1. Home
  2. Nortel Networks
  3. 1010 Branch Office Connection with no public network

1010 Branch Office Connection with no public network

We are trying to configure a Nortel 1010 for a Branch Office connection to a site that does not have a "public" network. They have access to the internet via DSL, and have a DLINK router behind the DSL modem that provides connectivity to all the systems at the site. The site therefore has just one public IP - the one associated with the DSL modem. This presents a dilemma since we do not have a public IP to associate with the public interface on the 1010. What we have done in the past was to take their private network and split it up with subnet masking to fool the 1010 into thinking there is a private network and a public network. The private network would include the IP address for the 1010's private interface, the mgmt IP and the IP of the host to which we are transferring data. The mgmt IP would also function as the static route. The public network would include the 1010's public interface as well as the site's default gw IP. For example, if a site uses 192.168.0.0/24 on their inside network, with 192.168.0.1 assigned to the DLINK router and 192.168.0.9 assigned to the host, we would give the public interface on the 1010 the IP address 192.168.0.2 and make the subnet mask of the public network 255.255.255.252. For the private network, we would assign .10 to the private interface and make .11 the mgmt IP. The private network would be composed of three "networks" which were actually just the three hosts -

192.168.0.9/32, 192.168.0.10/32 and 192.168.0.11/32 - with the mgmt IP as the static route. This used to work fine, but then we started having intermittent connectivity issues with 1010's configured this way. So, we aren't dead set on continuing this method - we just need to find something that works for this scenario, and would appreciate any suggestions.
Reply to
neicymath
Loading thread data ...

why not just replace the DLink router with the 1010?

Reply to
Ray

Sorry, I should have been more clear. The site is a client of our business, not one of our own "branch offices". We need to send our business-related data to them securely, but we are not going to be providing all of their internet connectivity. So, we need to create a VPN tunnel with them which will fit into their existing network structure, but we cannot replace their structure. Hope that makes more sense. If they had something other than a DLink, we could probably just create a tunnel using their existing device. But unfortunately they (and many of our clients) don't, so we are trying to secure the data without asking the client change their existing infrastructure.

Reply to
neicymath

I found that our Linksys router had an 'IPSEC pass through' feature which allowed 'regular' traffic to be NATted but allowed Contivity clients in and out OK...just a thought...

Reply to
Ray

thanks for the idea. perhaps the client's DLink has something similar. But it is still a mystery as to how we are supposed to configure the public and private interfaces when there is not a public network.

Reply to
neicymath

does the 1010 support IP alias? I spend time with 221s and they do. Proved useful once or twice!

Reply to
Ray

I don't think the issue is the fact that the client has a private network only. We've been doing lots of testing and have used two hubs to make the "private" network separate from the "public" network physically and have assigned a different subnet to the private network than what we are using for the public network. (The public network behind the DSL modem is using 192.168.0.0/30 and the private network is using 25.25.25.0/24.) We can get the tunnel to come up just fine. I can ping the mgmt IP on the 1010 and the host on the private network sometimes. Sometimes I cannot. I have found that when I cannot, if I let the ping run continuously, then I do get an echo every 240 pings, or every four minutes. Weird.

Reply to
neicymath

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.