<div dir="ltr">You can also do ACL's on the nat router to prevent unwanted traffic if you want. Putting in specific host routes will probably do the trick and allows you to fine tune the control.<div><br></div><div>Good luck!</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jul 19, 2017 at 2:28 PM, Lelio Fulgenzi <span dir="ltr"><<a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div class="m_-5467676903765735769WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Thanks Charles!<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">The servers I’m talking about connecting to in the real network would include servers I have no control over and would be difficult to replicate. For example,
our active directory servers. For the most part, I will be replicating any and all servers off-line, especially those that I need to make changes to, e.g. DNS servers. I won’t be using the NAT/PAT solution to build any sort of client connection like phone
or jabber to cucm, that will all happen offline. Same for Unity connection. The routing will be very specific – likely even host based – to allow access to the outside world.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Besides – the collaboration servers are all on the same network – I wouldn’t even begin to know how to route individual IPs on the same network out the NAT/PAT
link! Although there’s probably a way! </span><span style="font-size:11.0pt;font-family:Wingdings;color:#1f497d">J</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u><u></u></span></p><span class="">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Lelio<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">---<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Lelio Fulgenzi, B.A.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Senior Analyst, Network Infrastructure<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Computing and Communications Services (CCS)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">University of Guelph<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><a href="tel:(519)%20824-4120" value="+15198244120" target="_blank">519-824-4120 Ext 56354</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><a href="http://www.uoguelph.ca/ccs" target="_blank">www.uoguelph.ca/ccs</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Room 037, Animal Science and Nutrition Building<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Guelph, Ontario, N1G 2W1<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
</span><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Charles Goldsmith [mailto:<a href="mailto:wokka@justfamily.org" target="_blank">wokka@justfamily.org</a>]
<br>
<b>Sent:</b> Wednesday, July 19, 2017 3:20 PM<br>
<b>To:</b> Lelio Fulgenzi<br>
<b>Cc:</b> voyp list, cisco-voip (<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>)<br>
<b>Subject:</b> Re: [cisco-voip] offline network - using NAT/PAT to connect to the outside world<u></u><u></u></span></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Be careful of SIP connections from your offline network getting to production devices. You don't want your Unity Connection to start reporting MWI status back to your production network or if using Single Inbox, to sync with your Exchange.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">My advice is to not let your offline network connect to anything on the public network, other than a couple of devices for you to go in and manage it from (ie, your workstation) and for specific tests.<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Wed, Jul 19, 2017 at 1:28 PM, Lelio Fulgenzi <<a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a>> wrote:<u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
A while back we had a good discussion about offline network upgrade preparation. A few people mentioned using NAT/PAT in order to connect to servers that would be too difficult to replicate in the off-line network.<br>
<br>
I'm trying to get my head around this and thought I'd share this simplified plan that I want to start off with.<br>
<br>
In the offline network we have:<br>
<br>
<br>
* a layer 3 switch that does the routing for the offline network<br>
<br>
* a router which does some other tasks like NTP, DHCP, etc.<br>
<br>
* layer 3 switch is connected to router<br>
<br>
Here's what I envision:<br>
<br>
<br>
* connect the router to a public network, i.e. network 45<br>
<br>
* configure NAT/PAT on the router so that all the inside networks (on the switch) are patted using the public network address<br>
<br>
* configure static routes on the router for all inside networks (on the switch) pointing to the switch<br>
<br>
* configure static routes on the router for specific outside networks pointing network 45 gw<br>
<br>
* configure static routes on the switch for specific outside networks pointing to the router interface<br>
<br>
The biggest issue here is that we have replicated many of our public networks in this offline network and there can't be any chance of that leaking.<br>
<br>
But I'm pretty sure this would prevent that.<br>
<br>
Thoughts? Gotchas?<br>
<br>
Lelio<br>
<br>
---<br>
Lelio Fulgenzi, B.A.<br>
Senior Analyst, Network Infrastructure<br>
Computing and Communications Services (CCS)<br>
University of Guelph<br>
<br>
<a href="tel:519-824-4120%20Ext%2056354" target="_blank">519-824-4120 Ext 56354</a><br>
<a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a><br>
<a href="http://www.uoguelph.ca/ccs" target="_blank">www.uoguelph.ca/ccs</a><br>
Room 037, Animal Science and Nutrition Building<br>
Guelph, Ontario, N1G 2W1<br>
<br>
<br>
______________________________<wbr>_________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/<wbr>mailman/listinfo/cisco-voip</a><u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div></div></div>
</div>
</blockquote></div><br></div>