3

Is it possible to set up routing rules without connecting additional cables to the Cisco routers? The problem is that we have old Ciscos, and two ethernet ports are used already. We use Cisco 1841 routers.

Example: I am on a PC with IP address 192.168.1.19, and I need to access 192.168.2.25, which is in a branch office. My office PC firewall (pfSense) has two network cards with IP addressess set up on them 192.168.1.28 and 10.0.0.1. The branch office has a similar firewall. They are connected through a VPN.

This would look something like this, I guess:

192.168.1.19 (client) -> 192.168.1.1 (Cisco router) -> 192.168.1.28 (pfSense) -> 10.0.0.1 -> 10.0.0.2 -> 192.168.2.28 (pfSense) -> 192.168.2.1 (Cisco router) -> 192.168.2.25 (client)

I know this probably looks so bad, so you are welcome to criticize. I am just trying to learn networking while being sysadmin and have some constraints.

Basically here I want to set up VPN between two offices using different internet source and spare computers with pfSense installed.

Edit: I have created a detailed diagram if that helps to understand the reason behind this. I want to create a new VPN for a new "test" network in the branch office while not breaking old VPN connection. If this works, then I can replace the old VPN link.

enter image description here

The two ethernet ports on the Ciscos used for 1 - our main network, 2 - VoIP system.

Looking at the diagram, I guess if our internet traffic is routed through the firewall, the same way should be possible to route traffic between the subnets, correct?

Edit2: corrected picture IP addresses

0

Based on your updated diagram and edits, you have one obvious problem: multiple routes to the same remote network.

You need to prioritize the routes to use the test network when you want to test. In your Ciscos, you should be able to do this, but it depends on how you have the routes set up in the device. One of the easiest ways is to use administrative distance to do this. Set AD lower on the route you wish to prefer and higher on the backup route. AD works with both statically defined routes or routes received through routing protocols.

You didn't include the Cisco configurations, so I don't know how the Ciscos get the routes to the other site.

| improve this answer | |
  • Thanks to you I got an introduction to something important. By looking at configs I think route to reach network 192.168.2.0 is set up via serial using eigrip and distance is 90: D 192.168.2.0/24 [90/1764352] via 192.168.220.2 where 192.168.220.2 is IP of branch office IP on serial interface. However there is another rule: S* 0.0.0.0/0 [1/0] via 192.168.1.10 (some of our internal IPs are not from private range, but I did not want to disclose here).. so the question goes deep somewhere, maybe I think better of first removing VPN and replacing it, not doing side by side. – Clear Sky Oct 29 '15 at 0:10
  • I think that setting up a static route to one subnet on the other side (must be done on both sides), as a test (after hours) for that route, is quick easy to enable and disable. The static route will have a lower AD than EIGRP, and you could run the tests between the two subnets, then disable the route on each side when you are done testing. – Ron Maupin Oct 29 '15 at 2:34
1

if your network looks like the next enter image description here

so router it self won't handle any routing regard the VPN or additional VPN connections because pfsense will handle it . router will just has a default route to the firewall to access any network in the other side . so router won't involve in creating new VPN over new ISP , pfsense will

| improve this answer | |
  • But my computer gateway set up as 192.168.1.1 I forgot to mention. – Clear Sky Oct 28 '15 at 12:14
  • OK no problem , router will handle routing between your network and the other site network . – Gadeliow Oct 28 '15 at 12:37
  • @clearsky If your network actually looks like this, then you could (should?) change your default gateways to be the pfsense boxes and just retire the routers. The one thing I don't understand is you say your 1841s have two interfaces and both are in use, but that's not what this diagram shows. Can you make a diagram of your actual network topology and add it to the question? – Todd Wilcox Oct 28 '15 at 12:39
  • Thanks, I have updated the question with current diagram, maybe that helps. Thank you for your reply. – Clear Sky Oct 28 '15 at 17:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.