Cisco 1720

[pcunix]

My customer has a Cisco 1720 on a frame relay connection that he has configuration access to.

Presently it is configured to have a 192.168 address on its internal interface and does nat using a small pool of real ip addresses.

I need to put a server in this network that will be accessed from the outside world

Two ways I can do this: map an ip address inward, or have the server actually use one of the real ip addresses on one of its interfaces. For a number of reasons I'd prefer to do the latter rather than mapping an address inward. This server can take on the nat function also.

So- ideally- I'd like the Cisco to not do nat and basically just "get out of the way"- allow this server to be the gateway for the internal network.

If that's not possible, I will settle for mapping inward..
Tony Lawrence
SCO Unix/Linux Resources

http://pcunix.com

tony@pcunix.com

 

[pcunix]

Just in case I'm not being clear:

Ideally I'd want to turn off nat, and have the Cisco's Ethernet port take one of the real ip addresses. I'd connect that to a small switch where my server with another of the real ip addresses would also be connected. The other interface of my server goes to another switch where everything else is connected. My server will do the nat and firewall functions.

Is this possible?

If this is possible but too complex to cover here, I'm quite willing to pay for assistance of course. Tony Lawrence
SCO Unix/Linux Resources

http://pcunix.com

tony@pcunix.com

 

[CCIEWANNABE]

Static and dynamic mappings can be combined; just don't include your statically mapped internal addresses in your address pool. This allows you to specify some hosts (such as your server to be the gateway ) that have a fixed external address but belong to your internal network, while allowing other hosts to be assigned their external address dynamically.

Route once; switch many

 

[ChrisAC]

I would forget about doing NAT on the router if there's a firewall in place or something else that could do NAT behind it. A firewall would be the way to go.

We always configure the real address on the ethernet interface of the router (the first address from the assignment) and then put the second address on the outside of the firewall. The firewall can then control NAT and any server access via static maps.

Chris.
************************
Chris Andrew, CCNA
chrisac@gmx.co.uk
************************

 

[pcunix]

Yes, Chris, that's what I want to do. Sounds easy enough Tony Lawrence
SCO Unix/Linux Resources

http://pcunix.com

tony@pcunix.com