Member Avatar for wajeeh_r

Hello,

I am located in Jeddah, Saudi Arabia. I have two offices branches in Jeddah city.

In (office 1) I have 1MB internet connection along with it I have the following Public IP address range.


.115 and so on till

All these public IP’s are reachable from outside Saudi Arabia also with in Saudi arabia. I also have a cisco router in my (office 1).

At the other branch that is say (office 2). I have a range of Public IP addresses as


.147 and so on till

There is no internet connection at (office 2) only I have the above mentioned IP addresses range.

These IP addresses at (office 2) are only reachable if some one tries to ping them from with in Saudi Arabia. But they are not reachable from the internet users worldwide that is outside Saudi Arabia. I also have another router at (office 2).

I would like to know is it possible to configure at router in office 1, and some configuration at router in office 2
so that if my partner who is located in Germany and wanted to reach the IP that is the range at office 2, he can reach via the router at (office 1) where I have the internet connectivity.

Is it possible by NAT or by Access Lists. Please guide me how can this be done as I am having routers at both branches. What configuration is to be done in routers at both offices to accomplish this task.

Thanks & regards,
wajeeh

  • 3 Contributors
  • 4 Replies
  • 223 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by ardentsunshine

Dani AI

Generated

Short summary and practical plan based on the thread (references to posts by , and are preserved here for context). The key fact is that local static or dynamic routes only control forwarding on routers that already see the traffic. If the IP block for the second office is not announced into the global BGP table by the ISP, hosts on the wider Internet will not be able to reach those addresses no matter what static routes are added locally. (cisco.com)

Practical options that work without changing how the ISP routes the block:

  • Place a publicly reachable IP from Office‑1 on the Internet and perform a 1:1 static NAT to the host at Office‑2. Carry the translated traffic across a site‑to‑site tunnel (IPsec or GRE over IPsec) so Office‑2 can receive and reply. Example (placeholders only):
interface Gig0/0
 ip address <OFFICE1-WAN> 255.255.255.240
 ip nat outside

interface Tunnel0
 ip address 10.255.255.1 255.255.255.252
 ip nat inside

ip nat inside source static <OFFICE2-HOST-IP> <OFFICE1-PUBLIC-IP>
ip route <OFFICE2-HOST-IP> 255.255.255.255 10.255.255.2

This keeps the global address space on Office‑1 and tunnels real traffic to Office‑2. Use NAT on the Internet edge and IPsec on the tunnel endpoints. (cisco.com)

Other approaches and constraints:

  • An application reverse‑proxy on a server in Office‑1 can forward specific services to Office‑2 (lighter than 1:1 NAT for single apps).
  • Asking the ISP to announce Office‑2’s block (or moving the block so it is announced from Office‑1) will make those IPs globally routable, but this requires provider cooperation, BGP/AS considerations, and is usually more involved than NAT/proxy. (cisco.com)

Verification checklist and quick troubleshooting:

  • Confirm whether the Office‑2 prefix is announced (use a BGP looking‑glass / RIPEstat or Hurricane Electric toolkit).
  • From outside the country run traceroutes to see where the path stops.
  • On the routers use show ip route, show ip nat translations, and show crypto ipsec sa to verify routing, NAT and tunnel state. (bgp.he.net)

Security note: avoid opening full ranges publicly—map only required services, apply ACLs on the NAT/edge device, and protect the site‑to‑site tunnel with strong keys and crypto policies.

Recommended Answers

All 4 Replies

Member Avatar for ardentsunshine

You can use static or dynamic routes

You can tell your router if he pings say your Eth 0/1 to forward it out your Serial 0/0

If you went with dynamic you could have your internet fowarded to your office two. A static would only allow a certain ip address to connect. If you go with dynamic you can set an ACL access control list or extended ACL to block certain ports or ips etc.

Member Avatar for ardentsunshine

if you wanted a range you use wildcard bits so if you wanted all addresses you would use if you wnated a specific one or all address for a network number 255.255.255.0. Just search for the command ip route on ciscopedia if you have it. It's relativley easy if you have the syntax

Member Avatar for marinme

There is no internet connection at (office 2) only I have the above mentioned IP addresses range.

How are the two offices connected? How are people in Saudi Arabia able to see the second set of IPs if they are not connected to the internet or another network with an internet connection?

Member Avatar for ardentsunshine

How are the two offices connected? How are people in Saudi Arabia able to see the second set of IPs if they are not connected to the internet or another network with an internet connection?

you can use a static or dynamic route If they can send info to say the routers serial then they route that info to the other router which connects to the internet.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.