1

In our office we have Verizon (ISP) and an OpenBSD. Now We want to add a second ISP (Comcast) using a Cisco RV320/325 Dual Wan Router. So, my question is regarding the communication between Cisco Dual Wan Router and OpenBSD. Does any one have experience with that type of setups? If so, can you shed a little light in order to understand what do I need to do?

I appreciate in advance any reply, and also let me know if you need further info about this setup.

Simple Network Topology enter image description here

5
  • I'm unclear what you are asking. OpenBSD is a host operating system. Are you asking if a host can use a Cisco router?
    – Ron Maupin
    Commented Nov 21, 2016 at 16:20
  • OpenBSD is just working as Firewall using a single ISP. Now we want to use Dual ISP.
    – Carlos
    Commented Nov 21, 2016 at 16:25
  • You are going to need to provide more information. A network diagram would be in order here. The OpenBSD host is off-topic, but you can certainly use a firewall with a router.
    – Ron Maupin
    Commented Nov 21, 2016 at 16:27
  • You should really have the firewall between your router and the ISPs. You can do it like you have drawn, but you will need to have firewall rules to allow any LAN traffic that must pass both directions through the firewall if your router is used for LAN routing. I don't really understand what the problem is.
    – Ron Maupin
    Commented Nov 21, 2016 at 18:38
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Aug 15, 2017 at 5:32

3 Answers 3

1

Ok, for those who are looking for a straight solution without bothering with OpenBSD configuration and avoid handling custom NATTING based on TWO (2) different ISP. I found out that Cisco RV325 has already a place to handle NATTING. That way I was able to setup successfully Verizon and Comcast without messing up with OpenBSD configuration.

Open this link for more info.

enter image description here

0

Because you are configuring your Cisco appliance with two WAN interfaces, you are first going to choose if the secondary connection you are adding is going to be for load balancing or for a failover (Cisco refers to this is Smart Link Backup). Once you have determined the purpose of the link, you may also configure the Network Service Detection, Protocol Binding, Service Management (port forwarding), and the bandwidth of your new WAN link.

Once you have configured the Cisco RV320, you will have to configure your OpenBSD firewall to correctly manage the new traffic that will be present on your network. How you configure the Firewall will depend on what services are running on it (NAT, IP Filtering, Layer 7 Firewall, etc.) and what you are trying to accomplish.

1
  • We plant to implement failover since our web framework is critical. Regarding the OpenBSD configuration, we are using NAT to manage the traffic from Verizon. Question: How OpenBSD will know which ISP is working. Let's say that Verizon is down, and Cisco appliance does the failover switching to Comcast. In that case, how OpenBSD will know about that change?
    – Carlos
    Commented Nov 21, 2016 at 19:40
0

Well, if you know Cisco routers more than OpenBSD, keep your setup.

In an OpenBSD-centric setup, where RV325 does routing only, OpenBSD does NAT, QoS, load-balancing and failover policies. In such scenario a couple of VRF istances have to be defined in RV325.

Being a VRF instance an isolated virtual router, each virtual router will route packets between two interfaces: one interface on an inside VLAN, and the other towards one ISP.

One trunk port would connect the Cisco RV325 to the inside, carrying both VLANs. The two VLANs will have to be carved out of an OpenBSD trunk too, so it can reach both ISPs, passing through each VRF instance.

OpenBSD will be at a crossroads where it can manage all traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.