This document outlines the configuration of my Cisco ISR 1000 (C1111-8P) used in a Dual WAN setup. My ISPs are Free and OVH.
I have two VLANs: one is for the LAN and the other functions as a DMZ.
One computer in the DMZ can only access the Internet via OVH.
Security zones are enabled but not currently utilized.
netconan was used to anonymize the configuration.
interface GigabitEthernet0/0/0
description WAN FREE
no ip dhcp client request dns-nameserver
ip address dhcp
ip nat outside
zone-member security WAN_OVH
negotiation auto
I don't need the Free DNS servers, so I added
no ip dhcp client request dns-nameserver
.
interface GigabitEthernet0/0/1
description WAN OVH
no ip address
ip mtu 1492
ip nat outside
ip tcp adjust-mss 1452
negotiation auto
pppoe enable group global
pppoe-client dial-pool-number 1
spanning-tree portfast
PPPoE uses 8 bytes for encapsulation, so the MTU of the interface is 1500-8=1492. Hence,
ip mtu 1492
.
interface Dialer1
mtu 1492
ip address negotiated
no ip redirects
ip nat outside
zone-member security WAN_OVH
encapsulation ppp
ip tcp adjust-mss 1452
dialer pool 1
dialer idle-timeout 0
dialer persistent
dialer-group 1
ppp mtu adaptive
ppp authentication chap callin
ppp chap hostname netconanRemoved2
ppp chap password 7 09424B1D1A0A1913053E012724322D3766
ppp ipcp dns request
Create a route map for each outside interface. First, create an ACL allowing or denying the inside subnets that can use this interface:
ip access-list standard 3
10 permit 192.168.93.0 0.0.0.255
20 permit 192.168.8.0 0.0.0.255
Then create the route-map:
route-map WAN-OVH permit 10
match ip address 3
match interface Dialer1
To set up NAT, add:
ip nat inside
to every inside interfaceip nat outside
to every outside interface
Be careful with the DHCP interface.
ip nat outside
must be added after the DHCP client gets the IP address, otherwise the interface will never get it!
Add ip nat
in global configuration for each interface with a route map:
ip nat inside source route-map WAN-FREE interface GigabitEthernet0/0/0 overload
ip nat inside source route-map WAN-OVH interface Dialer1 overload
Since OVH uses PPPoE, add
ip nat
to the Dialer interface.