Got a Cisco 1800 router, no nat, with 2 internet connections. Both come with own IP ranges and router IP. Want to use one for internet and other for VPN but can't figure out how to see both public IP's from a single firewall as the firewall settings only allow for IP range from one of the sources. The firewall doesn't have dual isp just one port for WAN.

Any ideas? Adding routes perhaps?

  • "the firewall settings only allow for IP range from one of the sources" Your possible challenge here is the capabilities of your actual firewall. Are you running a separate firewall versus the IOS firewall commands? – user48838 Jul 24 '10 at 8:09
  • I'm confused, what do you mean by "see both public IP's from a single firewall" ? Where is the firewall located ? Can you provide a simple network scheme using dia or Viso ? You can have as many uplinks you want, a firewall just evaluates rules and try to see if they match with the traffic, if it happens it takes actions. It's not linked to a specific IP or IP range. You really can do whatever you want. – Aki Jul 6 '11 at 13:24

Generally speaking, I'd say you need a single big internet connection. If you require redundancy, then there might be a discussion around whether you need BGP for failover of your IP space or something. I did have a thought on how you might make this work anyway though...This is just a 2am shot in the dark..it would need to be tested in a lab first, etc...

But you could use your cisco 1841 as the VPN endpoint for your remote-access clients, and put the interface you use for that in a separate vrf. Each vrf has it's own routing table. In this case, you would have two vrfs: the global (default) vrf where your internet browsing public interface and your private interface reside, and your vpn vrf. For example:

ip vrf vpn
 rd 1:1
ip vrf default
 rd 2:2
interface fa0/0
 description dsl for browsing
 ip vrf forwarding default
 ip address
interface fa0/1
 description cable internet for vpn
 ip vrf forwarding vpn
 ip address
interface vlan 1
 description private lan 
 ip vrf forwarding default
 ip address
ip route vrf default
ip route vrf vpn

You see both Internet connections are separate. You would tie your VPN clients back to your private network like this:

crypto isakmp profile cisco
 vrf deafult
crypto dynamic-map dynmap 10
 set isakmp-profile cisco

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.