Current network is:

Cable modem <=> Router (Cisco 1941/K9) <=> Switch (Cisco C2960S-48FPS-L)

After the IT guy who recommended a bunch of equipment fell off the face of the earth, I decided to setup my home network myself. I'm a former computer security expert (application level) but not IT trained. Network works, but could be better. I set up some VLANs (security cameras, etc.), plus Cisco security zones.


  1. My network WAN Connection is slow, definitely slower than it should be.
  2. I’m double NATed: router & modem.

Internal LAN is speedy.

I recall IT consultant said we could plug the modem directly into the switch. I didn’t understand this at the time. I think I understand better now. If I put the modem on its own VLAN and run security protocols between VLANs, then that should be secure, right? I’m confused, however, because I assumed that the router (with its security card) being between the modem and the switch (and therefore my internal LANs) provided better security (firewall, etc.). Also, how will internal VLAN clients *know* how to find the cable modem as a gateway? Do they first go to the Router and then Switch short circuits connections to the modem's port from there on out?

Cable modem <=> Switch (Cisco C2960S-48FPS-L) <=> Router (Cisco 1941/K9)

Tl/dr: can I connect my cable modem directly to my switch on its own VLAN, thereby improving speed, eliminating double NAT and still enjoy network security?


EDIT I: (12-17-19)

Request below for more info re: Security and Control.

I have Cisco Zone security policies running on the VLANs, IP NAT, auditing. I have complete control of my modem (at least, what Xfinity allows), so I can set a fair amount of security policies, IP addresses, etc.

Partial router configuration copied below:

parameter-map type inspect pmap-ip-clients-to-wan
 audit-trail on
class-map type inspect match-any http-protocols
  description --- Hyper Text Transport Protocols ---
 match protocol http
 match protocol https
policy-map type inspect usr-to-wan-policy
 class type inspect http-protocols
 class type inspect mail-protocols
 class type inspect icmp-protocol
 class type inspect vpn-to-wan-protocols
 class type inspect appl-services
 class type inspect pinhole-exceptions
 class type inspect eng-clients-to-wan
 class class-default
  drop log
interface GigabitEthernet0/0
 description WAN side dhcp client
 ip address dhcp
 no ip redirects
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly in
 zone-member security WAN
 duplex auto
 speed auto
 no cdp enable
 no mop enabled
interface Vlan50
 description --- Meeting Hall for Family ---
 ip address
 ip nat inside
 ip virtual-reassembly in
 zone-member security USR
  • What kind of 'security protocols' do you mean exactly? How much access do you have to the modem's configuration? Dec 17, 2019 at 6:06
  • @grawity I've updated the question with more info. Please see the EDIT. ty. -a Dec 17, 2019 at 17:48
  • Set the modem to forward everything. Use the router for security.
    – Larryc
    Dec 17, 2019 at 18:31
  • @Larryc I’ve tried that before. Wasn’t successful. Comcast router gets in the way in manner that’s a problem. Also, it’s bridge mode isn’t a real bridge mode. Putting router in a DMZ has problems. I’d like to VPN and use DDNS eventually and there are issue. Also, I’m warming to the idea of modem connected to the switch, if it can be secure. Dec 17, 2019 at 18:45


You must log in to answer this question.

Browse other questions tagged .