{"id":910,"date":"2013-08-06T01:08:16","date_gmt":"2013-08-05T23:08:16","guid":{"rendered":"http:\/\/diablo.craem.net\/wordpress\/?p=910"},"modified":"2013-08-06T01:08:16","modified_gmt":"2013-08-05T23:08:16","slug":"policy-based-routing-cisco-y-mikrotik-tunnel-ipip-y-nat-1","status":"publish","type":"post","link":"https:\/\/diablo.craem.net\/?p=910","title":{"rendered":"Policy Based Routing Cisco y Mikrotik, tunnel IPIP y NAT (1)"},"content":{"rendered":"

Esta entrada, con diferencia, es una de las configuraciones que m\u00e1s me ha hecho sudar la gota gorda…. intervienen varios factores:
\n1\u00ba) Tengo un proveedor de servicio que me proporciona 8 ip’s p\u00fablicas
\n2\u00ba) Tengo que llegar con mi conexi\u00f3n al proveedor
\n3\u00ba) Hago un tunel IPIP entre la Mikrotik y mi router cisco
\n4\u00ba) Hay que usar nat
\nEl motivo es que, necesito usar esas 8 ip’s y s\u00f3lo determinados equipos, saldr\u00e1n por el tunnel IP \/ ip’s p\u00fablicas; el resto de m\u00e1quinas de mi casa, saldr\u00e1 por la conexi\u00f3n normal que tengo.
\nPrimero de todo, har\u00e9 la config y el esquema con cisco como cliente y mikrotik como servidor:
\n\"ipip1\"<\/a>
\nEmpezamos por la configuraci\u00f3n de la mikrotik:
\n
\n\/interface ipip
\nadd disabled=no dscp=0 local-address=3.3.3.3 mtu=1480 name=ipip_craem remote-address=2.2.2.2
\n\/ip address
\nadd address=192.168.194.1\/30 disabled=no interface=ipip_craem network=192.168.194.0
\nadd disabled=no distance=1 dst-address=1.1.1.1\/32 gateway=192.168.194.2 scope=30 target-scope=10
\nadd disabled=no distance=1 dst-address=1.1.1.2\/32 gateway=192.168.194.2 scope=30 target-scope=10
\nadd disabled=no distance=1 dst-address=1.1.1.3\/32 gateway=192.168.194.2 scope=30 target-scope=10
\nadd disabled=no distance=1 dst-address=1.1.1.4\/32 gateway=192.168.194.2 scope=30 target-scope=10
\nadd disabled=no distance=1 dst-address=1.1.1.5\/32 gateway=192.168.194.2 scope=30 target-scope=10
\nadd disabled=no distance=1 dst-address=1.1.1.6\/32 gateway=192.168.194.2 scope=30 target-scope=10
\n<\/code>
\nPrimero creamos el tunnel, le damos la ip y, para no perder la de red y broadcast, negociamos con el proveedor que nos la enrute una a una, tras pagarle unas cervezas al t\u00e9cnico \ud83d\ude09
\nY ahora el lado Cisco; empezamos por el tunnel:
\n
\ninterface Tunnel7<\/strong>
\n description TUNNEL proveedor \/29
\n ip address 192.168.194.2 255.255.255.252 --> ip privada del tunnel
\n ip mtu 1480 --> ajustamos el mtu
\n ip nat outside --> mis m\u00e1quinas est\u00e1n detr\u00e1s del firewall, con NAT
\n ip virtual-reassembly
\n ip policy route-map prov_lan --> policy route aplicado
\n qos pre-classify --> aplico QoS antes de meter en el tunnel
\n tunnel source 2.2.2.2 --> ip p\u00fablica mia
\n tunnel destination 3.3.3.3 --> ip destino
\n tunnel mode ipip --> modo del tunnel
\n<\/code>
\nCreamos la pol\u00ed\u00adtica:
\n
\nip local policy route-map prov_map
\n<\/code>
\nMetemos en un access-list las ip’s que tendr\u00e1n salida por el tunnel:
\n
\naccess-list 112 remark -> ACL NAT prov IPS PUBLICAS
\naccess-list 112 permit ip host 172.26.2.9 any
\naccess-list 112 permit ip host 172.26.2.11 any
\naccess-list 112 permit ip host 172.26.2.5 any
\naccess-list 112 permit ip host 172.26.2.6 any
\naccess-list 112 permit ip host 172.26.2.12 any
\n<\/code>
\nHacemos el route-map para identificar los paquetes:
\n
\nroute-map prov_lan permit 10
\n match ip address 112
\n set interface Tunnel7
\n<\/code>
\nY ahora, nacemos el nat de las privadas a las p\u00fablicas de nuestro proveedor:
\n
\nip nat inside source static 172.26.2.9 1.1.1.1
\nip nat inside source static 172.26.2.11 1.1.1.2
\nip nat inside source static 172.26.2.5 1.1.1.3
\nip nat inside source static 172.26.2.6 1.1.1.4
\nip nat inside source static 172.26.2.12 1.1.1.5
\n<\/code>
\nSi no ponemos el nat en el tunnel; no habr\u00e1 traducci\u00f3n y no podremos usar las ip’s.
\nAhora hemos de aplicar el policy-map a los interfaces:
\n
\ninterface FastEthernet0\/0
\n bandwidth 6096
\n ip address dhcp
\n ip flow ingress
\n ip nat outside
\n ip virtual-reassembly
\n ip policy route-map rlan_map<\/strong>
\ninterface GigabitEthernet0\/1\/0
\n ip address 172.26.2.20 255.255.255.0
\n ip flow ingress
\n ip nat inside
\n ip virtual-reassembly
\n ip policy route-map rlan_map
\n negotiation auto
\n<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"

Esta entrada, con diferencia, es una de las configuraciones que m\u00e1s me ha hecho sudar la gota gorda…. intervienen varios factores: 1\u00ba) Tengo un proveedor de servicio que me proporciona 8 ip’s p\u00fablicas 2\u00ba) Tengo que llegar con mi conexi\u00f3n al proveedor 3\u00ba) Hago un tunel IPIP entre la Mikrotik y mi router cisco 4\u00ba) […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,6,8],"tags":[41,107,119,143,184],"class_list":["post-910","post","type-post","status-publish","format-standard","hentry","category-cisco","category-mikrotik","category-varios","tag-cisco","tag-mikrotik","tag-nat","tag-policy-based-routing","tag-tunnel-ipip"],"_links":{"self":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/posts\/910","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=910"}],"version-history":[{"count":0,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/posts\/910\/revisions"}],"wp:attachment":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=910"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=910"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=910"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}