Routers

L2TP technology on Cisco routers is usually used when it is necessary to provide simple and secure remote access for company employees.

 

Technology benefits

The situation occurred due to the coronavirus pandemic demonstrated the importance of having remote access for employees to the company resources. Which of course, has to be easy, convenient and secure.

Recently remote access technology was a privilege mainly for top managers and administrators. Now, it is a vital need even for an ordinary employee.

The technology itself and different ways of remote connections already exist for a long time. However, due to its weak spread, most managers don't understand which equipment is needed and how such access can be set up. And most importantly - how much does it cost?

What do we offer

For those companies and managers, who value their time and resources, my colleagues and I offer a turnkey solution for establishing remote access VPN based on the Cisco Systems equipment.

Sooner or later, but every company faces the problem with the Internet connection being out of order. And right after that, the question about backup channel arises. What settings needed to be done to automatically switch to backup link in case of an accident?

This article describes the configurations for Cisco 881 routers and similar models (1841, 1941, 2900, 3800...). If you have Cisco ASA, the settings for it are described in the article Dual WAN on Cisco ASA.

One of the easiest and most effective ways to configure a Cisco router - is using the IP SLA monitor. The device will track the availability of the primary Internet provider, and once the connection is lost (certain address won't respond to ICMP requests during several seconds), it will forward traffic through the backup link.

Overlapping IP address ranges in your own LAN and the local area network of the organization you're partnering with is a common issue that network administrators are faced with in their daily jobs. The textbook solution for this issue is NAT.
Let us skip the explanations of how to do basic configurations for dynamic and static NAT scenarios that you use when you need to hide your internal IP address behind a public IP address in order to get access to outside resources (dynamic NAT), or allow internal resources to be available from the outside world (static NAT). You can find tutorials for these types of configurations in the "Basic Configuration of Cisco Router" and "Basic Configuration of Cisco ASA" articles, as well as the "Using NAT" article.

Destination address substitution

Let us look at an example, in which we need to create a special IP address, that is used to impersonate the real IP address that overlaps with something in your network, and redirects the traffic towards the real destination.

10.0.0.5 – the actual IP address of the server that you need to gain access to
– dummy IP address, that will redirect the user's traffic to 10.0.0.5

The hardest thing about NAT in Cisco routers and ASA firewalls is understanding how to use the technology in real life. Tons of guide papers have been written, the Internet is full of gigabytes of information on the topic, yet the subject remains relevant. Truth is, 95% of absolute majority of people will only need to use just one of the two types of connections.

1) PAT (Port Address Translation)

A bunch of internal IP addresses are translated into a single external IP address when connecting to the outside world. While each packet destined to outside networks is being processed by a router or a Cisco ASA, the correlation of the actual internal IP address and port number of the source of the TCP connection is being remembered, which allows to correctly perform the reverse translation and transfer return packets.
This kind of NAT is used when you need to allow access to external resources (such as the Internet).

2) Static NAT

This is translating addresses one-to-one. A specific public IP address is put together with an internal IP address. This kind of NAT translation is used when you need access world to a server or resource or a DMZ.

How to add a route

By default, any router or firewall is aware only of those networks and subnets that are directly connected to it. This applies likewise to Cisco equipment and any other vendors. If a device has 2 interfaces with IP addresses from different networks assigned, it is capable of forwarding packets between two connected hosts, routing the traffic. That is, of course, if the hosts have that device configured as their default gateway.

The above example is oversimplified and is almost never used in real life. Let's consider a more complex and realistic scenario: we have two locations in a company, with each office having its own LAN that is connected to a router. Between the two offices there is some kind of a point-to-point link.
In this case, by default, each router will only be aware of its LAN and of the link between the offices, but will not know where to forward the packets destined for the other office's LAN. If you issue a ping command, each router will be able to access the outside IP address of the other router, but will not be able to reach any address inside the remote LAN.

In this article we're going to examine how to create and use access lists based on the scenario of connecting a small office network to the Internet with the help of a Cisco 881 router. The command syntax and configuration steps are going to be the same for routers of other models and series (1841, 2800, 3825, etc.), as well as for Layer 3 switches (3500, 4800, etc. series). The differences might come up in the interface configuration for each model.

For our sample network, we have:

several workstations and servers inside the office's Local Area Network Cisco 881 router switch (used only to connect the LAN hosts, has no other configuration)

Our task: limit the traffic that passes through the router

One of the most common tasks dealing with Cisco 881 and other routers is building a site to site VPN tunnel between different geographic locations. Today we will look at an example setting up a VPN tunnel between a main office and a remote branch office.

At our disposal, we have:

Cisco 2800 router in the main office (R-MAIN)
Main office user LAN 192.168.10.0 /24
External static IP address 1.1.1.2 /30
ISP gateway 1.1.1.1 /30

Cisco 881 router in the branch office (R-BRANCH)
Branch office user LAN 192.168.20.0 /24
External static IP address 2.2.2.2 /30
ISP gateway 2.2.2.1 /30

A host or workstation from one Vlan can communicate with hosts located in other VLANs using a Cisco router that would handle the Layer 3 routing between the different  VLANs. The Cisco router has to be connected to the switch through a Trunk port. Each packet of traffic is marked with the VLAN number (called Vlan ID) when it is sent over a trunk port. This allows the participating devices to handle the packets correctly.
The trunk interface on the router is divided into subinterfaces with the matching IP addresses for each VLAN subnet.
Here we have an example of a configured trunk port on Cisco 2811 router that is connected to a Layer 2 switch. Note that the configuration commans will be the same for all Cisco routers like Cisco ASR1000, ISR 4000 or any other.

Video version of this article

Enter the configuration mode:

Let's see how to connect an office to the Internet using a Cisco router.
Let's take Cisco 881 for example. Commands for configuration of other routers (1841, 2800, 3825…) will be the same. They may differ only in configuration of interfaces, i.e. their names and numbers.

The scheme includes

Task: provide access for LAN computers to the Internet