cisco 837 config with 5 static ip's

[stevehutton]

Hi Everyone,

I'm hopeing that someone has come up against this issue before as I think that it would be a common problem.  

I got BT business broadband with 5 static IP addresses to find out that the 2 wire router supplied does not do one-to-one NAT, meaning that each public IP address is mapped to a separate private ip address with numerous days taking to BT support on the phone I found out that the router was the problem as it did not provide the functionality to do this.  So I spoke to someone I know and he suggested that I should get a cisco 837 as this would do everything I want and it nearly does.  

I am currently NATing 2 public IP addresses to separate private IP addresses and everything appeared to be working from the outside, however I have recently noticed there is a major flaw in this configuration as one of the servers is a small business server 2008 and it needs to send email to a third party mail filter and I have only just realised that the IP address that is being presented to the outside world is a DHCP assigned IP address that is assigned to the dialer when the router negotiates it's IP address.  I have spent countless hours trying to configure the router to connect differently and trying to force the router to use the static IP address that was supposidly the IP address of the router however this does not work and it seems that I need to use the  ip address negotiated command instead of manually assigning the IP address to this interface.

Now with this configuration all 5 public IP addresses can be acccessed including the routers IP address and the 5 public ip addresses can also all be NAT' but I need to make the traffic appear to come from a single IP address or even one of my public ip addresses as I it will be totally impossible to have a proper mailserver running if the originating IP address that is presented to everyone on connection is the assigned IP address on the DIALER 0 interface which is going to change and insidentally is not the supposid(IP address of the router).

I have tried asking BT to make the address the dialer gets via [ip address negotiated] static unable to get out of the loop of first line support to ITSM back to telephone support.

On the likes of an asa 5580 you can use the global nat command to ensure all your traffic is coming from the ip address of your choosing. Is there anything you can do on a cisco 837 to do this?

I really am shocked to find a company the size of BT who I know for a fact use a lot of cisco equipment far more advanced than a cisco 837 cannot provide the connection information to configure this router.

I am also annoyed at this because BT also sell cisco 837 router to small businesses as they also sell you 5 public IP addresses which are not properly useable with the supplied 2 wire router.

Anyway enough ranting! If you have any ideas who to contact in BT and what to ask for please help me out I have added the configuration of the router in the hope someone can spot something that would do it.

On a plus point this config will work as long as you don't plan on having a working email server 🙂

TIA

Steve 

Current configuration : 4707 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ******-router
!
boot-start-marker
boot-end-marker
!
enable secret 5 itsasecretpassword
!
aaa new-model
!
!
!
aaa session-id common
!
resource policy
!
ip dhcp excluded-address 10.100.0.254
!
!
ip cef
ip name-server 10.100.0.1
!
!
username admin privilege 15 password 0 ********
!
!
!
!
!
interface Ethernet0
 ip address 10.100.0.254 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
 hold-queue 100 out
!
interface Ethernet2
 no ip address
 shutdown
 hold-queue 100 out
!
interface ATM0
 ip address 81.142.ROU.TER 255.255.255.248
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no atm ilmi-keepalive
 dsl operating-mode auto
 pvc 0/38
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
!
interface FastEthernet1
 duplex auto
 speed auto
!
interface FastEthernet2
 duplex auto
 speed auto
!
interface FastEthernet3
 duplex auto
 speed auto
!
interface FastEthernet4
 duplex auto
 speed auto
!
interface Dialer0
 description $FW_OUTSIDE$
 ip address negotiated
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 no cdp enable
 ppp authentication chap callin
 ppp chap hostname B*******@hg**.btclick.com
 ppp chap password 0 *******

 ppp pap sent-username B*****@hg**.btclick.com password 0 *******

 ppp ipcp dns request
 ppp ipcp wins accept
 ppp ipcp mask request
 ppp ipcp route default
 ppp ipcp address accept
!
ip route profile
ip route 0.0.0.0 0.0.0.0 Dialer0
ip http server
ip http secure-server
!
ip nat inside source list 1 interface Dialer0 overload
ip nat inside source static tcp 10.100.0.1 25 81.142.aaa.aaa 25 extendable
ip nat inside source static tcp 10.100.0.1 80 81.142.aaa.aaa 80 extendable
ip nat inside source static tcp 10.100.0.1 443 81.142.aaa.aaa 443 extendable
ip nat inside source static tcp 10.100.0.1 987 81.142.aaa.aaa 987 extendable
ip nat inside source static tcp 10.100.0.1 1723 81.142.aaa.aaa 1723 extendable
ip nat inside source static tcp 10.100.0.1 3389 81.142.aaa.aaa 3389 extendable
ip nat inside source static tcp 10.100.0.9 22 81.142.bbb.bbb 22 extendable
ip nat inside source static tcp 10.100.0.9 25 81.142.bbb.bbb 25 extendable
ip nat inside source static tcp 10.100.0.9 80 81.142.bbb.bbb 80 extendable
ip nat inside source static tcp 10.100.0.9 443 81.142.bbb.bbb 443 extendable
!
access-list 1 permit 10.100.0.0 0.0.0.255
snmp-server community public RO
!
control-plane
!
!
line con 0
 no modem enable
line aux 0
line vty 0 4
 exec-timeout 120 0
 password ********
 length 0
!
scheduler max-task-time 5000
end

 

Message Edited by stevehutton on 01-04-2009 02:06 AM

[a-hill]

Hi Steve,

I can't really assist with the Cisco (not what you wanted to hear I know) but I can provide some insight into BT's static IP's that will hopefully help in resolving your issue.

