Cisco Routers :: RVS4000 One-to-One NAT / Multiple Public IP Addresses
Mar 11, 2013
If there are any small business routers that offer one-to-one NAT? I have several public IP addresses assigned to me by CenturyLink. I have two servers that provide email and web hosting for two different domains. I want to put the client machines on one VLAN (VLAN Z) and assign it a public IP address (to keep server traffic separate). I want to put each server on its own VLAN (VLANs X & Y) and assign each server its own public IP address. I need the router to be able to provide a firewall and port forwarding for each VLAN. I also need to be able to route traffic between VLANs so the clients on VLAN Z can access their email and the websites on VLANs X and Y. I also need to be able to route DNS traffic between VLANs so each server can provide name resolution for their respective domains.
So, is this possible with a small business router or do I need to look at something different? I'm fairly certain this configuration is not possible with my current Cisco RVS4000. What it boils down to is I need a router that is capable of having multiple public IP addresses on the same interface and to forward those public addresses to private VLAN subnets. This would be one-to-one NAT if I understand it correctly..
The client has a Cisco RVS4000. There are 3 Internet devices need to be accessed from the outside and will use one public IP for one device. I don't see any options to setup on Cisco RVS4000 to do 3 NATs. If Cisco RVS4000 doesn't work in this situation, which router will do?
I have a customer that has an RSV4000 Router. The customer has also purchased a block of 5 usable public IP addresses. I need to be able to assign these public IP addresses to printers either by configuring a static IP on each printer directly or thru IP mapping or some other method. Does the RSV4000 support using multiple public IP addresses and if so what configuration is needed in the router for the printers to be seen by the outside world.
I would like to configure an 877w I just bought. It's connecting to a UK ADSL2+ link.I'm a penetration tester and I want to put the Cisco router in front of my existing firewall which has an IPS on it, so that it doesn't get in the way of port scans and vulnerability scans. My ISP has issued me with 14 usable addresses a/240 subnet and basically I want to be able to use the route with just the public IP addresses. I have configured Cisco routers before, but never with this type of configuration. It's always been single public IP address NAT'd through to one or two internal LAN's.
It will be nice if I could assign the wireless and fast ethernet ports to the same VLAN using the public addresses. I don't want to use DHCP I'm quite happy statically assigning IP addresses to the computers wireless and LAN interfaces. I am reasonably certain this is possible because not sure how to do it and a little busy at the moment carrying out penetration tests.
Is it possible to have multiple public IP addresses that are from different subnets going through one router? I have been told that this is not possible with most routers and that I would have to spend a lot of money on a router to be able to do it. I am still not totally clear on what defines a subnet even after reading up on them. What I am trying to achieve:
-My office has 10 computers.
-All would be connected to one router.
-My internet service provider has provided me with 10 public IP addresses, that are all very varied (which I asked for)
I'm currently replacing my ASA 5505 with a 5510. I have a range of public IP addresses, one has been assigned to the outside interface by the setup wizard (e.g. 123.123.123.124 ) and another I would like to NAT to an internal server (e.g 192.168.0.3 > 123.123.123.125). On my asa 5505 this seemed fairly straigh forward, i.e. create an incoming access rule that allowed SMTP to 123.123.123.125 and then create a static nat to translate 192.168.0.3 to 123.123.123.125. Since I've tried to do the same on the 5510 traffic is not passing through so I'm assuming that the use of additional public IP addresses is not handled in the same way as the 5505? I also see that by default on the 5505, 2 VLANs are created, one for the inside and one for the outside, where as this is not the case on the 5510. Is the problem that VLANs or sub-interfaces need to be created first? I'm doing the config via ASDM.
Everything else seems to OK i.e. access to ASDM via 123.123.123.124, outbound PAT and the site-to-site VPN.
I have a Netgear ProSafe VPN Firewall FVX538. But I also have 10 Public IP Addresses that I will like to setup for three web services. So how do I set this up. With multiple routers. Or can my Netgear FVX538 take multiple Public IP Addresses to the same ports. If not how can setup multiple routers. one being the main one.
I work for a company that recently upgraded to a Cisco RVS4000 router in place of a failing D-Link router. I configured the RVS4000 to utilize the same address space as the D-Link previously did (192.168.0.0 Network Address, 255.255.255.0 Subnet Mask, RVS4000 in Gateway Mode with IP Address 192.168.0.1, DHCP Scope from 192.168.0.101 - 200 managed by the RVS4000) before installing it on the network. I powered down the D-Link as well as the cable modem, then all of the workstations in the office. Then, I installed the RVS4000, powered up the cable modem, and once it was ready, powered on the RVS4000.
