0

I have a lot of IT experience/consulting, but want to test what I have done against some of the real experts hre in the networking field so I can keep learning and do what's best.

I have ISPs with 5 usable static IPs assigned. To split them so I can use separate IPs for particular usage scenarios, I have simply plugged in a small Netgear managed switch from the ISP modem, made sure the ports are running duplex and as high as they can go, and then from the Netgear plugged in and configured my main SonicWall with one IP, another two routers for some other work, etc.

Is this the proper/best performance way of splitting up the IPs? I ask because this method appears to work OK, but for a Gateway to Gateway VPN I have setup (one office has 100Mbs fiber up/down, and the other side is 50MBs up/down), I have found the performance a little underwhelming even for simple file copies between sites (can get no more then 10MBs, and then it seems to saturate the bandwidth, or CPU power of the router, dunno...). I am worried there is something asymmetrical in this approach. The routers for the VPN are Cisco RV042G and Cisco RV320, which frankly, am not sure are great routers to start with. I've assured by both ISPs there are is no throttling going on.

Hopefully this makes sense. Any constructive thoughts would be appreciated. many thanks

D

| improve this question | |
  • 1
    Without seeing the Netgear configuration, it's impossible to say for sure. The problem may be in the performance of your Netgear router. Just because it has 100M or gigabit ports, doesn't mean it can forward traffic at that rate. – Ron Trunk Mar 9 at 18:04
  • Thx Ron. You raise a good thought there. I don;t know how to add screen shot, but the switch is a Netgear GS108T 8 port. all ports are set to Auto as it seems to be best fit what ISP port is giving us, showing 1Gb Full Duplex. Is there something I should check? – D Consults Mar 9 at 18:25
  • Auto is probably the best setting. I don't know if there are operational parameters on that switch to check. But I wouldn't expect a $75 switch to work as well as a $1000 switch. – Ron Trunk Mar 9 at 18:46
0

There are two basic options:

  1. You use a switch to connect all your devices directly to your ISP router/handover port. If you use a managed switch, make sure you secured everything: remove management/IP interface from the (WAN) VLAN, disable CDP, LLDP, MSTP/RSTP/RPVST and all other functions that could be used to compromise or disturb your network. Use ACLs on the switch to create a (very basic) firewall.
  2. Map virtual IPs on the Sonicwall to DMZ (private) IP addresses (or only TCP/UDP ports). Make sure the Sonicwall responds to ARP on those IP addresses, so the ISP router can forward appropriately. Set up firewall policies to allow the connections you require. I'd seriously recommend this option for any device that is not Internet-hardened.

These options can also be combined, so you could connect a VPN gateway directly to the switch/VLAN and map other IPs to servers/services through the Sonicwall.

PS:

made sure the ports are running duplex and as high as they can go

Do NOT manually configure Ethernet ports EVER unless you can configure them identically on both sides (and there's a need to in the first place). Especially configuring one side for manual full-duplex deactivates Autonegotiation which a) disables Gigabit Ethernet completely (where Autoneg is mandatory) and b) causes the other side to fall back to half duplex (legacy mode). This in turn creates a nasty duplex mismatch which causes very poor performance.

| improve this answer | |
  • Thx for the feedback. Just to clarify: From the ISP modem, connects to the Netgear 8 port switch. This splits up the WAN IP's to a SonicWall router for the on premise local network, firewall, etc, then to a Cisco router for the Gateway VPN, and then another router for email relays. Yes, it may not be efficient, but for now that's what I have. – D Consults Mar 10 at 14:29
  • If 'another router for email relays' is behind the SonicWall you need to use virtual IPs and port forwarding/DNAT. You should consider setting up a WAN VLAN that you can distribute through your core network. – Zac67 Mar 10 at 14:39
  • My bad. It is not behind the SonicWall. Each router is getting an individual connection from the Netgear, thus each get an ISP IP address separately. But I do understand what you mean. thx – D Consults Mar 10 at 14:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.