3

I want to share a FO/Internet connection among three separate small offices.

Internet provider modem/router has LAN 192.168.1.0/24, with its gateway at 192.168.1.1 and serving IPs (192.168.1.100-200) via DHCP to all its LAN PORTS.

|CPE INTERNET PROVIDER|----- 192.168.1.1

I would like to serve the following separate subnetworks:

NETWORK 2 ETH ----- 192.168.2.0/24 (DHCP RANGE 192.168.2.100-192.168.2.200)

NETWORK 3 ETH ----- 192.168.3.0/24 (DHCP RANGE 192.168.3.100-192.168.3.200)

NETWORK 4 ETH ----- 192.168.4.0/24 (DHCP RANGE 192.168.4.100-192.168.4.200)

I am thinking in the following setup, with either a Ubiquity EdgeRouter or a SMB Cisco:

 __________________________________________
|         CPE INTERNET PROVIDER            |
|               192.168.1.1                |
|                   /16                    |    
|__________________________________________|
                     .
                     .
                     .
 __________________________________________
|               192.168.1.2                |
|                   /16                    |
|                WAN PORT1                 |
|                                          |
|               CISCO OR UBIQUITI          |
|                                          |
| LAN PORT2      LAN PORT3     LAN PORT4   |
| 192.168.2.1    192.168.3.1   192.168.4.1 |
|     /24            /24           /24     |
|   (VLAN2)        (VLAN3)       (VLAN4)   |
|__________________________________________|
     .               .              .
     .               .              .
     .               .              .
     .               .              .
SUBNETWORK2     SUBNETWORK3    SUBNETWORK4
  1. configuring the Internet CPE modem/router LAN to 192.168.1.0/16.
  2. disable DHCP in that CPE.
  3. attach a Cisco SMB RV325 or a Ubiquiti EdgeRouter, with:

    a) its WAN interface configured to 192.168.1.2/16
    b) VLAN2 configured in LAN Port 2 with network 192.168.2.0/24
    c) VLAN3 configured in LAN Port 3 with network 192.168.3.0/24
    d) VLAN4 configured in LAN Port 4 with network 192.168.4.0/24
    e) DHCP Pool configured in LAN Port 2 with IP Range 192.168.2.100-192.168.2.200
    f) DHCP Pool configured in LAN Port 3 with IP Range 192.168.3.100-192.168.3.200
    g) DHCP Pool configured in LAN Port 4 with IP Range 192.168.4.100-192.168.4.200

LAN ETH ports 2,3,4 would serve via ethernet cables the small offices, where a regular switch at the ends would allow connect all devices.

My doubts are:

  1. does this setup make sense?
  2. Do CISCO SMB RV325 or Ubiquiti EdgePro allow to configure separate DHCP pools per VLAN/PORT?
  3. How do I ensure that VLANs/subnetworks are not reachable between them?

Thanks,

  • Your setup looks good to me. – user36472 Sep 12 '17 at 5:49
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 18:31
3

1 - the setup make sense, but there's one potential issue: The ISP provided CPE may not NAT networks others than 192.168.1.0/24 to the Public IP address. I.E. it will not perform NAT for the 3 subnetworks. If this is the case, you may have to NAT those 3 networks with IP from the 192.168.1.0/24 network.

(btw there's a discrepancy between the text Internet provider modem/router has LAN 192.168.1.0/24 and the schema where it is noted as /16, I assume the correct one is /24 as it is the most common case)

2 - For DHCP

  • Cisco SMB RV325
    It is not clear from this user manual that you can configure separate DHCP pools, but there's 90% chance it is the case.

    In the CLI reference guide it is not explicit either but the syntax use seems to imply it is possible.

interface vlan modify 25 dhcp 192.168.22.2~192.168.22.150 dns static 11.11.11.11 11.11.11.22 wins 33.33.33.33 option66 tftp.server.org option150 44.44.44.4 option67 file.txt

In the worst case, it supports DHCP relay so you can relay DHCP requests from all VLAN to an external DHCP server

  • Ubiquity Edge pro
    I'm not familiar with EdgeOs but it's based on Vyatta, which I used a lot, and it is possible without a doubt.

