Routing for Verizon FIOS -- Reward for answer

Routing for Verizon FIOS -- Reward for answer
NewsGroups | Search | Tools
User Password
Register Now! Lost Password?
 comp.dcom.sys.cisco  Post an article  get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content  add this group's latest topics to your Google content  YahooMyWeb Yahoo!  Google Google  Windows Live Favorites Windows Live  del.icio.us del.icio.us  digg digg  Add to Netscape Netscape
Subject Author Date
Routing for Verizon FIOS -- Reward for answer Fletcher James 05-03-2008
Posted by Fletcher James on May 3, 2008, 12:24 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
This is your opportunity to be a Cisco hero (and to earn a tin of incredible
cookies, with the first correct answer.) I suspect that the right person
can solve this problem in a snap, but the solution has been eluding us for
over a month.

We have been assigned a block of 64 static IP addresses (actually, 61) by
Verizon, for our Business FIOS network. Let's call our addresses
70.x.x.64/26.

We wish to place a Cisco 1841 directly on the FIOS connection, and then have
a handful of devices inside (perimeter network), connected by a simple
Ethernet switch. Most of the addresses will be handled by an ISA server
(firewall/NAT, which protects our LAN and a separate Web Server zone), but a
few other devices will be independent (e.g. a videoteleconference unit which
doesn't play well inside the firewall, a wireless router for untrusted
devices, etc.)

For many reasons, it would be best if we were simply routing our traffic to
the inside of the Cisco, so that our 70.x.x.64/26 subnet is on the INSIDE of
the 1841.

The problem we have is this: Verizon's gateway is 70.x.x.1. Unlike our
other ISPs, they have NOT assigned us a separate 30-bit subnet with an
address for our router (in this case, that would be 70.x.x.2). I think
Verizon just expected us to NAT everything immediately after their
interface, the way that residential customers do with their Actiontec
router/firewall units.

So the problem is: What do we use as an address for the outside interface
of our router, which will allow it to route traffic to the gateway, OR, how
do we otherwise deal with this problem?

To demonstrate: If we assign our router's outside to .66 (they've told us
not to use .65) then we need a netmask of 255.255.255.128 so that we can
route outbound through the gateway. Unfortunately, that then defines ALL of
our public addresses as being on the outside of the router. We've looked at
a long list of solutions, and none of them are very good:

OPTION A: Currently, we have declared our outside interface as
70.x.x.126/24. We then force all of our inbound traffic to the inside with
a long list of entries such as:

ip route 70.x.x.69 255.255.255.255 FastEthernet0/0

This works, but poorly -- I suspect there's a lot of unnecessary ARPing
going on.

OPTION B: We could keep the public addresses on the outside, and then NAT
them to private addresses between the Cisco and the perimeter network (e.g.
70.x.x.69 --> 10.0.0.69) and then NAT them a second time in the ISA server.
Yuch.

OPTION C: We could "steal" the address 70.x.x.2/30 for our outside
interface,and hope that it never causes a problem (We've tried this, but
have had inconsistent results -- it works, and then when we re-boot our
router it mysteriously fails.)

OPTION D: We could assign a PRIVATE address to the outside of our router --
say, 10.1.1.1. But then, how would we direct traffic to our gateway? If we
provide a default route just by interface

ip route 0.0.0.0 0.0.0.0 FastEthernet0/1)

then it's got to ARP for every single outbound address. QUESTION: would the
following solve that problem:

ip route 0.0.0.0 0.0.0.0 70.x.x.1

ip route 70.x.x.1 255.255.255.255 FastEthernet0/1

OPTION E:
You're the genius. Tell us Option E.

I would very much appreciate it if you could cc me directly on any reply.

Thanks!

Fletcher James
President
Levit & James, Inc.
703-771-1549
http://www.levitjames.com




Pure Networks
Posted by Trendkill on May 3, 2008, 3:23 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
> This is your opportunity to be a Cisco hero (and to earn a tin of incredib=
le
> cookies, with the first correct answer.) =A0I suspect that the right perso=
n
> can solve this problem in a snap, but the solution has been eluding us for=

> over a month.
>
> We have been assigned a block of 64 static IP addresses (actually, 61) by
> Verizon, for our Business FIOS network. =A0Let's call our addresses
> 70.x.x.64/26.
>
> We wish to place a Cisco 1841 directly on the FIOS connection, and then ha=
ve
> a handful of devices inside (perimeter network), connected by a simple
> Ethernet switch. =A0Most of the addresses will be handled by an ISA server=