When connecting to the BT network on an account that has multiple IP's, the connecting device that establishes the PPP session will always be assigned a DHCP peer address to guarantee connectivity. The way the business hub works is it uses the peer route to map the static IP's, you then set router up as the gateway for the multiple addresses on a no-NAT network (the Business Hub runs an internal NAT and externaly facing no-NAT network simultaniously), any device connecting on the NAT will always show as being on the DHCP peer address, and any device configured with a no-NAT public IP will show as having that IP.

It sounds to me like you've not disabled NAT for the public IP's, and with NAT enabled the static IP's will always route over the Cisco's WAN address... hence inbound is fine but outbound isn't. It is possible to use one of your static IP's on the WAN side of the Cisco, providing it can be set to obtain the subnet and gateway via DHCP from the HGR... so basically tell the WAN port to use one of the IP's you specify but grab the subnet and gateway from the ISP. This way you can keep your set up and have inbound access via each devices own IP, but outbound will show as what ever IP you specified.

Ultimately the 5 IP's you have are no-NAT IP's that are being told to run over NAT which is what I believe is causing your issue.

[stevehutton · Accepted solution]

Hi,

Thanks for your response.  I went back at the config and entered the IP address of the router back into the dialer instead of negotiating it and it is now working properly (I done this about 50 times already but funnily enough it's working now).  Thanks for your help with this, possibly there was some more configuration later on that made the difference but all 5 static ip's are working now and the originating IP address outbound is now showing as the IP address of the router and one to one Nat is working as well 😄 

I have added a full copy of the config for anyone else that is having problems configuring a Cisco 837 router to get full use out of their BT business broadband static IP addresses.

Cheers

Steve

version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname router
!
boot-start-marker
boot-end-marker
!
enable secret
!
aaa new-model
!
!
!
aaa session-id common
!
resource policy
!
ip dhcp excluded-address 10.100.0.254
!
!
ip cef
ip name-server 10.100.0.1
!
!

username admin privilege 15 password 0 [password]

!
!
!
interface Ethernet0
 ip address 10.100.0.254 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
 hold-queue 100 out
!
interface Ethernet2
 no ip address
 shutdown
 hold-queue 100 out
!
interface ATM0
 ip address [Routers IP address] 255.255.255.248
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no atm ilmi-keepalive
 dsl operating-mode auto
 pvc 0/38
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
!
interface FastEthernet1
 duplex auto
 speed auto
!
interface FastEthernet2
 duplex auto
 speed auto
!
interface FastEthernet3
 duplex auto
 speed auto
!
interface FastEthernet4
 duplex auto
 speed auto
!
interface Dialer0
 description $FW_OUTSIDE$
 ip address negotiated
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 no cdp enable
 ppp authentication chap callin
 ppp chap hostname Bxxxxxx@hgxx.btclick.com
 ppp chap password 0 [password]
 ppp pap sent-username Bxxxxxx@hgXX.btclick.com password 0 [password]
 ppp ipcp dns request
 ppp ipcp wins accept
 ppp ipcp mask request
 ppp ipcp route default
 ppp ipcp address accept
!
ip route profile
ip route 0.0.0.0 0.0.0.0 Dialer0
ip http server
ip http secure-server
!
ip nat inside source list 1 interface Dialer0 overload
ip nat inside source static tcp 10.100.0.1 25 81.142.aaa.aaa 25 extendable
ip nat inside source static tcp 10.100.0.1 80 81.142.aaa.aaa 80 extendable
ip nat inside source static tcp 10.100.0.1 443 81.142.aaa.aaa 443 extendable
ip nat inside source static tcp 10.100.0.1 987 81.142.aaa.aaa 987 extendable
ip nat inside source static tcp 10.100.0.1 1723 81.142.aaa.aaa 1723 extendable
ip nat inside source static tcp 10.100.0.1 3389 81.142.aaa.aaa 3389 extendable
ip nat inside source static tcp 10.100.0.9 22 81.142.bbb.bbb 22 extendable
ip nat inside source static tcp 10.100.0.9 25 81.142.bbb.bbb 25 extendable
ip nat inside source static tcp 10.100.0.9 80 81.142.bbb.bbb 80 extendable
ip nat inside source static tcp 10.100.0.9 443 81.142.bbb.bbb 443 extendable
!
access-list 1 permit 10.100.0.0 0.0.0.255
snmp-server community public RO
!
control-plane
!
!
line con 0
 no modem enable
line aux 0
line vty 0 4
 exec-timeout 120 0
 password [password]
 length 0
!
scheduler max-task-time 5000
end

[mark239]

 Hello

There is a way to do this. All you have to do is unnumber the router address given by bt to the ethernet port(or ports as a vlan member if they are layer 2 ports on that model - I cant remember) against the dialer interface.

You then use the cisco as a default gateway to any host on your lan that you wish to use a static IP for - obviously you will need a seperate firewall.

For example, your ethernet port will have an ip address of 1.1.1.1 (This is the address BT give as the router/hub address)

You then put a device (EG a firewall) behind this, with a static IP on your range, and the 1.1.1.1 address as its default gateway.

You can use all of the other statics in this way - or - as I do - use a firewall to perform the NAT (I use checkpoint NGX, as its one of the products I work with)