Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Cisco > routing with multiple routers in one subnet

Reply
Thread Tools

routing with multiple routers in one subnet

 
 
Pascal
Guest
Posts: n/a
 
      03-22-2007
Hello,

I have 2 subnets :
Main subnet : 10.0.0.0/24
Remote office subnet 10.0.1.0/24

There are 2 routers connected to the Main subnet :
- 1 that connects 10.0.0.0/24 to 10.0.1.0/24 with ip of 10.0.0.253
- 1 that connects 10.0.0.0/24 to the internet with ip of 10.0.0.254

If the default gateway on all machines in the Main subnet is 10.0.0.254
How can I route properly my traffic without having to create a
persistent route on all my machines in the 10.0.0.0/24 subnet for the
10.0.1.0/24 subnet ?

Thanks
 
Reply With Quote
 
 
 
 
ghett0
Guest
Posts: n/a
 
      03-22-2007
Pascal wrote:
> Hello,
>
> I have 2 subnets :
> Main subnet : 10.0.0.0/24
> Remote office subnet 10.0.1.0/24
>
> There are 2 routers connected to the Main subnet :
> - 1 that connects 10.0.0.0/24 to 10.0.1.0/24 with ip of 10.0.0.253
> - 1 that connects 10.0.0.0/24 to the internet with ip of 10.0.0.254
>
> If the default gateway on all machines in the Main subnet is 10.0.0.254
> How can I route properly my traffic without having to create a
> persistent route on all my machines in the 10.0.0.0/24 subnet for the
> 10.0.1.0/24 subnet ?
>
> Thanks


It's a kludge, but point your workstations to the 10.0.0.254 address for
their default gateway. Ensure that this router knows how to get to
10.0.1.0/24 via 10.0.0.253. The router should issue ICMP redirects to
the clients when they try to send traffic to the 10.0.1.0/24 subnet.

You should consider creating a transit network. Create a third subnet
and place your Internet edge router in it.

Workstations 10.0.0.0/24 -> Main router -> Remote router (10.0.1.0/24)
|
| <- (Transit network)
| 10.x.x.x/30
|
Internet edge

The Internet edge router needs two routes. First, it has a default route
to your ISP's next hop. Second, it has a route 10.0.0.0/8 pointing to
the transit address of the main router.
 
Reply With Quote
 
 
 
 
Pascal
Guest
Posts: n/a
 
      03-22-2007
Thanks ghett0 !

You are right it will be a mess. Unfortunately those people who are
setting up the Remote offices want me to set things up this way. I am
trying to find a way to prove them that there should be a better one.

Here's what they suggested me to do :
http://www.duchemin.org/visio.vsd



here's what I think you said I should do :
http://www.duchemin.org/visio2.vsd
Does this look right ?



Thanks again !




ghett0 wrote:
> Pascal wrote:
>> Hello,
>>
>> I have 2 subnets :
>> Main subnet : 10.0.0.0/24
>> Remote office subnet 10.0.1.0/24
>>
>> There are 2 routers connected to the Main subnet :
>> - 1 that connects 10.0.0.0/24 to 10.0.1.0/24 with ip of 10.0.0.253
>> - 1 that connects 10.0.0.0/24 to the internet with ip of 10.0.0.254
>>
>> If the default gateway on all machines in the Main subnet is 10.0.0.254
>> How can I route properly my traffic without having to create a
>> persistent route on all my machines in the 10.0.0.0/24 subnet for the
>> 10.0.1.0/24 subnet ?
>>
>> Thanks

>
> It's a kludge, but point your workstations to the 10.0.0.254 address
> for their default gateway. Ensure that this router knows how to get to
> 10.0.1.0/24 via 10.0.0.253. The router should issue ICMP redirects to
> the clients when they try to send traffic to the 10.0.1.0/24 subnet.
>
> You should consider creating a transit network. Create a third subnet
> and place your Internet edge router in it.
>
> Workstations 10.0.0.0/24 -> Main router -> Remote router (10.0.1.0/24)
> |
> | <- (Transit network)
> | 10.x.x.x/30
> |
> Internet edge
>
> The Internet edge router needs two routes. First, it has a default
> route to your ISP's next hop. Second, it has a route 10.0.0.0/8
> pointing to the transit address of the main router.

 
Reply With Quote
 
Dave
Guest
Posts: n/a
 
      03-22-2007
On 22 Mar, 20:30, Pascal <(E-Mail Removed)> wrote:
> Hello,
>
> I have 2 subnets :
> Main subnet : 10.0.0.0/24
> Remote office subnet 10.0.1.0/24
>
> There are 2 routers connected to the Main subnet :
> - 1 that connects 10.0.0.0/24 to 10.0.1.0/24 with ip of 10.0.0.253
> - 1 that connects 10.0.0.0/24 to the internet with ip of 10.0.0.254
>
> If the default gateway on all machines in the Main subnet is 10.0.0.254
> How can I route properly my traffic without having to create a
> persistent route on all my machines in the 10.0.0.0/24 subnet for the
> 10.0.1.0/24 subnet ?
>
> Thanks


Can you not simply insert a static route on the internet router...

ip route 10.0.1.0 255.255.255.0 10.0.0.253

this would route traffic destined for the 10.0.1.0 back out the
interface to the remote network through the proper gateway router.