> (firewall/NAT, which protects our LAN and a separate Web Server zone), but=
a
> few other devices will be independent (e.g. a videoteleconference unit whi=
ch
> doesn't play well inside the firewall, a wireless router for untrusted
> devices, etc.)
>
> For many reasons, it would be best if we were simply routing our traffic t=
o
> the inside of the Cisco, so that our 70.x.x.64/26 subnet is on the INSIDE =
of
> the 1841.
>
> The problem we have is this: =A0Verizon's gateway is 70.x.x.1. =A0Unlike o=
ur
> other ISPs, they have NOT assigned us a separate 30-bit subnet with an
> address for our router (in this case, that would be 70.x.x.2). =A0I think
> Verizon just expected us to NAT everything immediately after their
> interface, the way that residential customers do with their Actiontec
> router/firewall units.
>
> So the problem is: =A0What do we use as an address for the outside interfa=
ce
> of our router, which will allow it to route traffic to the gateway, OR, ho=
w
> do we otherwise deal with this problem?
>
> To demonstrate: =A0If we assign our router's outside to .66 (they've told =
us
> not to use .65) then we need a netmask of 255.255.255.128 so that we can
> route outbound through the gateway. =A0Unfortunately, that then defines AL=
L of
> our public addresses as being on the outside of the router. =A0We've looke=
d at
> a long list of solutions, and none of them are very good:
>
> OPTION A: Currently, we have declared our outside interface as
> 70.x.x.126/24. =A0We then force all of our inbound traffic to the inside w=
ith
> a long list of entries such as:
>
> ip route 70.x.x.69 255.255.255.255 FastEthernet0/0
>
> This works, but poorly -- I suspect there's a lot of unnecessary ARPing
> going on.
>
> OPTION B: We could keep the public addresses on the outside, and then NAT
> them to private addresses between the Cisco and the perimeter network (e.g=
.
> 70.x.x.69 --> 10.0.0.69) and then NAT them a second time in the ISA server=
.
> Yuch.
>
> OPTION C: We could "steal" the address 70.x.x.2/30 for our outside
> interface,and hope that it never causes a problem (We've tried this, but
> have had inconsistent results -- it works, and then when we re-boot our
> router it mysteriously fails.)
>
> OPTION D: =A0We could assign a PRIVATE address to the outside of our route=
r -- =A0
> say, 10.1.1.1. =A0But then, how would we direct traffic to our gateway? =
=A0If we
> provide a default route just by interface
>
> ip route 0.0.0.0 0.0.0.0 FastEthernet0/1)
>
> then it's got to ARP for every single outbound address. =A0QUESTION: would=
the
> following solve that problem:
>
> ip route 0.0.0.0 0.0.0.0 70.x.x.1
>
> ip route 70.x.x.1 255.255.255.255 FastEthernet0/1
>
> OPTION E:
> You're the genius. =A0Tell us Option E.
>
> I would very much appreciate it if you could cc me directly on any reply.
>
> Thanks!
>
> Fletcher James
> President
> Levit & James, Inc.
> 703-771-1549http://www.levitjames.com

Can you get verizon to sell you another separate /31 (yes a /31 works,
we use them all the time for point to point routing adjacencies) and
then setup routing on both sides? Else I don't see why you can't
carve out the /30 as you have said, and ensure that Verizon and you
are advertising properly on both sides. Or install a switch between
them and you for external hosts and NAT for anything going internal.
Not sure you can do that with FIOS, never had to deal with it.

Posted by Thrill5 on May 4, 2008, 3:14 am
If you were  Registered and logged in, you could reply and use other advanced thread options
It is never "best" to simply route traffic to your inside network. The
only reason you need a public IP is if you are accepting connections from an
internet source, which should only be a few devices (your mail server, web
server and VPN concentrator, etc.) All of your inside traffic for web
browsing can be NATed to a singe outside address Your video conference
station should be able to have two addresses, the inside address on your
LAN, and the outside address that it is NATed to.

You can also request a separate address from Verizon so that the connection
between your router and their connection is on a different subnet than the
block they assigned you. If you can't do that, your only option is to
bridge the traffic which, in my opinion, is the worst case option.


