Routing for Verizon FIOS -- Reward for answer

Fletcher James · 2008-05-03T16:24:04+00:00

This is your opportunity to be a Cisco hero (and to earn a tin of incredible cookies, with the first correct answer.) I suspect that the right person can solve this problem in a snap, but the solution has been eluding us for over a month.We have been assigned a block of 64 static IP addresses (actually, 61) by Verizon, for our Business FIOS network. Let's call our addresses 70.x.x.64/26.We wish to place a Cisco 1841 directly on the FIOS connection, and then have a handful of devices inside (perimeter network), connected by a simple Ethernet switch. Most of the addresses will be handled by an ISA server (firewall/NAT, which protects our LAN and a separate Web Server zone), but a few other devices will be independent (e.g. a videoteleconference unit which doesn't play well inside the firewall, a wireless router for untrusted devices, etc.)For many reasons, it would be best if we were simply routing our traffic to the inside of the Cisco, so that our 70.x.x.64/26 subnet is on the INSIDE of the 1841.The problem we have is this: Verizon's gateway is 70.x.x.1. Unlike our other ISPs, they have NOT assigned us a separate 30-bit subnet with an address for our router (in this case, that would be 70.x.x.2). I think Verizon just expected us to NAT everything immediately after their interface, the way that residential customers do with their Actiontec router/firewall units.So the problem is: What do we use as an address for the outside interface of our router, which will allow it to route traffic to the gateway, OR, how do we otherwise deal with this problem?To demonstrate: If we assign our router's outside to .66 (they've told us not to use .65) then we need a netmask of 255.255.255.128 so that we can route outbound through the gateway. Unfortunately, that then defines ALL of our public addresses as being on the outside of the router. We've looked at a long list of solutions, and none of them are very good:OPTION A: Currently, we have declared our outside interface as...

T

Trendkill 18 years ago

Yes, except you would need to ensure Verizon adds a route (or turn up a protocol) to ensure that they know how to get back into the second half of your range. They would also need to turn up a secondary address, as .98/27 doesn't include .1 which is the gateway. You could turn up .68/30 with .69 as their secondary IP, .70 as your router, and then .96/27 on the inside interface. You'd lose .71-.95 unless you want to subinterface the router's connection back to the internal switch and trunk a /29, /28, and /27 instead. Although since Verizon doesn't seem to be able to do anything but transfer your calls, they probably won't turn up a secondary interface (even if its in your address range), and most likely will not add a static route for those subnets. May be worth a call though.....

Vote

S

stephen 18 years ago

No - proxy ARP should take care of this is it is enabled on the cisco WAN interface.

The cisco will repond to ARP requests where it is the preferred route to the destination IP - in this case any IP addresses on the LAN side of the cisco.

You can map further blocks on the LAN with static routes to the LAN side interface if the WAN side is only a small block such as a /30.

ip route 70.x.x.80 255.255.255.240 FastEth 0/0 for example maps another 16 addresses.

They would also need to turn up a secondary

Golden rule with a carrier who doesnt seem to have systems to do something, is not to ask for anything non standard (ie not standard for them).

Even if you get it sorted and it works, can you get it to stay like that, or will someone "fix" it for you when they notice ?

Vote

D

Dan Lanciani 18 years ago

| Based on numerous tests, I have come to the conclusion that the | router/switch on Verizon's side is totally spoof protected: It will not | respond to an ARP query unless the source address is one of the 61 addresses | assigned to us

You could always add a static arp entry for Verizon's gateway on your end and proceed with option D as I indicated. Of course, if they change their MAC address you will lose connectivity until you adapt.

| (we've tried .2 and also tried assigning 10.1.1.1 to the | outside of the router, and giving a static route to our gateway.) In one | case, .2 worked briefly -- probably because we had just swiched over, and it | had an association of our MAC address with a valid IP.

Possibly there had been an incoming packet to which your router had responded as a proxy. That would not look spoofed since the address would be in your range, and in any case your router would have picked up the MAC address of Verizon's router in the process.

Dan Lanciani ddl@danlan.*com

Vote

D

Dan Lanciani 18 years ago

| Based on numerous tests, I have come to the conclusion that the | router/switch on Verizon's side is totally spoof protected: It will not | respond to an ARP query unless the source address is one of the 61 addresses | assigned to us

You could always add a static arp entry for Verizon's gateway on your end and proceed with option D as I indicated. Of course, if they change their MAC address you will lose connectivity until you adapt.

| (we've tried .2 and also tried assigning 10.1.1.1 to the | outside of the router, and giving a static route to our gateway.) In one | case, .2 worked briefly -- probably because we had just swiched over, and it | had an association of our MAC address with a valid IP.

Possibly there had been an incoming packet to which your router had responded as a proxy. That would not look spoofed since the address would be in your range, and in any case your router would have picked up the MAC address of Verizon's router in the process.

Dan Lanciani ddl@danlan.*com

Vote

C

Charles N Wyble 18 years ago

Would a sub interface help here at all? Say interface FastEthernet0/1.1

I haven't read the whole thread yet, but that might help if you only wanted certain traffic using it?

Charles

Vote

T

Trendkill 18 years ago

A subinterface will not help this situation. A subint only divides the networks that can be accessible on the physical interface, and really provides the exact same functionality as having two different physical/logical interfaces when either you or your provider does not have or want to pay for the additional connectivity. This is why subints are usually reserved for routers on a stick (for creating/ trunking vlans) and for WAN Service frame-relay/WAN. At this point the only solution is a band-aid until he finds better service from Verizon to split out his point to point network w/ them from his contiguous address space.

Vote