Dave

 
Reply With Quote
 
Frank Winkler
Guest
Posts: n/a
 
      03-23-2007
Dave wrote:

>Can you not simply insert a static route on the internet router...
>
>ip route 10.0.1.0 255.255.255.0 10.0.0.253
>
>this would route traffic destined for the 10.0.1.0 back out the
>interface to the remote network through the proper gateway router.


You can but as ghett0 already mentioned, this wouldn't result in real
routing but rather in ICMP redirects. I had a similar setup and in my
experience, this doensn't work reliably cause not all clients handle the
redirects properly.

But anyway, it's an interesting thing. How is this defined? If the remote
end of the static route is in the same subnet as the source address an ICMP
redirect is sent back?

Regards

fw
 
Reply With Quote
 
ghett0
Guest
Posts: n/a
 
      03-23-2007
Pascal wrote:
> Thanks ghett0 !
>
> You are right it will be a mess. Unfortunately those people who are
> setting up the Remote offices want me to set things up this way. I am
> trying to find a way to prove them that there should be a better one.
>
> Here's what they suggested me to do :
> http://www.duchemin.org/visio.vsd
>
>
>
> here's what I think you said I should do :
> http://www.duchemin.org/visio2.vsd
> Does this look right ?
>
>
>
> Thanks again !
>
>
>
>
> ghett0 wrote:
>> Pascal wrote:
>>> Hello,
>>>
>>> I have 2 subnets :
>>> Main subnet : 10.0.0.0/24
>>> Remote office subnet 10.0.1.0/24
>>>
>>> There are 2 routers connected to the Main subnet :
>>> - 1 that connects 10.0.0.0/24 to 10.0.1.0/24 with ip of 10.0.0.253
>>> - 1 that connects 10.0.0.0/24 to the internet with ip of 10.0.0.254
>>>
>>> If the default gateway on all machines in the Main subnet is 10.0.0.254
>>> How can I route properly my traffic without having to create a
>>> persistent route on all my machines in the 10.0.0.0/24 subnet for the
>>> 10.0.1.0/24 subnet ?
>>>
>>> Thanks

>>
>> It's a kludge, but point your workstations to the 10.0.0.254 address
>> for their default gateway. Ensure that this router knows how to get to
>> 10.0.1.0/24 via 10.0.0.253. The router should issue ICMP redirects to
>> the clients when they try to send traffic to the 10.0.1.0/24 subnet.
>>
>> You should consider creating a transit network. Create a third subnet
>> and place your Internet edge router in it.
>>
>> Workstations 10.0.0.0/24 -> Main router -> Remote router (10.0.1.0/24)
>> |
>> | <- (Transit network)
>> | 10.x.x.x/30
>> |
>> Internet edge
>>
>> The Internet edge router needs two routes. First, it has a default
>> route to your ISP's next hop. Second, it has a route 10.0.0.0/8
>> pointing to the transit address of the main router.

Hi Pascal,

Now that I see what you're trying to do, I'd suggest that you see if
your MPLS vendor will let you connect the local switch at your "Main"
location directly to the IAD. The IAD 2431 looks like it supports two
fast ethernet interfaces. You could drop your local "Main" workstations
into the IAD, and it would send traffic destined for the remote location
directly to the MPLS cloud. Otherwise, the IAD could send Internet-bound
traffic directly to the Fortigate. Check with your provider and see if
they'll work with you on this.

Another option would be to enable routing capability into your "Main"
switch. The idea here, again, is that you put your workstations into
their own subnet so that those end points don't have to have specific
routing information or rely in ICMP redirects. Enabling a routing
function on that switch could address this.

I guess it comes down to if your comfortable having the MPLS provider
treat your "Main" location as just another stub network. Also, how much
"control" do you want in terms of handing off traffic to the remote
sites and the Internet.

Just throwing ideas out there!

 
Reply With Quote
 
Pascal
Guest
Posts: n/a
 
      03-23-2007
ghett0,

Please see my replies below

ghett0 wrote:

Hi Pascal,
> Now that I see what you're trying to do, I'd suggest that you see if
> your MPLS vendor will let you connect the local switch at your "Main"
> location directly to the IAD. The IAD 2431 looks like it supports two
> fast ethernet interfaces. You could drop your local "Main"
> workstations into the IAD, and it would send traffic destined for the
> remote location directly to the MPLS cloud. Otherwise, the IAD could
> send Internet-bound traffic directly to the Fortigate. Check with your
> provider and see if they'll work with you on this.


Here's what I think you suggested :
http://www.duchemin.org/visio3.vsd

As you said, I am really not comfortable having the MPLS provider be in
front of my firewall and route my internet traffic, I would lose too
much control. And I'm worried that if I need something done someday they
will take forever to fix it.

>
> Another option would be to enable routing capability into your "Main"
> switch. The idea here, again, is that you put your workstations into
> their own subnet so that those end points don't have to have specific
> routing information or rely in ICMP redirects. Enabling a routing
> function on that switch could address this.