> This is your opportunity to be a Cisco hero (and to earn a tin of
> incredible cookies, with the first correct answer.) I suspect that the
> right person can solve this problem in a snap, but the solution has been
> eluding us for over a month.
>
> We have been assigned a block of 64 static IP addresses (actually, 61) by
> Verizon, for our Business FIOS network. Let's call our addresses
> 70.x.x.64/26.
>
> We wish to place a Cisco 1841 directly on the FIOS connection, and then
> have a handful of devices inside (perimeter network), connected by a
> simple Ethernet switch. Most of the addresses will be handled by an ISA
> server (firewall/NAT, which protects our LAN and a separate Web Server
> zone), but a few other devices will be independent (e.g. a
> videoteleconference unit which doesn't play well inside the firewall, a
> wireless router for untrusted devices, etc.)
>
> For many reasons, it would be best if we were simply routing our traffic
> to the inside of the Cisco, so that our 70.x.x.64/26 subnet is on the
> INSIDE of the 1841.
>
> The problem we have is this: Verizon's gateway is 70.x.x.1. Unlike our
> other ISPs, they have NOT assigned us a separate 30-bit subnet with an
> address for our router (in this case, that would be 70.x.x.2). I think
> Verizon just expected us to NAT everything immediately after their
> interface, the way that residential customers do with their Actiontec
> router/firewall units.
>
> So the problem is: What do we use as an address for the outside interface
> of our router, which will allow it to route traffic to the gateway, OR,
> how do we otherwise deal with this problem?
>
> To demonstrate: If we assign our router's outside to .66 (they've told us
> not to use .65) then we need a netmask of 255.255.255.128 so that we can
> route outbound through the gateway. Unfortunately, that then defines ALL
> of our public addresses as being on the outside of the router. We've
> looked at a long list of solutions, and none of them are very good:
>
> OPTION A: Currently, we have declared our outside interface as
> 70.x.x.126/24. We then force all of our inbound traffic to the inside
> with a long list of entries such as:
>
> ip route 70.x.x.69 255.255.255.255 FastEthernet0/0
>
> This works, but poorly -- I suspect there's a lot of unnecessary ARPing
> going on.
>
> OPTION B: We could keep the public addresses on the outside, and then NAT
> them to private addresses between the Cisco and the perimeter network
> (e.g. 70.x.x.69 --> 10.0.0.69) and then NAT them a second time in the ISA
> server. Yuch.
>
> OPTION C: We could "steal" the address 70.x.x.2/30 for our outside
> interface,and hope that it never causes a problem (We've tried this, but
> have had inconsistent results -- it works, and then when we re-boot our
> router it mysteriously fails.)
>
> OPTION D: We could assign a PRIVATE address to the outside of our
> router -- say, 10.1.1.1. But then, how would we direct traffic to our
> gateway? If we provide a default route just by interface
>
> ip route 0.0.0.0 0.0.0.0 FastEthernet0/1)
>
> then it's got to ARP for every single outbound address. QUESTION: would
> the following solve that problem:
>
> ip route 0.0.0.0 0.0.0.0 70.x.x.1
>
> ip route 70.x.x.1 255.255.255.255 FastEthernet0/1
>
> OPTION E:
> You're the genius. Tell us Option E.
>
> I would very much appreciate it if you could cc me directly on any reply.
>
> Thanks!
>
> Fletcher James
> President
> Levit & James, Inc.
> 703-771-1549
> http://www.levitjames.com
>
>
>



Posted by Darren Green on May 4, 2008, 7:16 am
If you were  Registered and logged in, you could reply and use other advanced thread options
> It is never "best" to simply route traffic =A0to your inside network. =A0T=
he
> only reason you need a public IP is if you are accepting connections from =
an
> internet source, which should only be a few devices (your mail server, web=

> server and VPN concentrator, etc.) =A0All of your inside traffic for web
> browsing can be NATed to a singe outside address =A0 Your video conference=

> station should be able to have two addresses, the inside address on your
> LAN, and the outside address that it is NATed to.
>
> You can also request a separate address from Verizon so that the connectio=
n
> between your router and their connection is on a different subnet than the=

> block they assigned you. =A0If you can't do that, your only option is to
> bridge the traffic which, in my opinion, is the worst case option.
>
>
>
>
>
> > This is your opportunity to be a Cisco hero (and to earn a tin of
> > incredible cookies, with the first correct answer.) =A0I suspect that th=
e
> > right person can solve this problem in a snap, but the solution has been=

> > eluding us for over a month.
>
> > We have been assigned a block of 64 static IP addresses (actually, 61) b=
y
> > Verizon, for our Business FIOS network. =A0Let's call our addresses
> > 70.x.x.64/26.
>
> > We wish to place a Cisco 1841 directly on the FIOS connection, and then
> > have a handful of devices inside (perimeter network), connected by a
> > simple Ethernet switch. =A0Most of the addresses will be handled by an I=
SA
> > server (firewall/NAT, which protects our LAN and a separate Web Server
> > zone), but a few other devices will be independent (e.g. a
> > videoteleconference unit which doesn't play well inside the firewall, a
> > wireless router for untrusted devices, etc.)
>
> > For many reasons, it would be best if we were simply routing our traffic=

> > to the inside of the Cisco, so that our 70.x.x.64/26 subnet is on the
> > INSIDE of the 1841.
>
> > The problem we have is this: =A0Verizon's gateway is 70.x.x.1. =A0Unlike=
our
> > other ISPs, they have NOT assigned us a separate 30-bit subnet with an
> > address for our router (in this case, that would be 70.x.x.2). =A0I thin=
k
> > Verizon just expected us to NAT everything immediately after their
> > interface, the way that residential customers do with their Actiontec
> > router/firewall units.
>
> > So the problem is: =A0What do we use as an address for the outside inter=
face
> > of our router, which will allow it to route traffic to the gateway, OR,
> > how do we otherwise deal with this problem?
>
> > To demonstrate: =A0If we assign our router's outside to .66 (they've tol=
d us
> > not to use .65) then we need a netmask of 255.255.255.128 so that we can=

