1

I have the following set up:

Ubiquiti USG router (WAN: DHCP client: 192.168.20.100/24 GW: 192.168.20.1)
Ubiquiti USG router (LAN: DHCP server: 192.168.1.1/24)
|
Cisco 3750 Switch Port on VLAN 1 (LAN: DHCP client: 192.168.1.100/24 GW: 192.168.1.1)
Cisco 3750 Switch Port on VLAN 2 (LAN: DHCP server: 172.27.71.1/24)
|
PC (LAN: DHCP client: 172.27.71.100/24 GW: 172.27.71.1)

Cisco 3750 Switch Port on VLAN 3 (LAN: DHCP server: 172.27.72.1/24)
|
Server (LAN: DHCP client: 172.27.72.100/24 GW: 172.27.72.1)

Now in order to get it working I configured IP routing and DHCP on the 3750. This allow the PC and server to communicate via the Cisco switch as it is their common gateway.

In order to get internet access to the Server, I added a static routes:

In the Ubiquiti USG: 172.27.0.0/16 via 192.168.1.100

But this didn't work! In order to get it to work I had to add another static route to the upstream router:

172.27.0.0/16 via 192.168.20.100

Now we are getting to the questions:

  1. If the Ubiquiti USG is NATing the outbound traffic, then why do I need to add a static route to the upstream router that includes the 172.27.2.0/24 subnet, isn't this out of context?

  2. The Ubiquiti USG performs bandwidth accounting, but it doesn't list the server or the phone in its client list, it only lists the Cisco switch. If the Cisco switch does not perform NAT then why is the traffic being attributed to the switch?

  3. What do I need to change in my setup to make the USG aware of the devices connected to the Cisco switch - while still allowing inter-Vlan communication to occur on the Cisco switch?

I know I could get it to work by defining all the VLANs on the USG and running a DHCP server for each and just running a trunk to the Cisco switch (i.e. router on a stick) but then all the inter-VLAN traffic between the vlans would have to go via the USG and that is significantly slower.

  • 2
    I actually have enterprise-grade equipment in my home, but any questions I may have about my home network would be off-topic here. – Ron Maupin May 14 '16 at 2:24
  • 1
    You can disagree, but the place to disagree is in Network Engineering Meta. – Ron Maupin May 14 '16 at 2:36
  • 2
    "business network" is debatable -- I won't, however. "professionally managed" it is clearly not. Your base question is one of the most basic concepts of networking: routing. You've added a subnet for which the rest of the network is unaware. – Ricky May 14 '16 at 7:00
  • 2
    And, as @RickyBeam pointed out, it is not a professionally managed network, and, by consensus, it is off-topic because it is behind a residential broadband gateway: meta.networkengineering.stackexchange.com/a/234/8499 – Ron Maupin May 16 '16 at 14:17
  • 1
    This does not sound "professionally managed" I am not trying to be demaning...but running static routes in enterprise environments is horrible for many reasons namely the first one that comes to mind being there is no redundancy if a route goes down......not to mention the high administrative cost of managing an environment like this. Look up floating static route and think about that in addition to a valid routing protocol, that would be my advice. – Ty Smith Sep 12 '16 at 7:50
1

To answer questions two and three (question one is for a home networking, consumer-grade device), DHCP for VLAN 2 is done on the switch, rather than the router, so the router doesn't know about them, either through DHCP or via layer-2. You could run DHCP for both VLANs on the router, then the router will know about devices on both VLANs, or you could run both VLANs on the router so that it can see all the devices via layer-2.

I know I could get it to work by defining all the VLANs on the USG and running a DHCP server for each and just running a trunk to the Cisco switch (i.e. router on a stick) but then all the inter-VLAN traffic between the vlans would have to go via the USG and that is significantly slower.

Why do you think that? it is probably slower by tens of microseconds, and you will probably be unable to see any difference or measure it.

Edit (based on the edited question):

Your router doesn't know how to get to the route defined on the switch unless you specifically configure it, or you run a routing protocol between the router and the switch. Your route doesn't know where to send the traffic destined for the 172.27.2.0/24 network, except to drop it or send it to a default route.

The the need for the static route on your friend's home-network, consumer-grade router is off-topic here.

  • Why do I think it is slower? Because I can connect my file server to the switch with 4x 1Gbps in an LACP trunk and then I can have 4 workstations pulling 1Gbps each off the server. If I have to route all that through a single 1Gbps link to the router then I'm limiting my throughput to 1Gbps and effectively going to half duplex. – James May 14 '16 at 5:28
  • As I wrote, you can put both VLANs on the switch. It is a very non-standard design to have one on the router, and one on the switch. Depending on the channeling algorithm you use, and the addresses/ports assigned to the hosts, you may not get the full bandwidth you think you get. It is possible that two hosts are assigned to each of two of the channeled links, or even all four on one of the links. – Ron Maupin May 14 '16 at 5:31
  • OK I have expressed my question more fully here: networkengineering.stackexchange.com/questions/30406/… – James May 14 '16 at 6:06
1

If the Ubiquiti USG is NATing the outbound traffic, then why do I need to add a static route to the upstream router that includes the 172.27.2.0/24 subnet, isn't this out of context?

I think you're 100% correct, and that the problem is not on the upstream router but on the USG. There is a big "If" at the start of your question; it sounds like the USG is not really doing NAT. Personally I don't know this specific product but it seems extremely likely that just adding a static route is not enough, i.e. it is not by default doing NAT for anything arriving on its "inside" interface, probably only for the directly connected subnet. So you will have to somehow tell it to do NAT for 172.27.0.0/16 as well.

Not the answer you're looking for? Browse other questions tagged or ask your own question.