I actually have one 1800 configured as follow. this config is running well and all needed routing and port publishing are functioning.

Ip assignment to interfaces:
int ATM0.1: a.a.a.a pointtopoint address
int VLAN1: (internal network address) as secondary address
int VLAN1: b.b.b.b public ip address

Actually internal network is connected to Eth6

interface FastEthernet0
 no ip address
 duplex auto
 speed auto
interface BRI0
 no ip address
 encapsulation hdlc
interface FastEthernet1
interface FastEthernet2
interface FastEthernet3
interface FastEthernet4
interface FastEthernet5
interface FastEthernet6
interface FastEthernet7
interface FastEthernet8
interface ATM0
 no ip address
 no atm ilmi-keepalive
 dsl operating-mode auto
interface ATM0.1 point-to-point
 ip address a.a.a.a
 ip nat outside
 ip virtual-reassembly
 no snmp trap link-status
 pvc 8/35
  oam-pvc manage
  oam retry 5 5 1
  encapsulation aal5snap
interface Vlan1
 ip address secondary
 ip address b.b.b.b
 ip nat inside
 ip virtual-reassembly
 ip tcp adjust-mss 1452
 hold-queue 100 out
ip route ATM0.1
no ip http server
no ip http secure-server
ip nat inside source list 1 interface Vlan1 overload
ip nat inside source static tcp 22 interface Vlan1 222
ip nat inside source static tcp 443 interface Vlan1 443
ip nat inside source static tcp 80 interface Vlan1 80
logging trap notifications
access-list 1 permit

Studying documentation i found other possible configurations to accomplish the same result so i'd like to know what's the most right and why. My doubt are about which is the most correct interface(s) to use.

1) Assignment of public ip address (b.b.b.b) to a different interface instead of assign it as secondary address on vlan1 interface
2) Possible use of loopback interface for public o private ip
3) Possible use of eth0 for private ip
4) Possibile use of one eth (1-8) for private ip. These interfaces cannot be assigned an Ip because are layer 2. vlan or loopback must be used to use these interfaces?

  • This question lacks the actual question. What do you need to accomplish ? If it's routing - then routing between what ? And what isn't working. – drookie Oct 16 '16 at 19:52
  • Everything is working fine but i think there are different configurations to accomplish the same result. My question is what interfaces should be used for internal ip? Vlan loopback eth0 eth1-8 ? And why? – maudam Oct 16 '16 at 20:46
  • Why you use ip b.b.b.b as secondary? I don't understand reason for this. – Alexander Tolkachev Oct 16 '16 at 20:54
  • @alexander t This is my question. Waht's the right ip assignament to which interface and why. I'm going to edit my question to clarify this point. – maudam Oct 16 '16 at 21:27
  • Secondary addressing is less than ideal, and it should only be used for temporary situations. Normally, you would use subinterfaces with dot1q encapsulation to a switch trunk interface. Each network would be on a separate VLAN. – Ron Maupin Oct 16 '16 at 22:22

I agree with @RonMaupin's comment that secondary addressing is less than ideal.

Personally I would assign public address b.b.b.b to a loopback interface instead, with a mask.

In some scenarios you may not even need to assign the ip address to an interface (if you only use it for NAT) as you can often use the ip address directly in the NAT commands.

I.e. for dynamic NAT you could do:

ip nat pool public-ip b.b.b.b b.b.b.b prefix-length 32
ip nat inside source list 1 pool public-ip overload

And for static port NAT you could do:

ip nat inside source static tcp 22 b.b.b.b 222
ip nat inside source static tcp 443 b.b.b.b 443
ip nat inside source static tcp 80 b.b.b.b 80

But to be honest I'm not sure if you can combine the 2 sections above. If you try it let me know if it works and I'll update this answer.

Note that if you keep the ip address assigned to an interface (any interface) then the router will also listen on that address for any enabled services (telnet, SSH, SNMP, etc.) so you may want to put an ACL on your ATM0.1 interface that restricts access to both a.a.a.a and b.b.b.b.

  • If you downvote could you please do me a small favor and add a comment indicating what you think is wrong with it? – hertitu Oct 17 '16 at 21:19

Cisco 1800 is an ISR router serie, so it comprises several [types of] interfaces:

  • WAN interfaces, ADSL and ethernet
  • switchport interfaces
  • virtual LAN interfaces.

Last two types are usually encountered in switches (ot in switch modules for bigger routers), so all the switch tecniques apply to them.

Basically the following approach is used:

  • you connect the WAN link to a WAN port (in case os ADSL you really don';t have a choice) and configure this interface (this is actually the regular router method).

  • you connect LAN link to any of the switch ports and configure the VlanX interface as internal. This is the regular switch method? when you are using the L3-enabled switch as a router.

  • when you have more than one WAN link you connect it to the switch port, add more vlan to the database, add more VlanX interfaces to handle it's traffic and configure the appropriate switch port as an access port using switchport mode access command.

There are other complications and methods to solve them, but I'm afraid these are beyond the scope of this answer.

From what I'm seeing, you probably have a public IP set up as a secondary on a LAN interface. Tough this seems to be a working configuration, it really is a mistake. Looks like you have a misconnected WAN. If I'm right, this compromises your internal network, because it puts it in the same l2 domain as your WAN uplink. This opens various possibilities for any type of network fraud and/or unauthorized access.

  • I added some details to my question. Please review. – maudam Oct 16 '16 at 21:32
  • I think you are right, so given that my internal ip is assigned to vlan interface to use it with eth1-8 ports, on which interface i should assign the public ip to avoid troubles ? – maudam Oct 17 '16 at 6:53
  • You have a dedicated WAN fast ethernet interface Fe0, this is the exact place where the public uplink should be connected to. – drookie Oct 17 '16 at 8:43
  • First two types are usually encountered in switches => what switches have WAN or DSL interfaces? this compromises your internal network, because it puts it in the same l2 domain as your WAN uplink => are you saying this config bridges ethernet to ATM? That doesn't make sense... – hertitu Oct 17 '16 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.