Setting up a gateway on Cisco Routers - Revision history

KI5QKX: mw push

2026-04-30T18:52:52Z

mw push

← Older revision		Revision as of 18:52, 30 April 2026
Line 8:		Line 8:

	You have already registered with AMPRNet and got your 44.0.0.0/9 or 44.128.0.0/10 allocation and it is showing in the encap.txt file (see "If you are looking to get an IP allocation within the AMPRNet please read the Portal page.") info on the main page .		You have already registered with AMPRNet and got your 44.0.0.0/9 or 44.128.0.0/10 allocation and it is showing in the encap.txt file (see "If you are looking to get an IP allocation within the AMPRNet please read the Portal page.") info on the main page .


	You have registered some hosts of your allocated network in the AMPRNet DNS like <your call sign>.ampr.org		You have registered some hosts of your allocated network in the AMPRNet DNS like <your call sign>.ampr.org
Line 62:		Line 61:

	This are the minimum commands necessary to be able to route your inside 44 net IP to the outside world (but not to any other 44 net networks worldwide)		This are the minimum commands necessary to be able to route your inside 44 net IP to the outside world (but not to any other 44 net networks worldwide)


	This method will redirect any outgoing traffic (no matter what local IP is used ) to the tunnel and since the AMPR.ORG tunnel deal with tunneling from only 44 Net IP it mean that if the router local Lan is sharing 44 and non 44 IP machines the non 44 Net machines will have no connectivity to the world		This method will redirect any outgoing traffic (no matter what local IP is used ) to the tunnel and since the AMPR.ORG tunnel deal with tunneling from only 44 Net IP it mean that if the router local Lan is sharing 44 and non 44 IP machines the non 44 Net machines will have no connectivity to the world


	To overcome this problem a route policy will have to be used (with the command route-map) because regular route command deal with route for destination IP without looking at the source (local net) and route policy can do it ...		To overcome this problem a route policy will have to be used (with the command route-map) because regular route command deal with route for destination IP without looking at the source (local net) and route policy can do it ...
Line 176:		Line 173:
	Later on we will deal of how to create these tunnels lines configuration using a script		Later on we will deal of how to create these tunnels lines configuration using a script
	that takes the info from the ENCAP.TXT file and convert it to Cisco config		that takes the info from the ENCAP.TXT file and convert it to Cisco config


	<nowiki>interface Tunnel0		<nowiki>interface Tunnel0
Line 246:		Line 242:
	#EO user defined varibles		#EO user defined varibles
	#####		#####


	my $file = $ARGV[0];		my $file = $ARGV[0];
Line 506:		Line 501:

	### EO wildcard sub ### </nowiki>		### EO wildcard sub ### </nowiki>



	Before you run the script make sure to take out the line of your gateway from the encap file		Before you run the script make sure to take out the line of your gateway from the encap file


	The result of the script is set of commands that look like that		The result of the script is set of commands that look like that
Line 538:		Line 530:
	So with a small software work the whole procedure can be done fully automatic		So with a small software work the whole procedure can be done fully automatic

			[[Category:How-To]]
	[[Category:How-To Guides]]		[[Category:How-To Guides]]
	[[Category:Infrastructure]]		[[Category:Infrastructure]]
	[[Category:Gateways]]		[[Category:Gateways]]

KI5QKX: mw push

2026-03-01T00:14:52Z

mw push

← Older revision		Revision as of 00:14, 1 March 2026
Line 540:		Line 540:

	[[Category:How-To Guides]]		[[Category:How-To Guides]]
			[[Category:Infrastructure]]
			[[Category:Gateways]]

KI5QKX: mw push

2026-02-28T23:20:37Z

mw push

← Older revision		Revision as of 23:20, 28 February 2026
Line 73:		Line 73:
	== Option 2: VLAN and zone-based firewall ==		== Option 2: VLAN and zone-based firewall ==

	If you're familiar with zone-based policy firewalls in IOS, it's possible to combine that feature with VTI and policy-based routing in a way that doesn't require multiple route-maps and won't impact non-~~44net~~ traffic on the router.		If you're familiar with zone-based policy firewalls in IOS, it's possible to combine that feature with VTI and policy-based routing in a way that doesn't require multiple route-maps and won't impact non-44Net traffic on the router.

	<nowiki>!		<nowiki>!
	! Define security zones for the tunnel interface and ~~44net~~ vlan		! Define security zones for the tunnel interface and 44Net vlan
	!		!
	zone security AMPRNet		zone security AMPRNet
	zone security AMPRAlloc		zone security AMPRAlloc
	!		!
	! An ACL for source traffic on the ~~44net~~ vlan		! An ACL for source traffic on the 44Net vlan
	!		!
	ip access-list standard Vlan44		ip access-list standard Vlan44
Line 87:		Line 87:
	deny any log		deny any log
	!		!
	! Send all traffic coming from the ~~44net~~ vlan through the tunnel.		! Send all traffic coming from the 44Net vlan through the tunnel.
	!		!
	route-map ampr-tunnel permit 10		route-map ampr-tunnel permit 10
Line 153:		Line 153:
	service-policy type inspect AllowAllOut</nowiki>		service-policy type inspect AllowAllOut</nowiki>

	== Routing to other ~~44net~~ gateways ==		== Routing to other 44Net gateways ==

	In order to route your traffic to other 44 net gateways you need to build a tunnel interface to every gateway (unlike JNOS that one tunnel deal with all tunnels)		In order to route your traffic to other 44 net gateways you need to build a tunnel interface to every gateway (unlike JNOS that one tunnel deal with all tunnels)

KI5QKX at 20:18, 12 December 2024

2024-12-12T20:18:08Z

← Older revision		Revision as of 20:18, 12 December 2024
Line 537:		Line 537:

	So with a small software work the whole procedure can be done fully automatic		So with a small software work the whole procedure can be done fully automatic


			[[Category:How-To Guides]]

G1fef at 17:53, 29 March 2022

2022-03-29T17:53:12Z

← Older revision		Revision as of 17:53, 29 March 2022
Line 7:		Line 7:
	Pre requirement to the setup to work are as follows:		Pre requirement to the setup to work are as follows:

	You have already registered with AMPRNet and got your 44.x.x.x/y allocation and it is showing in the encap.txt file (see "If you are looking to get an IP allocation within the AMPRNet please read the Portal page.") info on the main page .		You have already registered with AMPRNet and got your 44.0.0.0/9 or 44.128.0.0/10 allocation and it is showing in the encap.txt file (see "If you are looking to get an IP allocation within the AMPRNet please read the Portal page.") info on the main page .


Line 27:		Line 27:
	(To see what interfaces you have in order to assign them the address use the command Show interface and identify the Ethernet port name.)		(To see what interfaces you have in order to assign them the address use the command Show interface and identify the Ethernet port name.)

	Then you have to assign the AMPRNet 44.x.x.x IP .		Then you have to assign the AMPRNet 44.0.0.0/9 or 44.128.0.0/10 IP.

	For a router with one port any additional network IP has to be secondary and the command is:		For a router with one port any additional network IP has to be secondary and the command is:

KE2A: removed reference to specific AMPRNet subnet

2020-03-23T00:22:07Z

removed reference to specific AMPRNet subnet

← Older revision		Revision as of 00:22, 23 March 2020
Line 95:		Line 95:
	description AMPRNet allocation		description AMPRNet allocation
	encapsulation dot1Q 44		encapsulation dot1Q 44
	ip address ~~44.68.54.1 255.255.255.248~~		ip address <your_44net_allocation> <your_subnet_mask>
	zone-member security AMPRAlloc		zone-member security AMPRAlloc
	ip policy route-map ampr-tunnel		ip policy route-map ampr-tunnel

KE2A: Changed VLAN config to subinterfaces

2020-03-23T00:20:11Z

Changed VLAN config to subinterfaces

← Older revision		Revision as of 00:20, 23 March 2020
Line 92:		Line 92:
	set interface Tunnel44		set interface Tunnel44
	!		!
	interface ~~Vlan44~~		interface GigabitEthernet0/0/0.44
	description AMPRNet allocation		description AMPRNet allocation
	~~ip address <first_ip_from_your_allocation> <allocation_subnet_mask>~~		encapsulation dot1Q 44
	ip ~~access-group Vlan44 in~~		ip address 44.68.54.1 255.255.255.248
	zone-member security AMPRAlloc		zone-member security AMPRAlloc
	ip policy route-map ampr-tunnel		ip policy route-map ampr-tunnel
Line 101:		Line 101:
	interface Tunnel44		interface Tunnel44
	description AMPRNet		description AMPRNet
	ip unnumbered ~~Vlan44~~		ip unnumbered GigabitEthernet0/0/0.44
	zone-member security AMPRNet		zone-member security AMPRNet
	tunnel source GigabitEthernet0/0/1		tunnel source GigabitEthernet0/0/1

KE2A: Tried to clarify variables in Option 2 config

2020-01-16T11:27:11Z

Tried to clarify variables in Option 2 config

← Older revision		Revision as of 11:27, 16 January 2020
Line 84:		Line 84:
	!		!
	ip access-list standard Vlan44		ip access-list standard Vlan44
	permit <your_44net_allocation> <~~your_mask~~>		permit <your_44net_allocation> <your_allocation_mask>
	deny any log		deny any log
	!		!
Line 94:		Line 94:
	interface Vlan44		interface Vlan44
	description AMPRNet allocation		description AMPRNet allocation
	ip address <~~gateway_ip_from_your_allocation~~> <allocation_subnet_mask>		ip address <first_ip_from_your_allocation> <allocation_subnet_mask>
	ip access-group Vlan44 in		ip access-group Vlan44 in
	zone-member security AMPRAlloc		zone-member security AMPRAlloc

KE2A: Changes to section titles and removed subjective language in description of Option 2

2020-01-16T11:07:31Z

Changes to section titles and removed subjective language in description of Option 2

← Older revision		Revision as of 11:07, 16 January 2020
Line 1:		Line 1:
	== ~~Approach #~~1 ==		== Option 1: Secondary IP on WAN interface ==

	To create a gateway using Cisco equipment you must have a Cisco Router (preferred from series 2600 and above)		To create a gateway using Cisco equipment you must have a Cisco Router (preferred from series 2600 and above)
Line 71:		Line 71:
	So two policy have to be created one for all addresses (excluding the AMPRnet that needed to be routed direct to the internet (without tunnel) and second one specifically for the 44 net hosts that needed to redirect their outgoing traffic to the tunnels		So two policy have to be created one for all addresses (excluding the AMPRnet that needed to be routed direct to the internet (without tunnel) and second one specifically for the 44 net hosts that needed to redirect their outgoing traffic to the tunnels

	== ~~Approach #~~2 ==		== Option 2: VLAN and zone-based firewall ==

	If you're familiar with zone-based policy firewalls in IOS, it's possible to combine that feature with VTI and policy-based routing in a ~~more straightforward~~ way that doesn't require multiple route-maps and won't impact non-44net traffic on the router.		If you're familiar with zone-based policy firewalls in IOS, it's possible to combine that feature with VTI and policy-based routing in a way that doesn't require multiple route-maps and won't impact non-44net traffic on the router.

	<nowiki>!		<nowiki>!

KE2A: Slight config change in Approach #2 and change to last sentence of the intro to that section.

2020-01-16T10:57:25Z

Slight config change in Approach #2 and change to last sentence of the intro to that section.

← Older revision		Revision as of 10:57, 16 January 2020
Line 73:		Line 73:
	== Approach #2 ==		== Approach #2 ==

	If you're familiar with zone-based policy firewalls in IOS, it's possible to combine that feature with VTI and policy-based routing in a more straightforward way that doesn't require multiple route-maps.		If you're familiar with zone-based policy firewalls in IOS, it's possible to combine that feature with VTI and policy-based routing in a more straightforward way that doesn't require multiple route-maps and won't impact non-44net traffic on the router.

	<nowiki>!		<nowiki>!
Line 90:		Line 90:
	!		!
	route-map ampr-tunnel permit 10		route-map ampr-tunnel permit 10
	set ~~ip next-hop 169.228.34.84~~		set interface Tunnel44
	!		!
	interface Vlan44		interface Vlan44