> > route outbound through the gateway. =A0Unfortunately, that then defines =
ALL
> > of our public addresses as being on the outside of the router. =A0We've
> > looked at a long list of solutions, and none of them are very good:
>
> > OPTION A: Currently, we have declared our outside interface as
> > 70.x.x.126/24. =A0We then force all of our inbound traffic to the inside=

> > with a long list of entries such as:
>
> > ip route 70.x.x.69 255.255.255.255 FastEthernet0/0
>
> > This works, but poorly -- I suspect there's a lot of unnecessary ARPing
> > going on.
>
> > OPTION B: We could keep the public addresses on the outside, and then NA=
T
> > them to private addresses between the Cisco and the perimeter network
> > (e.g. 70.x.x.69 --> 10.0.0.69) and then NAT them a second time in the IS=
A
> > server. Yuch.
>
> > OPTION C: We could "steal" the address 70.x.x.2/30 for our outside
> > interface,and hope that it never causes a problem (We've tried this, but=

> > have had inconsistent results -- it works, and then when we re-boot our
> > router it mysteriously fails.)
>
> > OPTION D: =A0We could assign a PRIVATE address to the outside of our
> > router -- =A0say, 10.1.1.1. =A0But then, how would we direct traffic to =
our
> > gateway? =A0If we provide a default route just by interface
>
> > ip route 0.0.0.0 0.0.0.0 FastEthernet0/1)
>
> > then it's got to ARP for every single outbound address. =A0QUESTION: wou=
ld
> > the following solve that problem:
>
> > ip route 0.0.0.0 0.0.0.0 70.x.x.1
>
> > ip route 70.x.x.1 255.255.255.255 FastEthernet0/1
>
> > OPTION E:
> > You're the genius. =A0Tell us Option E.
>
> > I would very much appreciate it if you could cc me directly on any reply=
.
>
> > Thanks!
>
> > Fletcher James
> > President
> > Levit & James, Inc.
> > 703-771-1549
> >http://www.levitjames.com- Hide quoted text -
>
> - Show quoted text -

Out of interest, could you not assign the ip address to the LAN side
of the router and on the WAN port use ip unnumbered to the LAN
interface.

int Fa0/X
ip address 70.x.x.X /26
int Serial X/X
ip unnumbered Fa0/X

I seem to recall I have have done this in the past mainly on ADSL
boxes where the client wanted to present a public IP address
internally..

Regards

Darren

Posted by Merv on May 4, 2008, 4:26 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

1. It appears that the router in question is using a Fast Ethernet
interface facing the FIOS ONT.
If this is in fact the case then an ip unnumbered command will be
rejected on a multi-access interface.
ip unnumbered can only be used on point-to-point serial interfaces.


2. The following static routing construct is viable:
ip classless
ip route 0.0.0.0 0.0.0.0 70.x.x.1
ip route 70.x.x.1 255.255.255.255 FastEthernet0/1


Option D would probably work but it is definitely a cludge.

The suggestion by other responders to approach Verizon to see if they
will provide a /30 or /31 for the FIOS link would definitely be
worthwhile pursuing.

However be forewarned that if Verizon has not planned for this
"feature", it will impact their service provisioning systems and they
will less inclined to provide what you are looking for - i.e a /30 for
the FIOS link.






Similar ThreadsPosted
Re: Excessive interface resets on Cisco 1841 and FIOS line February 6, 2008, 9:26 pm
Nobody knows the Answer!!! :-( August 20, 2004, 2:56 am
Re: Why didn't Verizon sue Cisco instead? March 11, 2007, 12:10 pm
PIX 501 Verizon Infospeed DSL November 22, 2007, 9:04 pm
Verizon TLS (Q in Q) multicast challenge February 21, 2006, 10:20 pm
Ring no Answer on as5800? November 9, 2004, 10:32 am
WIC-1AM - auto answer question June 29, 2006, 9:59 am
Cisco 1750 again - still no right answer :( October 24, 2006, 2:45 pm
Dropping Connections (Verizon Aircard) October 29, 2007, 12:41 pm
CISCO PIX hard question, can you answer it? TIA September 1, 2005, 3:01 pm

other useful resources:
The Federal Communications Commission (FCC)
Telecommunications Industry Association
Electronic and Software Security Products and Services
International Telecommunication Union

Custom CGI Perl and PHP programming by 1-Script.com

Contact Us | Privacy Policy
The site map in XML format XML site map