1

We have a straight forward internet connection which has a small /29 IP range. The connection is Ethernet and our default gateway is the first IP in the /29 range.

Our ISP has just given us a secondary IP range, a /28. They have told us that we need to use the first IP of that range as our default gateway.

Now the device it's connected to is a Juniper SRX.

Initially I thought this wouldn't be an issue but it turns out it's more tricky than I thought.

  • I can't just use any of the new IP addresses on the existing untrust interface because traffic isn't routed back to the correct gateway.
  • I can use a virtual router as the networks both come in over the same Ethernet cable and are plugged into a single interface

I was thinking that maybe I need to use source or policy based routing.

Does anyone have any ideas? Should I go back to them and ask for them to just route the new /28 subnet to IP address of the SRX in the original /29? Is PBR/SBR the way to go?

The only thing I know about their config is that the device is a Cisco and has the following config snippet

interface FastEthernet1/0/2
description *** Link into customer LAN ***
no switchport
ip address 1.0.0.145 255.255.255.240 secondary
ip address 1.0.0.121 255.255.255.248

#ping 8.8.8.8 source 1.0.0.145

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
Packet sent with a source address of 1.0.0.145 
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/20/26 ms
Improve this question
1
  • 2
    Ask them to properly set up a /30 point-to-point connection between them and you, and route your two blocks over it.
    – stevieb
    Sep 4, 2015 at 17:18

2 Answers 2

Reset to default
1

As @stevieb said, a link subnet and two routes is the correct path, but few ISPs do that these days. (esp. in a co-lo, which is what this looks like)

As the gateway for both networks is the same interface on the same device, there should be no issue with sending traffic from either subnet to either gateway. I've had the exact same setup in many data centers, and it was never an issue. If they have something odd set up (ACLs, etc.), then VRF or PBR would be logical solutions. The SRX should have plenty of CPU to do either; personally, I'd do PBR as it's less headache.

Improve this answer
1
  • I set this up in GNS3 and it works fine with just a Cisco router configured with the config above and then a vSRX configured with the 2 IP addresses in different subnets but with a single default route to the first gateway. This same config doesn't work on the live device, I will have to raise it with the ISP
    – Gareth Hastings
    Sep 9, 2015 at 10:02
0

I'm not quite following the question. What did you mean when you wrote

I can't just use any of the new IP addresses on the existing untrust interface because traffic isn't routed back to the correct gateway.

Traffic from the inet? It's not routed back to what gateway? Maybe an ascii drawing?

I'm also don't know what to think about "VRF or PBR." (assuming by PBR we mean filter-based forwarding rather than an execrable brand of beer). If I understand your configuration, you can't use either b/c the ISP's two subnets appear on the same SRX unit interface. You can't put a unit interface in two routing-instances and expect the box to commit the config. (To put it another way, you place interfaces in routing-instances, not addresses.) That also means you can't provision FBF because FBF routes traffic out different routing-instances depending on your filter. Wow, it's probably been 5 years since I did FBF ...

I am SO confused!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.