I kind of see the idea of that solution. The issue is that our switches
do not have routing capabilities. ( By the way is it what a Layer 3
switch is ? )

>
> I guess it comes down to if your comfortable having the MPLS provider
> treat your "Main" location as just another stub network. Also, how
> much "control" do you want in terms of handing off traffic to the
> remote sites and the Internet.
>
> Just throwing ideas out there!
>

Thanks for all your advices.



Now, in order to keep reasonable control of my traffic, do you think
that http://www.duchemin.org/visio2.vsd is technically doable ?
The fortigate firewall is also a router. It has 3 interfaces :
- WAN1 connected to Iquest router ( xxx.xxx.xxx.129/27 );
- WAN2 connected to Nuvox router ( 10.0.3.0/30 ),
- LAN1 connected to Main office subnet ( 10.0.0.0/24 )

If I would just create routes on the fortigate to route traffic
from 10.0.0.0/24 to xxx.xxx.xxx.129/27 for internet access to WAN1
and
from 10.0.0.0/24 to 10.0.3.0/30 for 10.0.1.0/24 to WAN2



Is this a way to do it too ?


Thanks
 
Reply With Quote
 
Pascal
Guest
Posts: n/a
 
      03-23-2007
Dave,

Thanks for your reply. Based on Frank's experience, this might cause
stability issues. So I'd rather not go this way.

However do you or Frank know if this : http://www.duchemin.org/visio2.vsd
could work ?

The fortigate firewall is also a router. It has 3 interfaces :
- WAN1 connected to Iquest router ( xxx.xxx.xxx.129/27 );
- WAN2 connected to Nuvox router ( 10.0.3.0/30 ),
- LAN1 connected to Main office subnet ( 10.0.0.0/24 )

If I would just create routes on the fortigate to route traffic
from 10.0.0.0/24 to xxx.xxx.xxx.129/27 for internet access to WAN1
and
from 10.0.0.0/24 to 10.0.3.0/30 for 10.0.1.0/24 to WAN2

Is this a way to do it too ?


Thanks guys !


Dave wrote:
> On 22 Mar, 20:30, Pascal <(E-Mail Removed)> wrote:
>
>> Hello,
>>
>> I have 2 subnets :
>> Main subnet : 10.0.0.0/24
>> Remote office subnet 10.0.1.0/24
>>
>> There are 2 routers connected to the Main subnet :
>> - 1 that connects 10.0.0.0/24 to 10.0.1.0/24 with ip of 10.0.0.253
>> - 1 that connects 10.0.0.0/24 to the internet with ip of 10.0.0.254
>>
>> If the default gateway on all machines in the Main subnet is 10.0.0.254
>> How can I route properly my traffic without having to create a
>> persistent route on all my machines in the 10.0.0.0/24 subnet for the
>> 10.0.1.0/24 subnet ?
>>
>> Thanks
>>

>
> Can you not simply insert a static route on the internet router...
>
> ip route 10.0.1.0 255.255.255.0 10.0.0.253
>
> this would route traffic destined for the 10.0.1.0 back out the
> interface to the remote network through the proper gateway router.
>
> Dave
>
>

 
Reply With Quote
 
Frank Winkler
Guest
Posts: n/a
 
      03-23-2007
Pascal wrote:

>The fortigate firewall is also a router. It has 3 interfaces :
>- WAN1 connected to Iquest router ( xxx.xxx.xxx.129/27 );
>- WAN2 connected to Nuvox router ( 10.0.3.0/30 ),
>- LAN1 connected to Main office subnet ( 10.0.0.0/24 )
>
>If I would just create routes on the fortigate to route traffic
>from 10.0.0.0/24 to xxx.xxx.xxx.129/27 for internet access to WAN1
>and
>from 10.0.0.0/24 to 10.0.3.0/30 for 10.0.1.0/24 to WAN2
>
>Is this a way to do it too ?


Sounds reasonable. But if you now have a triple-interface firewall,
depending on what kind the link to 10.0.1.0/24 is, you could omit the
transfer network. Or is it a kind of connection only the former 10.0.0.253
can handle?

Regards

fw
 
Reply With Quote
 
Frank Winkler
Guest
Posts: n/a
 
      03-23-2007
Pascal wrote:

>However do you or Frank know if this : http://www.duchemin.org/visio2.vsd
>could work ?


No clue - I can't view this file since I neither have Billy-OS nor Visio

Regards

fw
 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Cisco 1812 subnet to subnet NAT Amadej Cisco 1 09-04-2007 06:53 PM
Add a private subnet to existing real class C subnet bubbleserver@gmail.com Cisco 5 01-18-2007 04:59 PM
cannot ping from subnet A to subnet B for a specific host soup_or_power@yahoo.com Cisco 16 08-04-2006 02:30 PM
Subnet a subnet mask? Vass Computer Support 1 08-26-2005 01:02 PM
RE: Can anyone point me to some good subnet & subnet mask how tos..... Anonymous MCSA 0 04-02-2004 10:25 AM



Advertisments