WWW.DUMAIS.IO

cisco router configurationLast edited on Feb 25, 2012

My private network is built around a cisco 2620xm router and a cisco catalyst 3448-XL My router's image is c2600-adventerprisek9-mz.124-25c.bin, and for the switch: c3500xl-c3h2s-mz.120-5.WC17.bin.

DSL connection

My router has a WIC-1ADSL card. Using this, I can connect with my ISP. Note that these settings might only work for my ISP (Teksavvy, in ottawa)

vpdn enable
no ip cef
interface ATM0/0
 no ip address
 atm restart timer 300
 no atm ilmi-keepalive
 bundle enable
 !
 dsl operating-mode auto
 hold-queue 224 in
 pvc 0/35
  pppoe-client dial-pool-number 1
 !
!
interface Dialer1
 ip address negotiated
 ip access-group 120 in
 ip mtu 1492
 ip nat outside
 ip nat enable
 ip virtual-reassembly
 encapsulation ppp
 ip tcp adjust-mss 1452
 dialer pool 1
 dialer-group 1
 no cdp enable
 ppp authentication pap callin
 ppp pap sent-username your_username password 0 your_password
 ppp ipcp dns request accept
 ppp ipcp address accept
!
ip forward-protocol nd
! set default route to go through Dialer1 interface
ip route 0.0.0.0 0.0.0.0 Dialer1

! deny telenet access from outside.
access-list 120 deny   tcp any any eq telnet
access-list 120 permit tcp any any
access-list 120 permit ip any any
dialer-list 1 protocol ip permit

With these settings, your DSL connection should come up. Any host from the outside of your network will be able to access TCP ports (except 23) on your network. More details on NAT will follow.

VLAN trunking

Consider the following configuration:
VLAN 1 hosts the 10.0.0.0/24 network
VLAN 3 hosts the 10.0.3.0/24 network
VLAN 10 hosts the 10.0.10.0/24 network
VLAN 1 and VLAN3 can talk to each other and to the WAN
VLAN 10 can only talk to the WAN

interface FastEthernet0/0.1
 encapsulation dot1Q 1 native
 ip address 10.0.0.1 255.255.255.0
 ip access-group 101 in
 no ip unreachables
 ip nat inside
 ip virtual-reassembly
!
interface FastEthernet0/0.3
 encapsulation dot1Q 3
 ip address 10.0.3.0 255.255.255.0
 ip access-group 103 in
 no ip unreachables
 ip nat inside
 ip virtual-reassembly
!
interface FastEthernet0/0.10
 encapsulation dot1Q 3
 ip address 10.0.10.0 255.255.255.0
 ip access-group 110 in
 no ip unreachables
 ip nat inside
 ip virtual-reassembly

A subinterface (ie: 0.10) defines a vlan. In this setup, interface 0 is configured to handle VLANs 1,3 and 10 by separating it in 3 different sub-interface. Note that with this configuration, nothing more needs to be done for inter-vlan routing. By assigning an IP paddress to subinterfaces, you tell the router how to route between vlans.

With this configuration, all 3 networks will be able to talk to each other. To prevent VLAN10 to talk to VLAN 1 and 3, you could do the following:

access-list 100 deny   ip 10.0.0.0 0.0.0.255 10.0.10.0 0.0.0.255
access-list 100 permit ip any any
access-list 100 permit udp any any

access-list 103 deny   ip 10.0.3.0 0.0.0.255 10.0.10.0 0.0.0.255
access-list 103 permit ip any any
access-list 103 permit udp any any

access-list 110 deny   ip 10.0.10.0 0.0.0.255 10.0.0.0 0.0.0.255
access-list 110 deny   ip 10.0.10.0 0.0.0.255 10.0.3.0 0.0.0.255
! deny telneting in gateway from guest network
access-list 110 deny   tcp 10.0.10.0 0.0.0.255 host 10.0.10.1 eq telnet
access-list 110 permit ip any any
access-list 110 permit udp any any

DHCP

The following configuration will setup a DHCP server on the router with a different pool for each networks.

! only hand out ip addresses from 10.0.0.100-10.0.0.149
ip dhcp excluded-address 10.0.0.1 10.0.0.99
ip dhcp excluded-address 10.0.0.150 10.0.0.255
! only hand out ip addresses from 10.0.3.100-10.0.3.149
ip dhcp excluded-address 10.0.3.1 10.0.3.99
ip dhcp excluded-address 10.0.3.150 10.0.3.255
! only hand out ip addresses from 10.0.10.100-10.0.10.149
ip dhcp excluded-address 10.0.10.1 10.0.10.99
ip dhcp excluded-address 10.0.10.150 10.0.10.255
ip dhcp pool pool_vlan1
   import all
   network 10.0.0.0 255.255.255.0
   default-router 10.0.0.1
   dns-server 10.0.0.1
ip dhcp pool pool_vlan3
   import all
   network 10.0.3.0 255.255.255.0
   default-router 10.0.3.1
   dns-server 10.0.3.1
ip dhcp pool pool_vlan10
   import all
   network 10.0.10.0 255.255.255.0
   default-router 10.0.10.1
   dns-server 10.0.10.1


DNS

To use the cisco router as a DNS forwarder, the following simple configuration can be usd

ip dns server

NAT / Port forwarding

I never got port range forwarding to work on my router. I ended up writing 100 lines for a range of 100 ports. But this is not shown here for for sake of simplicity

ip nat translation timeout 3600
ip nat translation tcp-timeout 1200
ip nat translation finrst-timeout 15
ip nat translation syn-timeout 45
! forward port 80 to 10.0.0.4:80
ip nat inside source static tcp 10.0.0.4 80 interface Dialer1 80
! enable NAT on Dialer1 interface
ip nat inside source list 1 interface Dialer1 overload
access-list 1 permit 192.168.0.0 0.0.255.255