3

Networking community, I have hit a snag and was hoping for advice or suggestions:

enter image description here

I am having trouble getting Router 2 to transmit traffic between the Firewall WAN port (internet) and Router 1 and vice versa and am not sure what to do.

The Firewall (pfSense) is configured on the LAN side with 3 x VLAN's. (VLAN11, VLAN12, VLAN13). I have configured Switch1 with the appropriate Trunk/Access ports to allow for all devices to communicate with each other and the WAN (Internet access).

  • The VLAN addressing scheme from pfSense is: 192.168.11.X (VLAN11), 12.X (VLAN12), etc, etc.
  • Router 1: is configured as a DHCP server for all devices attached to G0/1
  • NAT is enabled and configured
  • OSPF is configured and enabled (For learning purposes)

The following are various configurations I have attempted, I feel I am very close, but am missing one small thing:

Config 1: Router 2: with manual G0/1 configuration

Router 2: G0/1: ip = 192.168.13.30 255.255.255.0

  • Router 2 has all of the information in its routing table from Router 1
  • Router 1 has all of the information in its routing table from Router 2
  • Router 2 CAN ping everything behind Router 1 (off G0/1)
  • Router 2 CAN ping server 1 & 2 (which reside on VLAN13)
  • Router 2 cannot ping the WAN address on pfSense
  • Router 1 cannot ping the servers which reside on VLAN 13 or pfSense WAN address

Configuration excerpt from Config_1

ROUTER 2: Configuration excerpt:

interface GigabitEthernet0/0
 description PrimaryWANDesc_
 ip address 192.168.200.5 255.255.255.252
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 ip address 192.168.13.15 255.255.255.0
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
router ospf 10
 network 192.168.13.0 0.0.0.255 area 0
 network 192.168.200.4 0.0.0.3 area 0
 default-information originate
!
ip forward-protocol nd
!
ip http server
no ip http secure-server
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
!
!
!
access-list 1 permit 192.168.0.0 0.0.0.255

ROUTER 1: Configuration excerpt:

interface GigabitEthernet0/0
ip address 192.168.200.6 255.255.255.252
ip address 192.168.200.6 255.255.255.252
ip nat outside
ip virtual-reassembly in

duplex auto
speed auto

!
interface GigabitEthernet0/1
ip address 192.168.2.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
router ospf 10
network 192.168.200.4 0.0.0.3 area 0
network 192.168.2.0 0.0.0.255 area 0
default-information originate
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip nat inside source list 1 interface GigabitEthernet0/0 overload
!
!         
!         
access-list 1 permit 192.168.0.0 0.0.0.255

Config 2: I have also recently tried the following to no avail: On Router 2, G0/1: "ip address dhcp" (Allowing pfSense to dynamically assign IP) - Router 2 has all of the information in its routing table from Router 1 - Router 1 has all of the information in its routing table from Router 2 - Router 2 CAN ping server 1 & 2 (which reside on VLAN13) - Router 2 CAN ping the WAN address on pfSense - Router 2 CAN ping everything behind Router 1 (off G0/1) - Router 1 cannot ping the servers which reside on VLAN 13 - Router 1 cannot ping the WAN address on pfSense - pfSense cannot ping Router2 eth0/0 ip address

Currently trying: going back and configuring the port on the switch that Router2, G0/1 is attached to, to 'Trunk' mode. Then I am going to manually reconfigure the G0/1 port again on the router..

Thank you again for any assistance or advice. Please let me know if I can provide any further details to aid.

Update: After removing NAT and OSPF 'default-information originate'

Router2 Configuration

interface Loopback0
 ip address 192.168.31.254 255.255.255.0
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 description PrimaryWANDesc_
 ip address 192.168.200.5 255.255.255.252
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 ip address 192.168.13.15 255.255.255.0
 ip address dhcp
 duplex auto
 speed auto
!
router ospf 10
 network 192.168.13.0 0.0.0.255 area 0
 network 192.168.200.4 0.0.0.3 area 0
!
ip forward-protocol nd
!
ip http server
no ip http secure-server

Router1: Configuration

interface Loopback0
 ip address 192.168.225.254 255.255.255.0
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 ip address 192.168.200.6 255.255.255.252
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 ip address 192.168.2.254 255.255.255.0
 ip virtual-reassembly in
 duplex auto
 speed auto
!
router ospf 10
 network 192.168.200.4 0.0.0.3 area 0
 network 192.168.2.0 0.0.0.255 area 0
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server

Updated

Router2

interface GigabitEthernet0/0
 description PrimaryWANDesc_
 ip address 192.168.200.5 255.255.255.252
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 ip address dhcp
 duplex auto
 speed auto
!
router ospf 10
 network 150.10.93.0 0.0.0.255 area 0
 network 192.168.30.0 0.0.0.255 area 0
 network 192.168.200.4 0.0.0.3 area 0
 default-information originate
!
ip forward-protocol nd
!
ip http server
no ip http secure-server
!
ip default-network 192.168.13.0
ip route 192.168.13.0 255.255.255.0 152.14.93.152 110

Firewall packet capture info

Ping sent from Router1 and Router2 to firewall WAN:

