How to setup firewall on IP Unnumbered interface?

[kmigmar805]

Hello Experts,

I would like to ask you a favor. I am having a trouble finding a manual or guide on how to setup a firewall on an IP Unnumbered interface for Cisco 2900  series router. Please help.

Thank you very much in advance!

Our router setup is as follows:

======================

ISP

|

|

-----------------------

Interface e0/0 - (IP Unnumbered using PPPoE )

Interface e0/1 – ( this address is shared by the IP unnumbered interface to dial to ISP)

-----------------------

Interface e0/2 – used for router management only purpose.

[Peter Paluch · Accepted solution]

Hello Ken,

If you are using PPPoE to access the internet then I suppose you have also created and configured the Dialer interface. In this case, it is the Dialer interface that processes the IP traffic sent via the PPPoE session, so simply configure the firewall on the corresponding Dialer interface. Do not place any firewall on the Ethernet interface - it would not have any effect because the IP traffic is not encapsulated directly into Ethernet frames.

Please note that the IP Unnumbered is something different from an interface that simply has no IP address configured. If an interface is configured without any IP address (i.e., the command no ip address is present in its configuration) then this interface is disabled for pure IP protocol. IP packets arriving at this interface are dropped without any processing, and such interface does not send any IP packets itself. The Ethernet interface on which only a PPPoE is configured without any IP address is IP-disabled, not IP Unnumbered.

On the other hand, the IP Unnumbered is a special feature that allows several interfaces to share the same IP address using the command ip unnumbered . In this case, interface configured using this command has the same IP address and mask as the other interface that is referenced by that command. This technique is used to conserve IP addresses.

Best regards,

Peter

[kmigmar805]

THANK YOU so much! All clear now. You made my day, man!

[kmigmar805]

Sorry, another question:

I tested two ways of firewall zone setup on the Router 1 Cisco 2911 IOS based Firewall:

A.

Outside zone member: 1. interface e0/0 ( Dialer0 )

Inside zone member: e0/1

Then there is no  connection to internet even if all Access rules from inside to outside are all set to Allow. No other ACL is associated with the any of the interfaces.

B.

Outside zone members: 1. interface e0/0 ( Dialer0 ) and 2. interface e0/1 

Inside zone member: e0/3 (management only)

Internet connection is Ok. But this setup is the same as having no firewall, isn't it?

Please advice me how it should be properly setup.

Thank you!

[Peter Paluch]

Ken,

You are welcome. Please, post your current configuration if it is possible. It is easier to start from there.

Best regards,

Peter