When devices connect, the RVS4000 is assigning them an IP address in the 192.168.1.0/24 subnet, instead of the 192.168.0.0/24 subnet. I have verified that the RVS4000's GUI is showing the correct settings, but connected devices are not picking up addresses from the correct address pool. In troubleshooting, I went to each workstation, released and renewed their IP addresses, and they picked up addresses in the correct subnet. I thought everything was solved, but the next day, the same problem resurfaced.
I left the DHCP lease time at the defaul value "0", which according to the unit's documentation should correspond to a 24-hour lease period. I suspect this is why I had to renew the clients' IP addresses the next day (today), but I still don't get why the RVS4000 wants to give out addresses in the 192.168.1.0/24 scope. Could this be a holdover from the factory settings?
Additional Information: I did not set up any VLANs on the network and the office only requires one subnet as there are not a lot of devices connected, nor do we need the traffic segragated. The VPN functions of the RVS4000 work fine. Using the QuickVPN utility, I can access the network and resources on the network remotely without issue.
I have 2 internet connections in my office one via Verizon Fios and another one via the local cable company. On the fios connection I have an RV042 VPN router and on the Cable company connection I have an rvs4000 router, I would like to know if there is a way I can connect the 2 so I can share a printer I have on one of the 2 networks from the other network without using the VPN feature, like via an ethernet cable connected between the 2 and some kind of static route maybe?
I recently purchased a RVS 4000 (firmware V2.0.0.3) and am having some issues creating a second (third...fourth?) IPSec VPN Tunnel. The first one is up and running just fine. On the VPN Summary screen it says [1 Tunnels Used 4 Tunnels Available].
When I go to configure the second tunnel, I select --New-- from the "Select Tunnel Entry" drop down and proceed to fill in all the connection information. When I click Save, it seems to be processing and after a few seconds just returns me to the same screen, with none of the information I just input and no connection created. No errors given.
I have another RVS4000 to connect at a different location which will require a similar setup, but don't want to do anything with it until I have the one mentioned above working fully.
I have an unusual deployment scenario which may require the use of a SRP-521W, the scenario is as follows:Temporary Setup:Cisco 857 As the ADSL router until Ethernet Hand-off is installedMultiple IP addresses delivered on the ADSL WAN serviceCisco 857 put into Bridge Mode and connected to SRP-521W WAN portCisco 521W handles the Authentication and RoutingCheck Point Firewall System connected to SRP-521W LAN-1Check Point Firewall has WAN IP 203.XXX.XXX.XXXCisco UC-540W Connected to SRP-521W LAN-2Cisco UC-540W has WAN IP 203.XX.XX.XX If you understand the above scenario, I am curious if this can be done and if so how? I need to keep the networks totaly separate and the only thing they would have in common is the Cisco SRP-521W.It should also be noted that the SRP-521W Is being used because the ADSL service is only temporary whilst the Fibre Build is completed and the carrier provides an Ethernet Hand-Off, then the Internet service will change to this type of presentation and the ADSL router will be relegated to the dark world of loneliness.I have gone through the router and have been playing around with the settings, the issue Is I have nothing in the LAB work up that can allow me to replicate this environment and test it before deployment... So, how to reduce the amount of trail and error I have to encounter to get it to work.
We have just setup a new RV042G firewall. The customer has multiple public IP addresses and we need to allow RDP access for at least 2 of the Public IP addresses. I only see a way to open ports for the one IP assisgned to the WAN. I temporarily did a one to one NAT for the second public IP to NAT to the private IP but that pretty much opens everything which is not ideal from a security standpoint. How can we setup multiple IP addresses on this firewall?
I am configuring this new router for a client. I am running into an issue that I cannot get working. They use 5 public IP addresses. Currently the wan port on the router is .66 and I have all the ports forwarded to the correct internal IPs. This works fine. However I need to forward parts from other public IPs (ex: .67) to internal IPs. So far I have been able to accomplish this via the One to One NAT feature. It allows me to forward ONE port from a public IP to a private IP. However I need to forward 3 or 4 ports per public IP to a single internal address. Does this router not support that functionality?
if possible with the RV042.Primary External IP address uses port forwards for some ports, all okay.I would like to have other external ip addresses assigned to machines on my lan.Basic host multiple web servers, on different IP addresses, using port 80. [code]
From what i am reading, it looks like the RV042 can do this, but I am not real clear what my rules should look like.
I would think my high priority rule for each external IP address would be to deny all traffic first for each machine on the lan.Then create one entry with source 202.x.x.2 port 80 -> 192.168.168.2 ?
How should I set my rules to do this, and what settings should I have on the Nic of the second machine?
I have an ADSL connection and have configured the PPPoE subinterface on WAN1 (ADSL) this connection has a static IP, and I know that the ISP gives that to me through DHCP however I have 4 or 5 additional IP addresses also provided to me on that same link, and they are not given to me via DHCP.
How do I configure this router to have multiple fixed IP addresses on a PPPoE interface?
