Advanced Features

Use the following table to configure IP EIGRP. For information on the commands used in this table, refer to the Cisco IOS Release 12.0 documentation set.

Step	Task	Router Prompt	Command
1	Enter configuration mode.	Router#	configure terminal
2	Enter router configuration mode, and enable EIGRP.	Router (config)#	router eigrp autonomous-system
3	Specify this command for each directly connected network.	Router (config-router)#	network network-number
4	Exit router configuration mode.	Router (config-router)#	exit

Use the following table to configure Easy IP (Phase 1). For information on the commands used in this table, refer to the Cisco IOS Release 12.0 documentation set.

Step	Task	Router Prompt	Command
1	Enter configuration mode.	Router#	configure terminal
2	Define standard access list that permits nonregistered IP addresses of hosts.	Router (config)#	access-list access-list-number permit source [source-wildcard]
3	Set up translation of addresses identified by previously defined access list.	Router (config)#	ip nat inside source list access-list-number interface interface overload
4	Enter configuration mode for Ethernet interface.	Router (config)#	interface ethernet 0
5	Establish Ethernet interface as inside interface for NAT.	Router (config-if)#	ip nat inside
6	Enable interface and configuration changes just made to interface.	Router (config-if)#	no shutdown
7	Exit configuration mode for Ethernet interface.	Router (config-if)#	exit
8	Enter configuration mode for dialer interface.	Router (config)#	interface dialer-name
9	Enable PPP/IPCP to automatically negotiate globally unique IP address from ISP router.	Router (config-if)#	ip address negotiated
10	Establish dialer interface as outside interface for NAT.	Router (config-if)#	ip nat outside
11	Enable interface and configuration changes just made to interface.	Router (config-if)#	no shutdown
12	Exit configuration mode for serial interface.	Router (config-if)#	exit

The following is a sample configuration file that contains commands relevant to Easy IP (Phase 1) only:

!
interface ethernet 0
ip address 10.1.1.2 255.255.255.0
ip nat inside
!
interface dialer 0
ip address negotiated
ip nat outside
!
ip nat inside source list 1 interface dialer 0 overload
access list 1 permit 10.0.0.0 0.255.255.255
!
 

For example, if host A attempts to open a connection to host C, the following events occur:

• If the Cisco 805 router does not already have a global IP address for the dialer interface, it requests one from the ISP router.

• The ISP router responds with the global IP address of 172.16.0.1.

• The Cisco 805 router creates a translation that associates the global IP address of the dialer interface (172.16.0.1) with the nonregistered IP address of host A (10.1.1.2). NAT uses the TCP and UDP ports to associate the nonregistered IP address to the global IP address.

• The Cisco 805 router forwards the packet to host C.

When host C attempts to respond to host A, the Cisco 805 router determines that the global IP address 172.16.0.1 contained in the packet for host A should be translated back to 10.1.1.2. Specifically, the router looks at the inside global IP address and TCP port number (172.16.0.1:1723) in the NAT table and searches for the same TCP port number in the inside local IP address and TCP port number (10.1.1.2:1723).

This section explains how to configure the following:

Step	Task	Router Prompt	Command
1	Enter configuration mode.	Router#	configure terminal
2	Enter DHCP configuration mode, and create pool of IP addresses that can be assigned to DHCP clients.	Router (config)#	ip dhcp pool name
3	Specify range of IP addresses that can be assigned.	Router (dhcp-config)#	network ip-address subnet-mask
4	Designate router as default router, and specify IP address.	Router (dhcp-config)#	default-router ip-address
5	Exit DHCP configuration mode.	Router (dhcp-config)#	exit

The following is a sample configuration file that contains commands relevant to DHCP server only:

!
ip dhcp pool dhcppool_1
network 10.1.1.1 255.255.255.0
default-router 10.1.1.1
!
 

The first DHCP client to request an IP address is assigned 10.1.1.2 and so on until a client is assigned 10.1.1.254. After the range of 254 IP addresses is assigned, the DHCP server reassigns 10.1.1.2 and so on.

The following is a sample configuration file that contains commands relevant to DHCP relay only:

!
ip dhcp-server 10.1.1.1
!
interface serial 0
ip helper-address 10.1.1.1
!
 

Use the following table to configure NAT overload. For information on the commands used in this table, refer to the Cisco IOS Release 12.0 documentation set.

Step	Task	Router Prompt	Command
1	Enter configuration mode.	Router#	configure terminal
2	Define a standard access list.	Router (config)#	access-list access-list-number permit source [source-wildcard]
3	Establish static source translation, identifying access list defined in previous step.	Router (config)#	ip nat inside source list access-list-number interface interface overload
4	Enter configuration mode for Ethernet interface.	Router (config)#	interface ethernet 0
5	Establish Ethernet interface as inside interface.	Router (config-if)#	ip nat inside
6	Enable interface and configuration changes just made to interface.	Router (config-if)#	no shutdown
7	Exit configuration mode for Ethernet interface.	Router (config-if)#	exit
8	Enter configuration mode for serial interface.	Router (config)#	interface serial 0
9	Establish serial interface as outside interface.	Router (config-if)#	ip nat outside
10	Enable interface and configuration changes just made to interface.	Router (config-if)#	no shutdown
11	Exit configuration mode for serial interface.	Router (config-if)#	exit

The following is a sample configuration file that contains commands relevant to NAT overload only:

!
interface ethernet 0
ip address 10.1.1.2 255.255.255.0
ip nat inside
!
interface serial 0
ip address 172.16.0.1 255.255.255.0
ip nat outside
!
access list 1 permit 10.0.0.0 0.255.255.255
ip nat inside source list 1 interface serial 0 overload
!
 

If hosts A and B attempt to open a connection to host C, the router does the following:

• Determines that the IP addresses of host A (10.1.1.2) and host B (10.1.1.3) should be translated to 172.16.0.1.

• Forwards the packets from hosts A and B to host C.

When host C attempts to respond to hosts A and B, the router does the following:

• Determines that the global IP address 172.16.0.1 contained in the respective packets for hosts A and B should be translated back to the correct local addresses.

For example, in the case of the packet for host A, the router looks at the inside global IP address and TCP port number (172.16.0.1:1723) in the NAT table and searches for the same TCP port number in the inside local IP address and TCP port number (10.1.1.2:1723).

For information on how to use the Cisco 805 Fast Step application, refer to the application online help. For information on how to configure a firewall using the CLI, refer to the Cisco IOS Firewall Feature Set feature module, which appears on Cisco Connection Online (CCO) only. This feature module also provides conceptual information on the firewall feature.

• Service Advertising Protocol (SAP)

• Routing Information Protocol (RIP)

• Serialization

To control costs, you can configure an extended access list so that SAP, RIP, and serialization packets do not activate the dial-up line.

Table 5-1: Sample IP Network-to-Internet Restrictions

Access Permitted	Access Denied
Permit any host on network 192.168.1.0 to access any Internet server.	Deny any Internet host from spoofing any host on network 192.168.1.0. (Spoofing is illegally claiming to be from an address from which it is not actually sent.)
Permit any Internet domain name system (DNS) server to send TCP replies to any host on network 192.168.1.0.	Deny any Internet host from making a remote terminal connection (Telnet) to any host on network 192.168.1.0.
Permit any Internet DNS server to send UDP replies to any host on network 192.168.1.0.
Permit any Internet host to access the Simple Mail Transport Protocol (SMTP) mail server on network 192.168.1.0.
Permit any Internet host to access the web server on network 192.168.1.0.
Permit any Internet host to access the File Transport Protocol (FTP) server on network 192.168.1.0.