1

I have a tunneling setup working in the lab using a pair of Cisco routers directly connected via Ethernet crossover on their WAN ports to simulate the internet. The problem is this is not realistic enough because the WANs have to be on the same subnet with this very simplified setup (afaik).

To add context, the customer wants to add a VPN in addition to an existing T1 without disturbing what is already there and there is no interest in giving internet access to the remote site, just another way to connect to the main office, via VPN in addition to T1.

So again, I have everything tested and working but the problem is I am quite sure it will not work "IRL" because of the default gateways below and the fact that in real life the WAN IPs of course are not on the same subnet.

So the question really has two parts:

  1. For future reference what is the easiest and cheapest thing to put "in the middle" so that I could use completely different IP addresses on the two WAN connections and have a much better lab, and
  2. Do you believe the third commented routes shown in each set below, or rather something similar, will be sufficient to make it work once on the customer site with the real IPs and the real ISP gateway IPs?

Essential details of both configs:

!-- MAIN OFFICE
!-- - WAN meant for VPN only
interface FastEthernet0/1
 ip address 212.212.212.212 255.255.255.248
 speed auto
 crypto map MY_MAP
!-- - LAN
interface FastEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 speed auto
!-- - VPN - not shown for brevity
!-- - Routes - .8 is a completely different gateway device.
ip route 0.0.0.0 0.0.0.0 192.168.1.8
ip route 192.168.2.0 255.255.255.0 192.168.2.1
!-- - If remote were 222.222.222.213 and main 
!--   office ISP gw were 212.212.212.214,
!--   will this be sufficient?
!ip route 222.222.222.213 255.255.255.248 212.212.212.214

!-------------------------------------

!-- REMOTE OFFICE
!-- - WAN meant for VPN only
interface FastEthernet0/1
 ip address 212.212.212.213 255.255.255.248
 speed auto
 crypto map MY_MAP
!-- - VPN - not shown for brevity
!-- - LAN
interface FastEthernet0/0
 ip address 192.168.2.1 255.255.255.0
 speed auto
!-- - Routes
ip route 0.0.0.0 0.0.0.0 192.168.1.1
ip route 192.168.1.0 255.255.255.0 192.168.1.1
!-- - If 222.222.222.214 were ISP gw address at remote, will this be sufficient?
!ip route 212.212.212.212 255.255.255.255 222.222.222.214
Improve this question

1 Answer 1

Reset to default
0
  1. For your simulation, you could just put another router in between the two site routers to act as the Internet.
  2. The commented routes will allow you to get the the Internet interface of the other side. I'm puzzled by the different masks used in the routes. You have 255.255.255.248 assigned to the interfaces, and you use that on the router at the Main site, but at the Remote site you use 255.255.255.255 as the route to the Main router. Neither one will allow general Internet access since you have your default route pointing to your LAN at the Main site. You may want to adjust the default route at the Remote site to point to the next hop (T1) and add another default route with a higher AD to point to the VPN to give you a backup default route for when the T1 fails.
Improve this answer
6
  • The 255/248 difference was an accident. I guess I would put them both at 255 ideally, so that it's more exact, because the purpose of that commented route is to try and guarantee that the VPN traffic flows only out the WAN intended to be used for the VPN, not out the T1 which has a downstream connection to a WAN gateway as well. So it's intended to make the routes work out. I don't feel like it's sufficient.
    – user62177541
    Dec 11, 2015 at 19:44
  • Your statically defined routes should have the actual next hop. For instance, your remote site has routes for the default and the subnet of the default for which the remote router has no route. You are setting the next hop to an address on the main site, but the remote router doesn't know that address is at the main site. Your routes need to know the next hop. You can create those routes with the real next hop for the T1 and the VPN, and distinguish them with AD, putting the higher AD on the backup route.
    – Ron Maupin ♦
    Dec 11, 2015 at 19:55
  • Could you expand a bit on how the middle router would roughly be configured? Like let's say in the scenario above, we have two ISP connections that have a block of IPs with one designated as gateway, so it would be nice if the router would emulate all that. And then it would also have to tie the two disparate networks together with what, a couple routes? The routing seems to be working, essentially as described in the original post, using routes similar to those commented ones, and the 255 version, not the 248 for the VPN route.
    – user62177541
    Dec 12, 2015 at 6:20
  • ... Also, let me try to pull out what you mean in point (1) myself. Would this be sufficient for the middle router: FastEthernet0/0 with an IP of 212.212.212.214/29, and now that interface is serving as gateway for static ip devices on that /29 subnet? Then similarly, FastEthernet0/1 with an IP of 222.222.222.214/29, and similarly there that IP address serves as gateway. Then routes...
    – user62177541
    Dec 12, 2015 at 6:30
  • The router emulating the the Internet only needs interfaces in both WAN subnets. Your site routers need routes to other router's WAN address with the next hop as the "ISP" port on the Internet router. The Internet router needs no routes defined since it is merely passive, and it knows how to reach both networks to which it is connected. It doesn't matter what size networks are connected to the Internet router. Any traffic sent to the ISP router for the other side will be sent to the other side, no routes on the Internet router needed.
    – Ron Maupin ♦
    Dec 12, 2015 at 6:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.