I also need to port forward some ports for each of the IP's but I assume this will be easy after i have the IP addresses setup.
At my company, we lease 3 static public IP addresses from 1 ISP. We want to have 3 separate networks that each use one of the IP addresses. Network 1 is the computer network, network 2 is the VOIP network, and network 3 is the security camera network. I am trying to determine the best way to do this. I have come up with 2 solutions in my head, but I'm not sure if they will work or not. I would like to get some input. Solution 1:Solution 1 looks something like this. Fiber box -> Router-> 3 switches. There would be one WAN input on the router, that would have a static route to 3 different LAN ports. For example, address 24.244.208.101 would be assigned to LAN port 1, 24.244.208.102 would be assigned to LAN port 2, and 24.244.208.103 would be assigned to LAN port 3 (by assigned, I mean have a static route to it). Is there some type of router that is capable of doing this? Solution 2:Solution 2 looks something like this. Fiber box -> Switch -> 3 Routers. The ethernet cable would run from the Fiber Box to a switch, and then 3 routers would be plugged into the switch. Each router would have the Static information configured in them. Would both of these methods work? If so, which would be the best way to go?
I am trying to configure a BT Business ADSL Router (BT2700HGV) to work in bridge mode in front of a Cisco RV120W router and cannot get this to work.I have followed numerous posts I have come across in configuring the BT router for bridged mode and this has been configured as follows:
ATM Encapsulation - Bridge LLC DSL and ATM - VPI=0, VCI=38 (also tried VCI=35) ATM PVC Search - Disabled Connection Type - Direct IP (DHCP or Static) Disable Routing - Yes
There are also some other options on the same configuration page for 'Broadband IP Network' (which I have left on DHCP) and also a 'Public IP' which has been left blank. After setting the above options this removes the LAN DHCP configuration, the PPPoA logon details and sets the internal IP address of the BT router to 192.168.1.254.
My understanding of 'Bridge' mode is that this router will now act simply as a modem and configuration details such as logon details and WAN IP address information are configured using the Cisco RV120W router?The configuration of the Cisco router is as follows:
Internet Connection Type - PPPoE Username and Password set Authentication Type - Auto-Negotiate (options here are PAP, CHAP, MS-CHAP and MS-CHAPv2) Routing Mode - Router (Other option is 'Gateway (NAT))' - I have tried both options
The WAN interface on the Cisco router is connected to one of the LAN ports on the BT router. The 'Broadband' light is on the BT router but the 'Internet' light isn't. The WAN status on the Cisco router is 'Connecting'. I am sure I am missing something simple.We have been assigned a range of static IP addresses from BT so am trying to get these working too (x.x.x.24/29 - 5 usable statics), another option available (other than PPPoE) for configuring the WAN interface on the Cisco router is a 'Static IP', not sure if this is the correct option but have tried messing with it, I have tried assigning a static IP from the range given to us (.30 - the router address specified by BT) along with the subnet mask, however don't know what to put as the default gateway, would this be the peer address (but assume that would change anyway), in any case, using the 'Static IP' option does not give an option to supply the BT logon details which I assume is required?
In bridged mode, what is the peer address assigned to, the BT router or the Cisco router?Does the BT router need to be configured with a public IP address?
Is it possible to have more public addresses to more internal addressees? I have an internet provider which is in control of my router and he is telling me it is not possible. It's a Cisco router and I have static IP address.
In setup for old RV042 (V1), when updating / adding Mac addresses, the table is always sorted by IP addresses. But in the new oneRV042 (V3) I have, even with latest firmware 4.2.1.02 the list is random, thereby increasing the chance of user entering DUPLICATE IP addr with diff Mac addr. That will result in conflict.If the firmware sorts the DHCP entries by ip addresses, user would be able to catch duplicate ip errors even if the system does not flag the errors. All Cisco smart engineers can you all get the dhcp entries SORT by ip addresses.
i have Cisco 1941(with security lic) and i have been asked to make a VPN with public IP addresses so there will be no info about internal networks. Other side has ASA 5520 and they provided me with 2 public IP addresses. i have done many different VPNs but this is first with public IP addresses and i cannot figure it out.So here is the question:
The thing is that I have private IP adresses on my LAN, and I have been issued a public IP network for my DMZ by my ISP.
Meaning I want to NAT my LAN but not my DMZ, but I can't seem to find a way in the 520 to do that. I can only find the oprion to turn off NAT all together.
I am trying to figure out how this works. I have an ISP device that connects to my 1841. ISP and fa0/0 hold the /30 WAN addresses. Fa0/1 hold one of the public IPs, lets say 1.1.1.1/29. Then the outside interface of the ASA holds 1.1.1.2/29. Now I have two routes in the 1841, one for default route going back to the ISP device, and a route for the 1.1.1.0/29 network going to the ASA.Now I have 4 more publics I can use 1.1.1.3 - 6. I do not want to assign these IPs to the servers, but yet just NAT them. I know this is possible, but cant figureI took an internal host and did a one to one static NAT from private to public. Packet tracer says my NAT rules are ok. Allowed all IP traffic for testing and still can't ping the server.
