ho la necessita di ri-configurare il mio amato 837 per farlo funzionare semplicemente come un router ethernet e nient'altro.
Premetto che ho già provato a cercare sul foum e su google ma non ho trovato nulla che mi soddisfasse a pieno. Inoltre piccoli risultati li ho ottenuti ma nulla di significativo.
Il mio obiettivo è quello di sfruttare un router USR che si collega direttamente all'adsl2+ di casa, e tramite un cavo ethernet, collegarlo al mio 837. Il Cisco non deve fare altro che prendere il segnale wan da una porta ethernet, e smistarlo sulle altre 3. Inoltre non mi serve alcuna altra funzione, neanche il firewall visto che lo gestisco col router di frontiera (USR).
Ho già cominciato a vedere che la 4a porta fisica dell'837, coincide con la Ethernet2, mentre lla 1-2-3 con la Ethernet0, solo che nn sono riuscito a concretizzare la configurazione.
Quello che ho fatto è stato semplicemente questo:
int ethernet2
ip address 192.168.1.10 255.255.255.0
ip nat inside
ip virtual-reassembly
hold-queue 100 out
no cdp enable
int Ethernet0
ip address 192.168.100.1 255.255.255.0
ip nat inside
ip virtual-reassembly
no cdp enable
hold-queue 100 out
Ho collegato il cavo ethernet che parte dall'USR, nella ethernet4 del router, assegnando alla porta eth2 l'ip 192.168.1.10 (in quanto la lan definita nell'usr è del tipo 192.168.1.x). Così facendo riesco a pingare tranquillamente dai pc connessi all'usr, quindi quelli della rete 192.168.1.x il cisco 837. Il viceversa invece non funziona, nè tantomento i pc connessi al cisco riescono a navigare in internet.
Sull'interfaccia eth0 ho invece definito 1 altra rete, che sarà quella interna all'837, ovvero quella a cui apparterrano tutti i pc ad esso connessi. Anche questa funziona isolatamente.
In pratica quello che non riesco a fare è a dirigere il traffico WAN/LAN dalla ethernet2 alla ethernet0 e viceversa.
Questa è la mia configurazione attuale..
Codice: Seleziona tutto
service nagle
no service pad
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
hostname Cisco837
boot-start-marker
boot-end-marker
logging exception 100000
logging count
logging userinfo
logging queue-limit 10000
logging buffered 150000 notifications
logging console critical
no aaa new-model
enable secret imtheadmin
clock timezone MET 1
clock summer-time MEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
ip dhcp excluded-address 192.168.100.1
ip dhcp pool 192.168.100.0/4
import all
network 192.168.1.0 255.255.255.0
domain-name CrAsHLaN
default-router 192.168.100.1
dns-server 213.205.32.70 213.205.36.70
lease infinite
no ip source-route
no ip gratuitous-arps
ip icmp rate-limit unreachable 1000
ip cef
ip subnet-zero
ip inspect log drop-pkt
ip inspect max-incomplete low 300
ip inspect max-incomplete high 400
ip inspect one-minute low 300
ip inspect hashtable-size 2048
ip inspect tcp synwait-time 20
ip inspect tcp max-incomplete host 300 block-time 60
ip inspect name Firewall tcp
ip inspect name Firewall udp
ip inspect name Firewall ftp
ip inspect name Firewall cuseeme
ip inspect name Firewall dns
no ip bootp server
ip domain name cisco.com
ip name-server 213.205.32.70
ip name-server 213.205.36.70
login block-for 1 attempts 3 within 30
login on-failure
login on-success
ip ssh time-out 60
ip ssh authentication-retries 2
archive
log config
hidekeys
ip tcp selective-ack
ip tcp window-size 2144
ip tcp synwait-time 10
interface Ethernet0
ip address 192.168.100.1 255.255.255.0
ip access-group 103 out
ip nat inside
ip virtual-reassembly
no cdp enable
hold-queue 100 out
no shutdown
interface Ethernet2
ip address 192.168.1.10 255.255.255.0
ip nat inside
ip virtual-reassembly
no cdp enable
hold-queue 100 out
no shutdown
interface FastEthernet1
no cdp enable
interface FastEthernet2
no cdp enable
interface FastEthernet3
no cdp enable
interface FastEthernet4
no cdp enable
interface ATM0
description InterfacciaATM
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
no ip route-cache
no ip mroute-cache
no snmp trap link-status
ip mtu 1500
no atm ilmi-keepalive
dsl operating-mode auto
bundle-enable
hold-queue 224 in
no shutdown
