is that we try to use de 878 behind a dualwan Linksys router. I think that dual NAT (NAT in the Cisco + NAT in the Linksys) should not work.
Any suggestion is welcome,
Guy
05-13-2007 06:09 AM
How many subnets the provider gave you? if you have one separated for LAN, you do not even need NAT.
Dual-nat may even work, but you will need to configure some static mapping on the 877 just like you do port forwarding on the linksys.
However the best would be you do NAT /FW and everything on the 877, and connect you systems directly there. Again you would need static mappings per above. But, you will also be able to configure QoS for the upload direction, and many more advanced things that only a cisco router does.
05-13-2007 06:28 AM
Our provider gives us only one public IP. That's all.
Before trying to configure the 878 as a bridge, we tried dual nat : port forwarding from the public ip to the internal interface of the 878. Then, port forwarding from the wan interface of the Linksys to the private network. But this does not work.
That'a why we try to transform 878 as a transparent router. Everything on the wan should be forwarded to the inside interface, and vice versa.
Any suggestion is welcome,
Guy
05-13-2007 07:22 AM
Hi,
The problem is that PPPoA does not carry ethernet addresses, necessary to be bridged. So you must terminate it in the 877.
For dual-nat to work correctly, you must forward to the address of linksys, not to router internal interface. First of course verify that you can navigate from behind linksys as well.
Still not clear to me what prevents you from connecting directly to the 877 and not using the linksys.
05-13-2007 08:19 AM
When i tried dualnat, the nat in the 877 was correctly set up from de wan interface to the wan1 interface of the Linksys. But unfortunately, it never works.
Why do we want to use 2 router ?
- we want to use 3 routers in order to implement a backup line.
- the 878 is "too difficult" for us. Our ISP does not help us anymore. The idea is to manage the Linkys but not the 878 once it is configured as transparent.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: