1. Router with integrated ADSL module running PPPoE
As illustration, the router used is Cisco 1841 router with wireless module. This sample configuration assumes the followings
* The Qwest uses 0/32 as the VPI/VCI which may not reflect your ISP VPI/VCI value. Confirm with your ISP regarding the value. * ISP connection is DSL with PPPoE * The router receives static IP address from ISP * Default gateway is received from the ISP PPP negotiation * There is a public server sitting behind the router, open to any inbound and outbound traffic * There is NAT/PAT on the router between local subnet of 10.10.0.0/22 (behind the BVI, FA0/0, and FA0/1) and the ISP Public IP address (in front of the Dialer0 interface) * Router is in IRB (Integrated Routing Bridging) mode * The Wired LAN interfaces (FA0/0 and FA0/1) are Layer 3 interfaces, where the FA0/0 is the Inside (Trusted) and FA0/1 is the DMZ * There is one "dumb switch" behind each one of the Wired LAN interfaces * DMZ interface is set for servers * Inside interface is set for local users' workstation and printers * Workstations and printers receive dynamic IP address via DHCP within 10.10.1.0/24 subnet * Wireless users receive dynamic IP address via DHCP within 10.10.3.0/24 subnet * The Radio and BVI interfaces are within the same broadcast domain, where the BVI is the Layer 3 interface * No layer 2 trunking to external network device * Wireless encryption type is WPA
Sample Configuration
version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname cisco1841 ! boot-start-marker boot-end-marker ! logging buffered 51200 warnings ! no aaa new-model clock timezone Arizona -7 ip cef ! ! no ip dhcp use vrf connected ! ip dhcp excluded-address 10.10.1.1 ip dhcp excluded-address 10.10.3.1 ! ip dhcp pool Inside network 10.10.1.0 255.255.255.0 dns-server 205.171.3.65 4.2.2.1 default-router 10.10.1.1 ! ip dhcp pool Wireless import all network 10.10.3.0 255.255.255.0 dns-server 205.171.3.65 4.2.2.1 default-router 10.10.3.1 lease 3 ! ! multilink bundle-name authenticated ! ! ! ! username xxxxxxx privilege 15 secret 5 xxxxxxxxxx ! bridge irb ! ! ! interface Loopback0 ip address 10.10.0.1 255.255.255.255 ! interface FastEthernet0/0 description Inside LAN ip address 10.10.1.1 255.255.255.0 ip nat inside duplex auto speed auto ! interface FastEthernet0/1 description DMZ ip address 10.10.2.1 255.255.255.0 ip nat inside duplex auto speed auto ! interface ATM0/0/0 description ADSL WAN port no ip address no snmp trap link-status no atm ilmi-keepalive dsl operating-mode auto pvc 0/32 encapsulation aal5mux ppp dialer dialer pool-member 1 ! ! interface Dot11Radio0/1/0 description Wireless interface no ip address no ip redirects ip local-proxy-arp ip virtual-reassembly ! encryption vlan 1 mode ciphers tkip ! ssid azwinters vlan 1 authentication open authentication key-management wpa guest-mode wpa-psk ascii 0 xxxxxxxxxxx ! speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0 station-role root no cdp enable ! interface Dot11Radio0/1/0.1 description Wireless VLAN 1 encapsulation dot1Q 1 native bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 spanning-disabled bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding ! interface Dialer0 description ADSL WAN Dialer ip address 71.216.xxx.xxx 255.255.255.0 ip mtu 1492 no ip redirects no ip unreachables no ip proxy-arp ip nat outside no ip virtual-reassembly encapsulation ppp ip tcp adjust-mss 1452 dialer pool 1 dialer-group 1 no cdp enable ppp authentication chap pap callin ppp chap hostname xxxxxxxxxx@qwest.net ppp chap password 0 xxxxxxxxx ppp pap sent-username xxxxxxxxx@qwest.net password 0 xxxxx ppp ipcp route default ! ! interface BVI1 description Wireless LAN ip address 10.10.3.1 255.255.255.0 ip nat inside ip virtual-reassembly no cdp enable ! ! ! no ip http server no ip http secure-server ip nat inside source list 1 interface Dialer0 overload ip nat inside source static 10.10.2.254 71.xxx.xxx.xxx ! access-list 1 permit 10.10.0.0 0.0.3.255 dialer-list 1 protocol ip permit no cdp run ! ! ! control-plane ! bridge 1 protocol ieee bridge 1 route ip ! ! line con 0 login local line aux 0 line vty 0 4 privilege level 15 login local transport input telnet ! no scheduler allocate ntp clock-period 17175169 ntp server 132.163.4.101 source Dialer0 prefer ntp server 148.167.132.200 source Dialer0 prefer ntp server 207.10.214.111 source Dialer0 prefer end
2. Router with integrated ADSL module running PPPoA
This sample configuration assumes the followings
* The Qwest uses 0/32 as the VPI/VCI which may not reflect your ISP VPI/VCI value. Confirm with your ISP regarding the value. * ISP connection is DSL with PPPoA * The router receives static IP address from ISP * Default gateway is received from the ISP PPP negotiation * There is a public server sitting behind the router, open to any inbound and outbound traffic * There is NAT/PAT on the router between local subnet of 192.168.2.0/24 (behind the BVI as the Layer-3 interface and FA0/0 - FA0/3 as the Layer-2 interfaces; and Radio interface) and the ISP Public IP address (in front of the Dialer0 interface) * Router is in IRB (Integrated Routing Bridging) mode * The Radio and BVI interfaces are within the same broadcast domain, where the BVI is the Layer 3 interface * No layer 2 trunking to external network device * The router is running CBAC as IOS-based Firewall
Sample Configuration
version 12.4 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption service sequence-numbers ! hostname yourname ! boot-start-marker boot-end-marker ! logging buffered 51200 warnings logging console critical enable secret 5 xxxxxxxxxxxxxxxxxxxxx ! aaa new-model ! ! aaa authentication login local_authen local aaa authorization exec local_author local ! ! aaa session-id common clock timezone PCTime -7 clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00 ! ! ! crypto pki trustpoint TP-self-signed-3720820174 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-3720820174 revocation-check none rsakeypair TP-self-signed-3720820174 ! ! crypto pki certificate chain TP-self-signed-3720820174 certificate self-signed 01
!KEY GOES HERE
quit ! dot11 ssid Es38ufd authentication open ! no ip source-route no ip dhcp use vrf connected ip dhcp excluded-address 192.168.2.1 ip dhcp excluded-address 192.168.2.21 192.168.2.254 ! ip dhcp pool sdm-pool1 import all network 192.168.2.0 255.255.255.0 default-router 192.168.2.1 dns-server 205.171.3.65 205.171.2.65 !
!************Various DHCP Bindings were here*****************
! ! ip cef ip inspect name SDM_LOW cuseeme ip inspect name SDM_LOW dns ip inspect name SDM_LOW ftp ip inspect name SDM_LOW h323 ip inspect name SDM_LOW https ip inspect name SDM_LOW icmp ip inspect name SDM_LOW imap ip inspect name SDM_LOW pop3 ip inspect name SDM_LOW rcmd ip inspect name SDM_LOW realaudio ip inspect name SDM_LOW rtsp ip inspect name SDM_LOW esmtp ip inspect name SDM_LOW sqlnet ip inspect name SDM_LOW streamworks ip inspect name SDM_LOW tftp ip inspect name SDM_LOW tcp ip inspect name SDM_LOW udp ip inspect name SDM_LOW vdolive ip inspect name sdm_ins_in_100 cuseeme ip inspect name sdm_ins_in_100 dns ip inspect name sdm_ins_in_100 ftp ip inspect name sdm_ins_in_100 h323 ip inspect name sdm_ins_in_100 https ip inspect name sdm_ins_in_100 icmp ip inspect name sdm_ins_in_100 imap ip inspect name sdm_ins_in_100 pop3 ip inspect name sdm_ins_in_100 rcmd ip inspect name sdm_ins_in_100 realaudio ip inspect name sdm_ins_in_100 rtsp ip inspect name sdm_ins_in_100 esmtp ip inspect name sdm_ins_in_100 sqlnet ip inspect name sdm_ins_in_100 streamworks ip inspect name sdm_ins_in_100 tftp ip inspect name sdm_ins_in_100 tcp ip inspect name sdm_ins_in_100 udp ip inspect name sdm_ins_in_100 vdolive no ip bootp server ip domain lookup source-interface Dialer0 ip name-server 205.171.3.65 ip name-server 205.171.2.65 ! ! ! file verify auto username xxxxx privilege 15 password 7 xxxxxxxxxxxxxxxxxxxx username xxxxxxx privilege 15 secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxx archive log config hidekeys ! ! ip tcp synwait-time 10 ip ssh time-out 60 ip ssh authentication-retries 2 ! bridge irb ! ! ! interface ATM0 no ip address no ip redirects no ip unreachables no ip proxy-arp no ip mroute-cache no snmp trap link-status atm vc-per-vp 64 no atm ilmi-keepalive pvc 0/32 encapsulation aal5mux ppp dialer dialer pool-member 1 ! dsl operating-mode ansi-dmt dsl enable-training-log ! interface FastEthernet0 ! interface FastEthernet1 ! interface FastEthernet2 ! interface FastEthernet3 ! interface Dot11Radio0 no ip address ! ssid Es38ufd ! speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0 station-role root bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 spanning-disabled bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding ! interface Vlan1 description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$ no ip address no ip redirects no ip unreachables no ip proxy-arp ip route-cache flow bridge-group 1 ! interface Dialer0 description $FW_OUTSIDE$ ip address negotiated ip access-group 103 in no ip redirects no ip unreachables no ip proxy-arp ip inspect sdm_ins_in_100 in ip inspect SDM_LOW out ip nat outside ip virtual-reassembly encapsulation ppp dialer pool 1 dialer-group 1 no cdp enable ppp authentication chap pap callin ppp chap hostname xxxxxxxxxxxxxxxxxxx ppp chap password 7 xxxxxxxxxxxxxxxxxxx ppp pap sent-username xxxxxxx password 7 xxxxxxxxxxxxxxxxxxx ppp ipcp route default ! interface BVI1 description $ES_LAN$$FW_INSIDE$ ip address 192.168.2.1 255.255.255.0 ip access-group 100 in no ip redirects no ip unreachables no ip proxy-arp ip nat inside ip virtual-reassembly ip route-cache flow ! ip http server ip http access-class 3 ip http authentication local ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ip nat inside source list 1 interface Dialer0 overload ! access-list 1 remark The local LAN. access-list 1 permit 192.168.2.0 0.0.0.255 access-list 2 remark Where management can be done from. access-list 2 permit 192.168.2.0 0.0.0.255 access-list 3 remark HTTP Access-class list access-list 3 remark SDM_ACL Category=1 access-list 3 permit 192.168.2.0 0.0.0.255 access-list 3 deny any access-list 100 remark auto generated by SDM firewall configuration access-list 100 remark SDM_ACL Category=1 access-list 100 deny ip host 255.255.255.255 any access-list 100 deny ip 127.0.0.0 0.255.255.255 any access-list 100 permit ip any any access-list 103 remark auto generated by SDM firewall configuration access-list 103 remark SDM_ACL Category=1 access-list 103 permit udp host 205.171.2.65 eq domain any access-list 103 permit udp host 205.171.3.65 eq domain any access-list 103 remark Auto generated by SDM for NTP (123) 132.163.4.101 access-list 103 permit udp host 132.163.4.101 eq ntp any eq ntp access-list 103 remark Auto generated by SDM for NTP (123) 128.138.140.44 access-list 103 permit udp host 128.138.140.44 eq ntp any eq ntp access-list 103 remark Auto generated by SDM for NTP (123) 192.43.244.18 access-list 103 permit udp host 192.43.244.18 eq ntp any eq ntp access-list 103 permit icmp any any echo-reply access-list 103 permit icmp any any time-exceeded access-list 103 permit icmp any any unreachable access-list 103 deny ip any any log dialer-list 1 protocol ip permit no cdp run ! control-plane ! bridge 1 protocol ieee bridge 1 route ip banner login ^CCCAuthorized access only! Disconnect IMMEDIATELY if you are not an authorized user! ^C ! line con 0 no modem enable transport output telnet line aux 0 transport output telnet line vty 0 4 access-class 2 in privilege level 15 authorization exec local_author login authentication local_authen transport input telnet ssh ! scheduler max-task-time 5000 scheduler allocate 4000 1000 scheduler interval 500 sntp server 132.163.4.101 sntp server 128.138.140.44 sntp server 192.43.244.18 end
3. Router receiving Ethernet hand-off of external modem running DHCP
Following is another wireless router sample configuration with assumptions of
* ISP connection is Cable Internet or DSL with DHCP * The router receives dynamic IP address from ISP * Default gateway is received from the ISP DHCP negotiation * There is NAT/PAT on the router between local subnet of 10.10.10.0/24 (behind the BVI, FA0-3, and Dot11Radio0) and the ISP Public IP address (in front of the FA4 interface) * Router is in IRB (Integrated Routing Bridging) mode * FA4 is Layer 3 WAN interface * The Wired LAN interfaces (FA1, FA2 and FA3) are Layer 2 interfaces (integrated switch) that are members of VLAN 10 * The Wireless LAN interfaces (Dot11Radio0.10) is also a member of VLAN 10 * The Layer-3 interface BVI10 is to "integrate" between Wired and Wireless LAN * All Wired and Wireless LAN machines receive dynamic IP address via DHCP within 10.10.10.0/24 subnet (exclude 10.10.10.1 - 10.10.10.10) * No layer 2 trunking to external network device * Wireless encryption type is WPA * The router is running CBAC as IOS-based Firewall
Sample Configuration
Current configuration : 5572 bytes ! version 12.4 no service pad service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! hostname cloud ! boot-start-marker boot-end-marker ! enable secret 5 enable password 7 ! aaa new-model ! ! aaa authentication login default local aaa authorization exec default local ! aaa session-id common ! resource policy ! clock timezone CST -6 clock summer-time CDT recurring ip cef ! ! no ip dhcp use vrf connected ip dhcp excluded-address 10.10.10.1 10.10.10.10 ! ip dhcp pool VLAN10 import all network 10.10.10.0 255.255.255.0 default-router 10.10.10.1 domain-name att.net lease 4 ! ! ip domain lookup ip domain name att.net ip name-server 208.67.222.222 ip name-server 208.67.220.220 ip inspect name MYFW tcp ip inspect name MYFW udp ! ! ! crypto pki trustpoint TP-self-signed-1295877613 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-1295877613 revocation-check none rsakeypair TP-self-signed-1295877613 ! ! crypto pki certificate chain TP-self-signed-1295877613 certificate self-signed 01 quit username morphius privilege 15 password 7 ! ! ! bridge irb ! ! ! interface FastEthernet0 switchport access vlan 10 spanning-tree portfast ! interface FastEthernet1 switchport access vlan 10 ! interface FastEthernet2 switchport access vlan 10 ! interface FastEthernet3 switchport access vlan 10 ! interface FastEthernet4 description WAN interface ip address dhcp ip access-group Internet-inbound-ACL in ip nat outside ip inspect MYFW out duplex auto speed auto no cdp enable ! interface Dot11Radio0 no ip address ! encryption vlan 10 mode ciphers tkip ! ssid bennachie vlan 10 authentication open authentication key-management wpa guest-mode wpa-psk ascii 7 ! speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0 station-role root no dot11 extension aironet no cdp enable ! interface Dot11Radio0.10 encapsulation dot1Q 10 no snmp trap link-status bridge-group 10 bridge-group 10 subscriber-loop-control bridge-group 10 spanning-disabled bridge-group 10 block-unknown-source no bridge-group 10 source-learning no bridge-group 10 unicast-flooding ! interface Vlan1 no ip address ! interface Vlan10 description Internal network no ip address ip nat inside ip virtual-reassembly bridge-group 10 bridge-group 10 spanning-disabled ! interface BVI10 description Layer-3 LAN interface to bridge FA1-3 ports ip address 10.10.10.1 255.255.255.0 ip nat inside ip virtual-reassembly ! ! ! no ip http server no ip http secure-server ip nat inside source list 1 interface FastEthernet4 overload ! ip access-list extended Internet-inbound-ACL permit udp any eq bootps any eq bootpc permit icmp any any echo-reply permit icmp any any unreachable permit icmp any any time-exceeded ! access-list 1 permit 10.10.10.0 0.0.0.255 ! ! ! ! control-plane ! bridge 10 protocol ieee bridge 10 route ip banner login ^CAuthorized access only! Disconnect IMMEDIATELY if you are not an authorized user!^C ! line con 0 password 7 no modem enable line aux 0 line vty 0 4 password 7 ! scheduler max-task-time 5000 ntp authenticate ntp source FastEthernet4 ntp server 70.85.188.218 ntp server 67.10.89.177 ! webvpn context Default_context ssl authenticate verify all ! no inservice ! end
I would read the page linked above as there are minimum requirements to change your OS to IOS.
Below is a link outlining the method to upgrade the CISCO AIRONET MODEL AIR-AP-1220B-x-K9 Access Point from VXWorks to IOS after downloading the IOS Upgrade Image.
NOTE: The upgrade is PERMANENT and cannot be undone. Once the AP is running IOS, there is no way of reverting back to VXWorks as the bootloader is overwritten
After loading the upgrade image, you can then download ANY IOS (not only the aforementioned upgrade image) to the AP.