Using an ASE(MPLS) line to route datacenter WAN traffic to office

Question

im trying to route the Internet from our Datacenter to our Office over an AT&T ASE line (similar to an MPLS). At first I was going to just add the office subnets to the router in the datacenter and link the 2 sites that way. However, after talking to some of ya'll, I ended up linking them using a shared subnet that is on the ASE/MPLS network.

Everything is working properly for all of the Internal subnets but im not sure how to get the Internet to route through the connection as well. My end goal is to remove the WAN connection from our office and use the WAN from the datacenter via the ASE/MPLS.

Please take a look at the diagram I have attached of the setup so you can better understand what im talking about.

The datacenter network is 192.168.1.0/24, the office network is 172.10.10.0/24, and the network used to link the sites is 10.10.10.0/24. There are more VLANs and networks, but if I can make it work on these I should be OK on the other ones. The switches that im using are Dell PowerConnects that can only do Layer2, so the Checkpoint 4400s that im using are handling the routes and are connected to the ASE line. There are 2 Checkpoints in the datacenter that are setup as a Cluster, with a VIP IP of 10.10.10.1.

I have some routes on each side to handle the internal traffic. i.e. ip route 172.10.10.0/24 10.10.10.5 and another one on the other side as ip route 192.168.1.0/24 10.10.10.1. There are handling the Internals perfectly.

To share the internet through this connection, I was considering changing the default gateway on my Office Checkpoint from the WAN IP of our Office WAN to the interface on the other side of the ASE 10.10.10.1. I would then create a NO_NAT rule for the internal subnets and then a regular NAT rule for the traffic to go out the WAN IP at the datacenter.

Is this an OK way of doing this? Currently, at the office, the default route on the checkpoint is pointed to the WAN connection at the office. I figured changing the default route would allow anything outside of the 172.10.10.0 subnet to hit the other side 10.10.10.1 and go from there.

Any help would be appreciated! Let me know if you think there is an error in my ways. Thanks!

Answer 1

It is actually pretty simple. Only advertise the default route into your network from the router connected to the Internet. Any traffic destined to a network, not otherwise in the routing tables, will then be sent to your Internet router. Perform NAT on that router for traffic leaving your network. You don't need NO_NAT rules because you only NAT on the Internet router for traffic destined to the Internet.