One of the most common tasks dealing with Cisco 881 and other routers is building a site to site VPN tunnel between different geographic locations. Today we will look at an example setting up a VPN tunnel between a main office and a remote branch office.

At our disposal, we have:

Cisco 2800 router in the main office (R-MAIN)
Main office user LAN 192.168.10.0 /24
External static IP address 1.1.1.2 /30
ISP gateway 1.1.1.1 /30

Cisco 881 router in the branch office (R-BRANCH)
Branch office user LAN 192.168.20.0 /24
External static IP address 2.2.2.2 /30
ISP gateway 2.2.2.1 /30

A host or workstation from one Vlan can communicate with hosts located in other VLANs using a Cisco router that would handle the Layer 3 routing between the different  VLANs. The Cisco router has to be connected to the switch through a Trunk port. Each packet of traffic is marked with the VLAN number (called Vlan ID) when it is sent over a trunk port. This allows the participating devices to handle the packets correctly.
The trunk interface on the router is divided into subinterfaces with the matching IP addresses for each VLAN subnet.
Here we have an example of a configured trunk port on Cisco 2811 router that is connected to a Layer 2 switch. Note that the configuration commans will be the same for all Cisco routers like Cisco ASR1000, ISR 4000 or any other.

Video version of this article

Enter the configuration mode:

R-DELTACONFIG#conf t

Sadly enough, sometimes network equipment goes out of order. This, of course, happens when you're least expecting it. In most cases that I've come across throughout my work, this is what happens: Cisco ASA is unexpectedly powered down or reloaded (due to planned or unplanned power outage, thunderstorm or work with electric equipment), and after reload, the interfaces, VPN tunnels and other services don't come back up. We're not going to examine the situation in which the device cannot turn on entirely and all the LED indicators are dead - in that case, a replacement for the device is the only viable option. Let's focus on the situation when the Cisco ASA device is still operable, but does not perform a full load - i.e. the Cisco IOS operating system image can't load properly. In this case, there is still a chance to reanimate the device, at least until you get a new one for replacement.

The first thing we need to do is connect to the firewall through a console cable. If the firewall does not respond to any commands and produces no output on the console screen, then you've reached the worst-case scenario - you can thank the device for its long and fruitful service and put it on a shelf. However, if you are seeing some activity on the console screen, it's not that bad and you can try to understand what's going on. The firewall may have entered into the special ROMMON mode (under normal circumstances, this mode is activated by pressing the ESC key during boot-up) or is in a cyclic reload that happens as it tries to load the operating system image.

The special ROMMON mode looks something like this:
Use ? for help.
ROMMON #0>

Once you're in this mode, you should try to force the device to start by entering the system command "boot":
ROMMON #0> boot

This material follows up on the topic covered in the Configuring VPN between two Cisco routers, but is being dedicated an entirely separate article, since it deals explicitly with configuring Cisco ASA devices.

The task will again consist of connecting a main and a branch office through VPN, but this time the main office works on a Cisco ASA 5510 firewall instead of a Cisco 2800 router.

At our disposal we have:
Cisco ASA 5510 firewall in the main office

Users are inside LAN 192.168.10.0 /24 External static IP address is 1.1.1.2 /30 ISP gateway is 1.1.1.1 /30

Router Cisco 881 at the branch office

In everyday work, it’s often necessary to determine the switch and port a user or device is connected to. To do it, you don’t have to look for it visually. All you need is to know its MAC address.
The point is that each switch stores information about all MAC addresses that showed at least any network activity in the last few minutes. Your task is to use this information wisely.
So, let’s say you need to find the switch port a user John is connected to. It’s known that the IP address of his computer is 192.168.10.100

There are two possible ways of how you can determine the MAC address:

To execute the ipconfig /all command in the command line on the user’s computer

Or

Let’s look over an example of how to connect an office LAN to the Internet with using a Cisco ASA firewall. For this example, we will use the junior model of the lineup – Cisco ASA 5505. Its main distinction from the higher-end models is the 8-port integrated switch, that allows to have 8 switch ports on board(Layer 2 of OSI model) . These ports cannot have an IP address assigned to them, but if you want to create Layer 3 interfaces, you can configure a virtual interface (VLAN) and assign IP addresses there. Assigning a port to a VLAN will allow you to use an IP address for that port, just like assigning one to an interface of a router.

In this example we will use:

An Internet uplink with static IP address Several hosts inside the office’s Local Area Network (LAN) Cisco ASA 5505 firewall Layer 2 switch (used only to connect the LAN hosts, without any additional configuration)

Our task: allow the internal LAN hosts to access the Internet through the firewall.

Once you start working with Cisco routers, you may wonder how you set up a SSH connection to a router. Five easy steps to do it are below.
We'll take a Cisco 881 router. Steps to set up a connection to a different router (1841, 2800, 3825, etc.) or a switch (2900, 3500, 4800, etc.) are pretty much the same, though interface configuration can be a little different. (Setting up a SSH connection to Cisco ASA firewalls is described in the article "Cisco ASA basic Internet access")
So, we have on hand

a Cisco 881 router, an administrator's workstation, several PC's in the office LAN, a switch connecting the PC's together on the LAN.

The task is to configure a secure connection to the Cisco router via SSH and provide a means of secure remote control.

Step 0. Configuring an interface

The router should have one interface, the one that is going to be used for remote control, enabled. In our case, it'll be a LAN Fastethernet 0 interface.

Let’s see how to connect an office to the Internet using a Cisco router.
Let’s take Cisco 881 for example. Commands for configuration of other routers (1841, 2800, 3825…) will be the same. They may differ only in configuration of interfaces, i.e. their names and numbers.

The scheme includes

an Internet connection with a static address several PCs in the office local network a router a switch for creating an office local network

Task: provide access for LAN computers to the Internet

This article describes how to configure Dual WAN connection on Cisco ASA. If you need to configure the same on any Cisco router like Cisco 881 then read the article "IP SLA on Cisco router"

Sooner or later, every network administrator encounters a channel going down, whether it is an ISP uplink to the Internet or a WAN circuit to some other resources. Most of the time this serves as that “a-ha” moment that forces us to think about creating some kind of a backup mechanism (too bad that we didn’t think about such things in advance!). Yet, if there are two ISPs available, you have the opportunity to configure a redundant connection scheme that will help you avoid downtime.

Ideally, you would place a router, connect two ISPs to it, reserve an autonomous system with public IP addresses and configure a fully redundant connection scheme with BGP protocol (Cisco ASA series support BGP only on 5500X models and with the latest versions of IOS). However, this approach suits only large companies with enough resources, capacity, and trained personnel.

In most cases configuring a backup ISP to be used in case of main channel failure is the most adequate solution. Cisco ASA devices have the capability to monitor the availability of the primary ISP channel and switching over to the configured backup in case of its failure (when the gateway fails to respond to ICMP requests over several seconds).

Let’s consider the simplest case when you have to hook up 3 departments of a company to different logical networks (Vlans) using one access layer switch Cisco 2960 (Sometimes they are called switches of the second layer of OSI model).

For example we need to organize these networks (Vlan):

Sales department (192.168.10.0 255.255.255.0) Accounting department (192.168.20.0 255.255.255.0) Administrators (192.168.100.0 255.255.255.0) Special network for managing the network equipment (192.168.1.0 255.255.255.0)

Video version of this article