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
interface Dialer0
ip address negotiated
ip access-group 131 in
ip tcp header-compression passive
ip mtu 1500
ip nat outside
ip inspect Firewall out
ip virtual-reassembly
encapsulation ppp
dialer pool 1
no cdp enable
ppp authentication chap pap callin
interface Dialer1
no ip address
no cdp enable
ip forward-protocol nd
no ip http server
no ip http secure-server
no ip forward-protocol udp netbios-ns
no ip forward-protocol udp netbios-dgm
ip nat translation timeout 60
ip nat translation tcp-timeout 60
ip nat translation udp-timeout 30
ip nat inside source list 1 interface Ethernet2 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Ethernet2
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 131 remark *************************************************************
access-list 131 remark *** ACL ANTI-SPOOFING ***
access-list 131 deny ip host 0.0.0.0 any log
access-list 131 deny ip 127.0.0.0 0.255.255.255 any log
access-list 131 deny ip 192.0.2.0 0.0.0.255 any log
access-list 131 deny ip 224.0.0.0 31.255.255.255 any log
access-list 131 deny ip 10.0.0.0 0.255.255.255 any log
access-list 131 deny ip 172.16.0.0 0.15.255.255 any log
access-list 131 deny ip 192.168.0.0 0.0.255.255 any log
access-list 131 remark *************************************************************
access-list 131 remark *** ACL PER CONTROLLARE TRAFFICO ICMP ***
access-list 131 permit icmp any any echo
access-list 131 permit icmp any any echo-reply
access-list 131 permit icmp any any time-exceeded
access-list 131 permit icmp any any unreachable
access-list 131 permit icmp any any administratively-prohibited
access-list 131 permit icmp any any packet-too-big
access-list 131 permit icmp any any traceroute
access-list 131 deny icmp any any
access-list 131 remark *************************************************************
access-list 131 remark *** ACL PER BLOCCARE L'ACCESSO A VIRUS E ATTACCHI ***
access-list 131 deny tcp any any eq 135
access-list 131 deny udp any any eq 135
access-list 131 deny udp any any eq netbios-ns
access-list 131 deny udp any any eq netbios-dgm
access-list 131 deny tcp any any eq 139
access-list 131 deny udp any any eq netbios-ss
access-list 131 deny tcp any any eq 445
access-list 131 deny tcp any any eq 593
access-list 131 deny tcp any any eq 2049
access-list 131 deny udp any any eq 2049
access-list 131 deny tcp any any eq 2000
access-list 131 deny tcp any any range 6000 6010
access-list 131 deny udp any any eq 1433
access-list 131 deny udp any any eq 1434
access-list 131 deny udp any any eq 5554
access-list 131 deny udp any any eq 9996
access-list 131 deny udp any any eq 113
access-list 131 deny udp any any eq 3067
access-list 131 remark *************************************************************
access-list 131 remark *** ACL TCP/UDP FORWARDING ***
access-list 131 permit tcp any any eq 4800
access-list 131 permit udp any any eq 4800
access-list 131 remark *************************************************************
access-list 131 remark *** ACL PER BLOCCARE ACCESSI NON AUTORIZZATI ***
access-list 131 deny ip any any log
control-plane
banner motd ^C
****************************************************************
----------------------------------------------------------------
* *** ROUTER PERIMETRALE ---- *** *
----------------------------------------------------------------
* WARNING: System is RESTRICTED to authorized personnel ONLY! *
* Unauthorized use of this system will be logged and *
* prosecuted to the fullest extent of the law. *
* *
* If you are NOT authorized to use this system, LOG OFF NOW! *
* *
****************************************************************
^C
dialer-list 1 protocol ip permit
line con 0
login local
no modem enable
line aux 0
line vty 0 4
privilege level 15
login local
transport input telnet ssh
scheduler max-task-time 5000
scheduler interval 500
sntp server 193.204.114.232
sntp server 207.46.197.32
sntp server 192.43.244.18
endGrazie per la vostra pazienza.
Saluti
, vi posto la configurazione, peraltro banale, di come ho risolto il problema:
