1

I have design the following network diagram, but I cannot figure out if it could cause some issue on the network: enter image description here

Some detail about the infrastructure:

  • Network connect Ext rtr A, Int rtr B and C is 172.16.0.0/24 (is default gateway for this network)

    • Ext rtr A IP 172.16.0.1/24
      • Ext rtr A have route to 172.16.100.0/24 via 172.16.0.2/24
      • Ext rtr A have route to 172.16.200.0/24 via 172.16.0.3/24
    • Int rtr B IP 172.16.0.2/24
    • Int rtr C IP 172.16.0.3/24
  • Network in island B is 172.16.100.0/24

    • Ext rtr B in the island IP 172.16.100.1/24 (is the default gateway for this network)
      • Ext rtr B have route to 172.16.0.0/24 via 172.16.100.254/24
      • Ext rtr B have route to 172.16.200/24 via 172.16.100.254/24
    • Int rtr B in the island have IP 172.16.100.254/24
      • Int rtr B have route to 172.16.200.0/24 via 172.16.0.3/24
  • Network in island C is 172.16.200.0/24

    • Ext rtr B in the island IP 172.16.200.1/24 (is the default gateway for this network)
      • Ext rtr C have route to 172.16.0.0/24 via 172.16.100.254/24
      • Ext rtr C have route to 172.16.100/24 via 172.16.100.254/24
    • Int rtr C in the island have IP 172.16.100.254/24
      • Int rtr C have route to 172.16.100.0/24 via 172.16.0.2/24

The package on this network will follow this flow: First Scenario:

  • A server 172.16.0.50/24 open a connection to server 172.16.100.10/24:
    • Package have as his next hop the default gateway (172.16.0.1/24) once is reach this router, package get a redirect to the new next hop (172.16.0.2) to reach the correct network, after that will reach his destination on host 172.16.100.10. Answer to this package will start with next hop the default gateway (172.16.100.1) once is reach this router, package get redirect to his next hop to reach the correct network (172.16.100.254) after that will reach again the host 172.16.0.50

Second Scenario:

  • A server in network 172.16.100.60/24 open a connection to server 172.16.200.80/24:
    • Package have as his next hop the default gateway (172.16.100.1/24) once is reach this router, package get a redirect to the new next hop (172.16.100.254) here the package change again the next hop with the final router 172.16.0.3 and after that arrive to the destination at 172.16.200.80/24 Answer to this package will start with next hop to default gateway (172.16.200.1) once is reach this router get redirect to his next hop (172.16.200.254) to reach the correct network, once is arrive on the internal router his new next hope is 172.16.0.2 and after that rach again the destination

Now the question: The difference between the hops in the package sent and respond can cause any issues on the communication?

1

First Scenario:

A server 172.16.0.50/24 open a connection to server 172.16.100.10/24:

Package have as his next hop the default gateway (172.16.0.1/24) once is reach this router, package get a redirect to the new next hop (172.16.0.2) to reach the correct network, after that will reach his destination on host 172.16.100.10. Answer to this package will start with next hop the default gateway (172.16.100.1) once is reach this router, package get redirect to his next hop to reach the correct network (172.16.100.254) after that will reach again the host 172.16.0.50

I think your understanding here is flawed. A packet sent from 172.16.0.50/24 to the default gateway172.16.0.1/24 would not then be routed back to the same network from which it originated. It is possible that the router sends an ICMP redirect to the originating host (this is pretty much deprecated today for security reasons), but a router does not route from a network back to the same network. In reality, you would set up the routing table in the originating host to point to the correct router for the destination network. The default gateway is the last resort for any destinations for which the originating host does not know the router.

Second Scenario:

A server in network 172.16.100.60/24 open a connection to server 172.16.200.80/24: Package have as his next hop the default gateway (172.16.100.1/24) once is reach this router, package get a redirect to the new next hop (172.16.100.254) here the package change again the next hop with the final router 172.16.0.3 and after that arrive to the destination at 172.16.200.80/24 Answer to this package will start with next hop to default gateway (172.16.200.1) once is reach this router get redirect to his next hop (172.16.200.254) to reach the correct network, once is arrive on the internal router his new next hope is 172.16.0.2 and after that rach again the destination

Again, your hosts should have the correct router for the internal destination networks configured, and only use the default router as a last resort for unknown destinations.

3
  • so you suggest me to manage the route on the host instead use the router, it the diagram i put only two island, but there are many more, and some traffic have to pass trough "internal network" and other have to pass trough the external. Manage the route at the host level will be a big effort. – AtomiX84 Oct 2 '20 at 17:03
  • No, your routers need to have the correct routes, but your hosts should know the correct router to use for the internal networks. A default gateway is used as a last resort for unknown destinations. The problem with your scenario is that the routers will not route a packet back to the network on which it is sourced. The original ICMP redirect was created to solve that problem, and a router would send a redirect to the originating host. Most sites will no longer allow ICMP redirect because that poses a security risk, so you can configure the hosts to use the correct router for internal networks – Ron Maupin Oct 2 '20 at 17:08
  • Ok, I get it, I have to configure the host to point the *.254 router for the foreign network and in the *.254 router have the configuration for the next hop know the network I need to reach. | EDIT | One question, to get more easy manage the routing table on the host, could I set a route for 172.16.0.0/16 via 172.16.[1|2]00.254, or it could cause a loop routing? the scope link on the interface will "win" against a route like that? – AtomiX84 Oct 2 '20 at 17:16
0

No. The number of hops makes no difference as long as the TTL doesn't expire. The number of router hops is invisible to the end hosts.

Here's some other observations:

  • I think you have a typo under Network C: I think you meant to say Int-C and Ext-C.
  • You didn't describe the lower connection between Ext-A and Int-B and Int-C.
  • I assume you intend to configure static routing on these devices. A routing protocol would make things much easier and give you some redundancy. As you describe it, a link failure will cause things to break, even though you have redundant connections.
  • Ideally, Int-b and Ext-b would use a FHRP, like VRRP or HSRP. Same for Int-C and Ext-C
2
  • Yes, that is a typo (damn ctrl+c&ctrl+v). Yes, I describe it the network is 172.16.0.0/24 all that router are directly connected to this network, some useful infos are missing? Yes, static routing is my only option here (I missing one information) it is a OpenStack environment, the router is created in IP namespace of the kernel, router IPs are in HA managed by the network controller of OpenStack. Ext rtr is configured to do NAT only and Int rtr are pure routing. – AtomiX84 Oct 2 '20 at 17:11
  • You can't have the same network 172.21.0.0 on both interfaces on Ext-A. – Ron Trunk Oct 2 '20 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.