18:15:26.000811 IP 192.168.200.6 > 150.10.93.152: ICMP echo request, id 117, seq 0, length 80
18:15:27.998919 IP 192.168.200.6 > 150.10.93.152: ICMP echo request, id 117, seq 1, length 80
18:15:29.998894 IP 192.168.200.6 > 150.10.93.152: ICMP echo request, id 117, seq 2, length 80
18:15:31.998897 IP 192.168.200.6 > 150.10.93.152: ICMP echo request, id 117, seq 3, length 80
18:15:33.998902 IP 192.168.200.6 > 150.10.93.152: ICMP echo request, id 117, seq 4, length 80
18:15:37.506098 IP 192.168.13.115 > 150.10.93.152: ICMP echo request, id 143, seq 0, length 80
18:15:37.506118 IP 150.10.93.152 > 192.168.13.115: ICMP echo reply, id 143, seq 0, length 80
18:15:37.506597 IP 192.168.13.115 > 150.10.93.152: ICMP echo request, id 143, seq 1, length 80
18:15:37.506602 IP 150.10.93.152 > 192.168.13.115: ICMP echo reply, id 143, seq 1, length 80
18:15:37.506971 IP 192.168.13.115 > 150.10.93.152: ICMP echo request, id 143, seq 2, length 80
18:15:37.506976 IP 150.10.93.152 > 192.168.13.115: ICMP echo reply, id 143, seq 2, length 80

Router 2

  • Router2 eth0/1 now receives an statically assigned address from the firewall

  • Default Route configured to VLAN13 Address (192.168.13.1)

    interface GigabitEthernet0/1 ip address dhcp duplex auto speed auto

    router ospf 10 network 150.10.93.0 0.0.0.255 area 0 network 192.168.13.0 0.0.0.255 area 0 network 192.168.200.4 0.0.0.3 area 0 default-information originate ! ip forward-protocol nd ! ip http server no ip http secure-server ! ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 192.168.13.1 110

pfSense configuration

  • VLAN 13 has DHCP disabled
  • Server1, Server2, and Router2 are mapped via their MAC address to a statically assigned IP address: (E.g. Router2: 192.168.13.115)
  • NAT is configured for Router2: with If (upstream) | Protocol (TCP) | Scr. address: * (any) | Src. Ports: * | Dest. address * | Dest. ports (other) | NAT IP 192.168.13.115 | NAT Port (Http)
Improve this question
4
  • Why are you using NAT between the routers? Are you also using NAT on the firewall? I don't see where you have any VLANs configured on the routers.
    – Ron Maupin ♦
    Feb 20, 2016 at 23:22
  • You should edit your question to include your comments, and you should provide a drawing.
    – Ron Maupin ♦
    Feb 20, 2016 at 23:24
  • Srry, the image was initially causing the question to be tossed back as 'spam'. Additionally, I do not want to use or have any VLAN's on the routers themselves.
    – dynamicruss
    Feb 20, 2016 at 23:43
  • Using NAT on links which have routing protocols running on them is a really bad idea since NAT is a one-way translation. You will not be able to originate traffic (like ping) from the outside. NAT is properly blocking Router 1 from originating traffic to anything on the inside of Router 2.
    – Ron Maupin ♦
    Feb 20, 2016 at 23:46

1 Answer 1

Reset to default
0

Since Router 1 is on an outside interface of Router 2, it will not be able to originate traffic to the inside of Router 2. You have configured inside source NAT on Router 2, and this is one-way. Addresses are translated from the inside to the outside. When traffic is originated from the inside, NAT creates a table entry in order for responding traffic to be translated, but it has no table entry for traffic originated from the outside.

Running NAT on links where you are running a routing protocol is a very bad idea.

Edit based on your updated information:

If you need or want the firewall to know about the routes on the other side of Router 2, you will need to somehow get the routes into the firewall's routing table, otherwise any traffic for the unknown networks will be sent toward the default route for the firewall, and that should be the WAN.

A router, including the routing process of your firewall, needs to have a route in its routing table for any network to which it is expected to forward traffic. A default route can be used to encompass all networks, and any more specific routes in the routing table are used. Since your firewall's routing table has no routes to the networks on the other side of Router 2, it will use its default route.

You can configure your firewall to participate in OSPF with your two routers, and that will place those routes in the firewall's routing table. It will also let you originate the default route into OSPF from the firewall, and then you should remove that from the other routers.

The other, less desirable, solution is to manually configure static routes in your firewall for the networks to which it has no direct connection. This doesn't scale, and when you add, remove, or change those networks, you will need to manually change the static routes in the firewall.

Improve this answer
9
  • Ron, thank you. I have done as you suggested and completely removed NAT from the equation. However I still am not able to successfully ping the firewall from Router1, nor is the firewall able to ping eth0/0 on Router2. Router1 can ping eth1 on Router 2 @ 192.168.13.15, but it cannot ping either of the servers which are 192.168.13.108, & 109.
    – dynamicruss
    Feb 21, 2016 at 19:43
  • You also don't need or want the default-information originate command on every router. That should come from the firewall where you want the default route to go out to the Internet, or you have a default route in Router 2 pointing to the firewall and originate the default route in Router 2 only. You should edit your question to include all the current configurations from each router.
    – Ron Maupin ♦
    Feb 21, 2016 at 19:53
  • Does the firewall participate in OSPF to send the default route? If not you need to place a default route toward the firewall in router 2 and use the default-information originate command into OSPF. Not having a default route at all will prevent you from getting outside the routes in your routing table. Also, the firewall itself may have a configuration to prevent pings. Can you ping the the firewall's VLAN IP address from either router, or the servers? Can you ping the WAN address from the servers?
    – Ron Maupin ♦
    Feb 21, 2016 at 20:46
  • Ron, I have updated the code. I am currently in the process of setting the default route in router 2 to that of the firewall to see if that helps.
    – dynamicruss
    Feb 21, 2016 at 20:59
  • Yes, the firewall is configured to allow 'ping' requests. I can ping VLAN 13 from Router2 (not VLAN12, 11 as I have prevented traffic from VLAN 13 to access the other VLANs. I can ping the firewall LAN and WAN IP from Router2. Router2 can also ping the servers. Router1, cannot ping the servers or the firewall. However, R1 can ping the eth0/1 address of R2.
    – dynamicruss
    Feb 21, 2016 at 21:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.