Basic configuration of the Cisco router. Access to the Internet.

Let’s see how to connect an office to the Internet using a Cisco router.
Let’s take Cisco 881 for example. Commands for configuration of other routers (1841, 2800, 3825…) will be the same. They may differ only in configuration of interfaces, i.e. their names and numbers.

The scheme includes

• an Internet connection with a static address
• several PCs in the office local network
• a router
• a switch for creating an office local network

Task: provide access for LAN computers to the Internet

Step 0. Clearing the configuration

The first thing to do when configuring a new router is to completely clear the startup configuration.
(Do it only on new or test devices!)
To do that, connect via a special console cable to the router console port, enter the command line and do the following:

Enter the privileged mode(#), you may need to enter a login name/password for that.

Erase the startup configuration

Reload the router

The router will reboot within 3 minutes and initial configuration dialog will appear. Type “no” and move to next step.

The current router configuration will have only default technological lines, and you can start the main configuration.

Step 1. Device name

Use the hostname «device name» command to set a router name. It will help you in future.

Step 2. Configuration of interfaces

We should configure two interfaces: external and internal ones.
The external interface will be used for connecting to the Internet. It will have the IP address and network mask provided by the ISP.
The internal interface will be configured for the local network 192.168.0.0 /24
For example, the ISP has provided us with the following addresses:

• Network 200.150.100.0
• Subnet mask 255.255.255.252 or /30
• Default gateway 200.150.100.1

Let’s configure the external interface: set an IP address and a network mask and enable it using the no shut command

Then, connect this router interface to the port of the provider’s equipment using a direct patch cord and check its availability with the ping command.

At first, the own interface

Then, the adjacent address – a provider’s gateway

After making sure that the provider’s gateway is available, we should configure the internal interface.
The local network will have the following addresses:

• Network 192.168.0.0
• Subnet mask 255.255.255.0
• Internal router address acting as an Internet gateway for all network hosts, 192.168.0.1
• I recommend starting the range of internal network addresses (users, printers, servers, etc.) with 192.168.0.5
• The max available address in this network is 192.168.0.254
• Let’s reserve addresses from 192.168.0.2 to 192.168.0.4 for emergency technological needs

To configure the internal interface of the local network, enter the Vlan 1 configuration mode, set an IP address and link it with one of the router’s physical interfaces (Fa 0).

Choose a physical router interface and link it with the virtual Vlan.

This could help for better understanding:
ip address => interface Vlan X => interface Fastethernet Y
The IP address is assigned to the Vlan X virtual interface, which is linked with the Fastethernet Y physical interface.

Connect the Fa 0 router interface to the switch with the working stations of the local network or directly with the administrator’s working station.
Then, check the availability of this router interface using the ping command from the command line.

Step 3. Configuration of the remote router access

You can access the router console not only using a console cable, but also remotely using the Telnet (data is transferred unsecure) and SSH (secure connection).

Let’s see how to configure the secure connection.

Enable the SSH version 2 protocol and set any domain name.

Generate the rsa keys required for connection. Enter 1024 at the request.

Set a user name with administrator rights and the password (*****)

Enable authorization through the device local base (the user you have created a line before).

Set a password for the privileged mode.

Then, using a special program supporting the SSH protocol, you can remotely enter the router console from any working station of the local network. For authorization, enter the login name and password set earlier.
You can learn more about access to the device using the SSH protocol in this article.

Step 4. Default gateway

For routing of packages to the Internet, we should define a default gateway of the device.

After that, you can check not only availability of provider’s equipment, but of the whole Internet connection.
For that, launch ping to any address in the external network in digital format (I recommend configuring DNS for the local network after configuration of the router).
Let’s take the google’s address (8.8.8.8) for example.

Step 5. Configuration of network address translation (NAT)

For Internet access from the local network, we should dynamically translate all internal addresses to a certain external IP address.

In our case, as the ISP gives us only with one external address 200.150.100.2 (defined by the /30 subnet mask as given in the example above), all local network addresses should be translated to it.

Define a list of internal addresses for translation to the external address.

Define the internal interface for translation.

Define the external interface for translation.

Create the network address translation (NAT) rule.

As a result, you should have Internet access from any workstation of the local network if their default gateway is the internal IP address of the router (192.168.0.1).

You can check this using the ping command to an Internet address from the command line. The address should be better in digital format to avoid potential problems with DNS names (Use 8.8.8.8 to check the connection).

You can learn more about how to do it in the article “a little about access lists”.