3 - To ensure that VLAN can not communicate together, you have to configure ACL (Cisco) or Firewall Rules (Ubiquity).

The SMB RV325 support 50 ACL rules, while the Ubiquity should not have limitation (other than memory) and you can either use interface based firewall or zone based firewall.

  • CPEs are normally configured with /24, but my plan is to reconfigure CPE LAN for /16, so three /24 subnetworks would be routed – M.E. Sep 13 '17 at 4:41
  • Doing this would overlap network. I.E you will have 1 subnet on an interface and 3 networks that are subnets of the first one on other interfaces. This is not recommended, and a Cisco device will not allow it (Vyatta allow it so maybe EdgeOs allow it too, not sure). You need first to check if the CPE can NAT different networks, if yes no need to go to a weird config. – JFL Sep 13 '17 at 6:11
  • Ho also you need to check if you can add routes to the subnets on the CPE. – JFL Sep 13 '17 at 6:31
2

does this setup make sense?

I see no problem with the basic premise, as long as you meant 192.168.1.0/24 and not 192.168.1.0/16 for the "middle" network (unless you are planning to utilize proxy ARP - bad idea). Also assuming you are planning on performing NAT on the Cisco/EdgeRouter (or else you will need either dynamic routing such as OSPF or static routes on the CPE device).

A few suggestions, with the setup you describe you could configure a second EdgeRouter to provide redundancy (not sure if the Cisco platform is capable of this). With both devices connected to the CPE device, you would simply need to run VRRP on the internal LAN interfaces. This is more complex, but you can take a failure of one device without any of the offices being adversely affected.

If you don't go with a redundant setup (or if you have multiple WAN IP addresses from your provider) and if the CPE device can be configured to do so, then you could operate it in a bridge/bypass mode so the Cisco/EdgeRouer handles all the outside traffic directly. Eliminates a L3 network that isn't needed, avoids a double NAT situation on your side and gives you more control overall on your gateway device.

Finally, if you have the interface available, set up a fourth LAN network that you can plug into directly if needed, especially if you are not one of the three office tenants. That way you won't have to connect to one of the office networks (which they may object to) anytime you need to do maintenance.

Do CISCO SMB RV325 or Ubiquiti EdgePro allow to configure separate DHCP pools per VLAN/PORT?

Yes, I believe they both do; although I have never used that particular Cisco product, that is a relatively basic feature for this level of device.

Note: the Cisco RV325 is End of Sale as I type this. You should instead be looking at the RV345 which is the replacement for the RV325.

How do I ensure that VLANs/subnetworks are not reachable between them?

Specifics depend on chosen vendor/product, but the basic premise would be through the use of ACLs and/or firewall features. While there may also be means of simply not routing any traffic from one VLAN to another on the Cisco/EdgeRouter, depending on how the CPE device plays in the mix it may allow traffic to get "redirected" back into a different VLAN.

  • About the end of sales, this notice list only the RV325-K9-AR I.E. the Argentina model as E.O.S. Regarding VRRP, very good advice, but for the CISCO both the CLI reference guide and the use manual don't contain the word "vrrp" nor "hsrp" so it seems it's not supported. (see my answer for the links to the manuals) – JFL Sep 12 '17 at 7:00
  • @JFL, true, I didn't catch that it was only the Argentina model. However, this is still a likely indication it is on the tail end of it's life as a platform even for other models (along with the platform release date in 2013) and it would be better to look at the RV345. – YLearn Sep 12 '17 at 7:14
  • I have find in the past that internet provider's CPEs would not route to LAN other than the LAN subnetwork. So CPEs LAN must be /16. – M.E. Sep 13 '17 at 4:43
  • @M.E., then the only way this would work is if you are doing proxy ARP on the Cisco/EdgeRouter and proxy ARP is not a good solution. Rather you should look at setting the CPE device in bridge mode and allow your router to handle all the traffic. – YLearn Sep 13 '17 at 4:47
  • Why is proxy ARP needed? – M.E. Sep 13 '17 at 4:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.