1

We recently got a new AT&T ASE(MPLS) line to connect our datacenter with our main office. We have a WAN connection at our datacenter and a WAN connection at the office. I want to setup 2 gateways on the same subnet so that I can control the internal traffic headed to the internet. Eventually, I want to remove the WAN connection & gateway in the office and have all WAN traffic leave through the datacenter.

I think that this would work, but im being told it will not from some co-workers. I currently have a 192.168.10.x network in our office and the gateway is 192.168.10.1. I want to create another gateway at 192.168.10.2 and put it on the firewall in the datacenter. Then, I will connect the AT&T line from a switch in our office to that new gateways port on the datacenter firewall.

My plan was to set some systems to use 192.168.10.2 as their gateway so their connection would leave via the datacenter WAN. I could keep some people on the 192.168.10.1 gateway and they would get internet from our office line. This seems to make good sense so im not sure why im being told this won't work.

Considering all of the VLANs and tagged properly and the networks are healthy, is there any reason this would not work? We have a separate subnet for the datacenter so that is why I wanted to put the new gateway on the firewall so the different VLANs could talk to each other properly.

Thanks for letting me know if you think this plan is sour.

Improve this question
4
  • 1
    We really need a simple diagram to understand your setup better.
    – Ron Trunk
    Jan 3, 2018 at 21:24
  • 1
    It's generally not a good idea to span subnets between sites.
    – Ron Trunk
    Jan 3, 2018 at 21:26
  • Ill see if I can mark up a drawing for clarity. If the final plan is to remove our firewalls and routers in our office and have everything come from the datacenter (WAN/LAN), would it be wrong to keep the gateway for the office network on the datacenter router? So it would be 192.168.10.1 on the datacenter router and just some switches in our office that are connected via the ASE/MPLS. Thanks Ron
    – saleetzo
    Jan 4, 2018 at 1:03
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Feb 21, 2018 at 16:35

2 Answers 2

Reset to default
1

I don't think this

I want to create another gateway at 192.168.10.2 and put it on the firewall in the datacenter

is "possible" as it appears you are adding the office network to the data-center firewall - So then the datacentre firewall would send all traffic out that port This is the "not a good idea to span subnets between sites" statement that Ron mentioned.

However even with a new gateway located on a device in the office and connected to the new AT&T connection there is an issue of how the data-centre routing decides on which of the two links should be used to send traffic to the office network.
You may need to "move" each office device one at a time. For each move you would modifying routing at both ends of the link. This depends on the capabilities of your routers.

I think this is what you described enter image description here

Improve this answer
7
  • The idea was to do a bit of a soft transition and move away from the site-to-site VPN. I was thinking that I could have some of the systems use .2 as their gateway and some of the other ones use .1. Once I can verify that it works, I would eventually replace the .2 with .1 and have that be the main gateway for the office.
    – saleetzo
    Jan 4, 2018 at 0:49
  • So when you ad the 192.168.10.2 interface to the datacentre firewall all traffic destined for the 192.168.10.0/24 will exit via the 192.168.10.2 interface and no longer go into the site-to-site VPN tunnel - that is its not easy to transition bit by bit if you add an interface on the destination subnet
    – Ross
    Jan 4, 2018 at 2:16
  • You are correct on your drawing-well done. Eventually, the plan would be to remove the firewall and that VPN-over-WAN connection at the office and just have everything on the datacenter connections. Until then, I guess I could add routes on each device to handle both subnets/VLANs. If I got rid of the site-to-site VPN and its WAN, and only had the gateway on the datacenter firewall that connected to switches in the office--that still wouldn't be a good idea?
    – saleetzo
    Jan 4, 2018 at 18:24
  • The better idea is to keep them segregated and use routes to link the subnets? Is that what you're getting at? Thanks again for the information - - much appreciated.
    – saleetzo
    Jan 4, 2018 at 18:24
  • Yes routers between sites is what I was getting at - However getting rid of a router from a small office is a common objective. Conversely, I personally would not use a switched link as I like a routed link for between offices - as the routers ten can be used to make decisions, provide backup paths - however I've not had to implement anything on a ASE/MPLS connection so I am inexperienced in this and the features it offers may allow the removal of the routers with no loss in control.
    – Ross
    Jan 4, 2018 at 20:27
1

The best/simplest design over time is one where all of the end hosts in a given subnet have a single common default gateway. This single logical gateway might actually be constituted by multiple physical devices but from the point of view of any device on that subnet (workstation, server, printer, etc) it has a single path out.

The next point is that the device(s) hosting that gateway is/are the place(s) where choices between multiple outbound paths can be made. Put another way - let the router be the place where, well, routing happens. The other point that falls out of this is that in such a design there's really no reason to be bridging subnets between sites. Your router(s) can host multiple end-user subnets while also connecting to either your routers at other sites (..also hosting their own subnets) or to outbound connectivity.

Improve this answer
1
  • Thank you. The multiple gateway idea would only be for a short period so I could verify that everything was working over the ASE line. Once that was working properly, I would remove the firewall at the office and get rid of the VPN site-to-site. The final setup would be a single gateway at the datacenter firewall cluster and it would connect to some switches at our office down the road via the ASE/MPLS. That seems to make sense, or does it not? thank you!
    – saleetzo
    Jan 4, 2018 at 0:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.