I have a customer thats got a Linksys router now, that has a DMZ port.The DMZ port is configurede to it routes the extra public ip-adress to the DMZ port it has.At the DMZ port they have another router connected, where they routes the public ip-adresses på some other devices.How can i make this setup on a Cisco ASA 5505 (With the Security Plus licens)What i have to do is to replace the Linksys router, and make it so, so it works like it was before with the Linksys.
I just thought if it's possible to make sure that only approved IP addresses for each of divisions of a company can be used.How can I assign for a port one/more public addresses and be sure that only this port is using it/them. Thing is I have only one 24 bit public Network ID provided to me by ISP. One IP address of the range is used for ISP's gateway. So I have 253 addresses to be distributed among divisions. However to avoid IP address conflicts I have to be sure that only dedicated for a division IP address/es is/are used by the division.
I have this motorola sbv5121e modem. I can connect one PC to it directly. When I try to connect a secont PC, via a switch, it won't give out 2 IP addresses. Moreover, I see that the one IP address it does give out, is a public one (like 22.x.x.x). I'm on XP and show the addresses with ipconfig. Is this modem defective hardware-wise, or is some setting internally wrong? How can I see what the DHCP server does?
I have set up a private domain network at home. I have a domain controller, a DNS server, and a DHCP server all running on one Windows 2003 Server machine. I have about 10 other machines around the house, getting their IP addresses from this DHCP server.
I have a Netgear WNDR3700 router.
I am about to get 5 public IP addresses from my ISP, and I would like to make some of these machines publicly accessible (while still accessible from the other machines in the network).
I found this link that says on my web server (one of the public machines), that I should use a second NIC and set that up to connect to my router (and get a private IP address from my DHCP server).
On an 887VA running 15.x IOS, is there a way to support both public and private addresses on inside vlans? The outside interface is public static ip, so the requirement would be to not nat anything if coming from inside vlan10 but nat if coming from inside vlan20.I didn't think this was possible since the outside interface would have to use an outside nat command that would not be ignored for traffic coming from vlan10.
I have just installed an SRP 527w and it's basic operation is working fine. However, the ISP has allocated (and set up routing for) a range of 16 additional static addresses to the link that I now wish to configure and use, but I am having problems. Details are as follows (ip addresses are fictitious): [code]Extra ip range Netmask: 255.255.255.240From what I understand, these are added as subinterfaces which are bridged off the main WAN interface. However, when I try to add a subinterface by specifying (say) I get an error when saving : [code] The error states "IP Address and Gateway cannot be the same as the netmask".
We have Cisco ASA 5505 box.We have a /29 subnet available.At this moment one of IP addresses in this rage is assigned to VLAN2 used for outside interface all outgoing traffic from VLAN10 (for employees) will go out using one IP, xxx.xxx.xxx.1all outgoing traffic from VLAN20 (for visitors) will go out using second IP, xxx.xxx.xxx.2all outgoing traffic from VLAN10 host yyy.yyy.yyy.yyy (mail server, webmail, ...) will go out using third IP, xxx.xxx.xxx.3all specified incomming traffic to xxx.xxx.xxx.3 will be NATted to internal host yyy.yyy.yyy.yyy in VLAN10 .The main purpose is to have specific public IP address for mail server only not to get to any black list,and to give visitors different outgoing IP address than for our internal users.
configuring my Cisco 2951 router with Z0ne-based firewall. This is the scenario I would like to configure.
I have two ftp servers,S1 and S2, behind the router which needs to be accessed by two groups of users, G1 and G2, from the outside, i.e., from the internet.
I have two public IP addresses, 152.12.164.203 and 152.12.164.204. The WAN interface of the router is configured with IP address 152.12.164.203. G1 needs to access S1 on 152.12.164.203 and G2 needs to access S2 on 152.12.164.204.
What are the steps in configuring the router if I need the above scenario to be implemented?
I need to put a few cameras, without a server, on a static WAN ip address. Do I just assign them a static LAN ip address(for example 192.168.1.200), make sure the port they use is open, then type the WAN static ip address then colon and the last address? Like this.....I'm making up the WAN address....45.34.55.334:200
I've currently got my ASA (5505) serving a /28 public subnet. I've ran out of IPs, so my DC has issued me an additional /24 subnet that they have routed to my ASA. What needs to be done on my ASA so be able to use these new addresses? I've been trying to search and not been able to find a good answer (some say I shouldn't have to do anything, everything else references NATing, which I currently don't do and would rather not do).The servers I assign these to, I'd like them to have the public ip assigned directly to them.
