Routing traffic between two subnets

Question

I currently admin a small network, it has two separate sites (site1 site2). Each site has independent internet, and a Sonic NSA 220 Firewall. There is currently VPN connecting the two Sonic firewalls, so the sites can communicate without any issues.

Our ISP has just installed a 'router' at each site (ISP Router 1 & 2), so it now presents two ports...Internet Port (ISP-WAN) and a inter-site port (ISP-LAN). This is so we can eliminate the VPN, and route traffic direct through the ISP cloud (ISP-LAN)

I am wanting to know how to set up the ports routing, so I can tell the firewall to route internal traffic through this new ISP-LAN port.

Each site has a DC (same domain) and a separate DHCP (sites have different IP ranges).

I was thinking I could connect port X6 on each firewall to the ISP-LAN port, this would connect the two sites (Blue Line), but not sure how to configure the routing/rules. Everything has the Sonic WAN port as its default gateway. I don't want the DHCP traffic etc broadcasting between sites.

Look forward to any help on this one.

Thanks

Answer 1

You are correct, if you have a free interface (eg. X6) on each router connect ISP-LAN at each site to that interface. I don't know if the SonicWALLs support VRRP but it is not needed. DHCP will not cross subnets unless you enable an IP Helper.

The ISP-LAN connection replaces your VPN but you will need to add some routes (which would have been implied or created previously due to the VPN). I'm guessing your ISP will refer to this has a managed VPN, an MPLS or a VLAN network.

However you will need to know what IPs/network your ISP has assigned to each ISP-LAN (where you have "???" in your picture).

First Case: IF your ISP has given you IPs on your subnets at each site (eg. 10.10.1.254 at Site 1 and 192.168.1.254 at Site 2) then you can route via these IPs. Assign (or leave) X6 on the LAN (same as X2/X3/etc). Then go to Network | Routing. You will need to create a route on each site (or you could use RIP, but not needed for 2 sites).

At Site 1 your route will be something like:

Source: Any
Destination: Site2 Subnet (192.168.1.0 / 255.255.255.0)
Service: Any
Gateway: ISP-LAN IP (10.10.1.254)
Interface: LAN/X0  (since it's on the LAN)
Metric: 20 (should be fine)

Create a similar route at Site 2 (but Destination of Site 1's Network using the Gateway of ISP-LAN at Site 2 [192.168.1.254]). I've done this for clients when this is how the ISP has configured things (used IPs on the local LAN to provide access via "the cloud").

Second Case: HOWEVER, if the ISP has used a DIFFERENT subnet for the ISP-LAN connection (such as 172.16.1.x or something) then you will need to configure X6 to be on that subnet, you won't need NAT. I've also done this for clients (where the ISP provides a 3rd subnet to join to 2 sites) -- in this case X6 will be on that 3rd subnet and the routes will be created automatically [just allow access with firewall rules].

So a QUESTION for you: What is the IP/subnet of the ISP-LAN at each site? Is it as you have in your picture (the X6 / ??? IPs) or is it something else?

EDIT: (since I can't add a comment)

I'm glad that helped. You would have DHCP traversing if the ISP configured the link as a Layer 2 link (essentially a VLAN) between the 2 ISP routers -- DHCP wouldn't cross Layer 3 without assistance but will Layer 2 (like on a switch). Now that you have added a different subnet to the link (your 10.0.0.1/30 subnet) you should be fine (the routers won't pass DHCP broadcast traffic beyond the subnet).

You can configure the routes with Probes so that they will deactivate if something fails, if you convert your VPN from an IPsec Policy VPN to a Tunnel Based VPN (which uses routes for the VPN) you can have it fail-over if you wanted. BUT since the ISP's VLAN and the Internet based VPN are running through the same ISP router the chance of only ONE failing is slim. (if you had a different back-up ISP then having a backup VPN would be a good idea)

As for the speed issue, I would check if you have BWM enabled on either router, other than that contact your ISP.

Answer 2

I am not too sure but I think I can help.

So if I understand correctly you want to use the blue lines ( ISP-LAN) instead of the red lines ( VPN).

You should configure the firewalls so that they are in VRRP (Virtual Routing Redundancy protocol) with each other. Then have your equipment point to the virtual IP of the VRRP, also you would want to contact the ISP and have them also configure their router point to the virtual gateway.

You will probably have to configure 2 different vrrp groups if you want to do load balancing : lets say vrrp group1 and vrrp group2. Where vrrp group1 is master for site1 and has site2 as backup. and vrrp group2 is master for site2 and backup for site1. In this case load balancing can be done.

Before you use the new connection shut off the vpn.

to read more on this please read vrrp.

Answer 3

thanks for your help with this. I have implemented the following, and it is kind of working, at least with the test machines I am using. I have set up pretty much what I think you described @PSaul. I have set port X6 on each firewall to a new zone (Interoffice, Trusted) and given them a static IP, 10.0.0.1/30 and 10.0.0.2/30. I then set up a route (as you described @PSaul) on each firewall that sends any traffic going to the other subnet to the X6 IP address on the far ends firewall, and send it through the local X6 port. The ISP had set the interoffice link (between their two routers as a Layer 2 connection, so was sending everything across. I found I was getting DHCP traffic across the networks, so not sure what I have in the network that is helping it traverse the subnets.

I have not disabled the VPN yet, and have just set this up for test machines with a very low metric, so they are using this link before the VPN (I like that).

I have not sent all traffic over the link yet, as I have one weird thing, but maybe a different question. I get nice fast traffic in one direction, but traffic in the opposite direction is about 1/3 the speed pretty consistently. It doesn't quite look like traffic shaping, but something odd going on.

Well, I learnt more so that's good. Thanks for your help. Just need to figure out the issue with the speed in one direction.