1

Real beginner here, struggling with my first real life network problem, existing kit, and almost no budget.

Two departments, which have to remain private from each other, are to be linked to main office, where the firewall routers and Internet connections are located by wireless bridge. The bridge is connected to one port in firewall router which defines the subnet and gateway.

Unfortunately, the bridge comprises a pair of EOC 8610+ 5GHz Wi-Fi devices which are working well, but cannot (at least for me) transmit DHCP across the bridge.

My plan is to set up three subnets and VLANs on a managed switch on the remote side of the bridge (Netgear M4100 GSM5212), e.g. .128, .160, .192 /27, each being part of the parent network defined at the firewall (.128/25) on my side of bridge. At present none of the devices with the managed switch are VLAN aware.

I plan to use the managed switch as a DHCP server, with ACLs to maintain security.

My questions:

  • Is this a credible plan?
  • Is there an easier way?
  • How do I set the default routes for the sub-sub nets when default route is first IP address of main subnet and therefore not in two of the three subnets.

Please forgive my ignorance, but need help here.

  • Hi Ron, thanks for the edits which I have just noticed. Much clearer and better but still not a solution for my circumstances. – Budgie Oct 17 '17 at 17:17
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 19:41
2

It sounds like you simply need to configure the switch as a DHCP relay. You can then manage DHCP for all the networks on the central DHCP server, and configure the gateway for each DHCP scope separately. The gateway for each network will be the address of the router for that network, probably the address you have defined for the VLAN in the layer-3 switch.

You do not set a default route for the individual networks, you set it for the router (layer-3 switch, in this case). This is the route that the router uses for any destination networks for which is has no other path. It will inherently have paths to any directly connected network, and it can get paths for other networks by using statically defined routes or routing protocols. The default route is simply a statically defined route that is used as a last resort because any other router in the routing table will have a longer match.

You probably want a routed link (/30) for the network from the layer-3 switch to the firewall. You will need to somehow let the firewall know about the networks on the other side of the layer-3 switch, either by statically defined routes, or with a routing protocol.

Alternatively, you will need to create individual (virtual) network interfaces on the firewall, which will need to support 802.1Q VLANs.

  • Hi Ron and many thanks for the reply. I am constrained by existing kit. There is only the one port available on the firewall and I cannot set up more than one subnet and dhcp server on it. Also as I stated I cannot get dhcp to work over the bridge. I believe your alternative is the only way I can go, hence my question. I believe the M4100-D12G has 802.1Q Vlan support. – Budgie Oct 17 '17 at 17:12
  • The switch is a layer-3 switch, and you simply need to use it to route the networks on your LAN. Are you sure the firewall cannot create virtual interfaces for 802.1Q VLANs? Many can, but some can't. A DHCP relay can work across your bridge because it uses IP to send and receive information, instead of the normal DHCP broadcast at layer-2. In any case, it is usually a best practice to route the LANs on your layer-3 switch. – Ron Maupin Oct 17 '17 at 17:16
  • OK, the firewall (Firebrick 105) is no longer supported but I can give port a VLAN ID and it does have VRRP settings but I am well outside my knowledge now. Do you have time to please help me with the switch configuration and is that appropriate here? – Budgie Oct 17 '17 at 17:25
  • I'm not familiar with that switch model or firewall, so I can't give you configuration specifics. I can tell you how networking works, and how you need to set up the network. I would create a routed link between the firewall and the layer-3 switch. put in static routes on the firewall to the three networks on the layer-3 switch, and do the network routing on the layer-3 switch. It is a simple, proven solution. – Ron Maupin Oct 17 '17 at 17:30
  • Many thanks for the guidance. My problem, (other than ignorance) is the routing. I have my three VLAN subnets and each has DHCP working from the switch. What I cannot sort out is routing within the switch and from the firewall to the switch. BTW is it OK to continue with these comments on this site? Many thanks once more for your help. – Budgie Oct 19 '17 at 9:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.