0

We are transitioning to new WAN connectivity. I have one VLAN (let's say ID 10). Currently there is one router R1 that has one private subnet and one public subnet on the VLAN 10 which goes through the network to different endpoints. Can I insert another router R2 into the network have the VLAN 10 joint it and move only the private subnet to the new route R2. So that now the R1 will route the public subnet and R2 will route the private subnet? Of course disabling the private's subnet gateway IP and R1.

Will it work? Or is there going to be a collision/problem with two routers sharing the same L2 VLAN albeit routing different subnets? I am not sure how it will behave. It's only a temporary solution until I am able to route the public subnet on R2 too.

Essentially I want to share the same one L2 VLAN with two L3 routers each of which will route one different subnet which were originally routed by one router.

Current State: Current State

Transitional State: Transitional State

End State: End State

EDIT: Included the pictures to better explain what I want to achieve

2
  • Where do you NAT private vs public? Is the handover an ISP router port? Please add the respective IP addresses & VLAN IDs to the router interfaces instead of to the routers themselves. Also it might help to add a diagram "now" to your "planned".
    – Zac67
    Jan 7 at 7:55
  • I will try to insert the now and planned images.
    – mitch
    Jan 7 at 8:41

2 Answers 2

0

The problem is your handover subnet 77.5.6.20/30. It only allows two routers to attach (.21 and .22) - the ISP one and yours. No way to attach a third router.

Of course, you could attach R2 behind R1 within the 88.10.1.0/27 subnet. R1 would then route transparently and only R2 would NAT your private subnet(s).

As a side note, you really shouldn't run a public and a private subnet within a single VLAN - securitywise that's suboptimal, mildly put. Instead, you should separate the VLANs and consider a decent DMZ concept (an additional firewall between the public and the private VLANs with (next to) no connectivity from public to private). As it is, a comprimised public host could directly attack private nodes which are likely less protected.

0

No, this wont work sadly. A router sits between networks and routes traffic between the networks. All you appear to be doing is creating two default gateways for subnets and configuring them on different routers. Because everything is using the same vlan 10 there is not way for the two routers to communicate with each other.

If a PC with IP 172.18.10.55 wants to get to google (8.8.8.8) it will send its packet to its default gateway 172.18.10.1 (R2). But from then on R2 has no way to get to R1. The route from R2 to R1, technically, would be back down into the 172.18.10.0/24 network to a host with an IP address that is outside of that subnet. That doesnt work.

If you are unable to route traffic at the moment using R2 then it isnt functioning as a router and you need to wait until you can route before adding it to your network.

5
  • I am able to get to the internet using R2 it has connectivity via public IP from the connectivity supplier, but I cannot move the public subnet to R2 right now because it's routed to R1 via it's public interface IP and I don't have controll over it as of now. That's why I first wanted to move the private subnets to R2 and route them to the internet via the new WAN on R2 and then when I am able to route the public subnet via R2 move the public subnet from R1 to R2 also. I need to reduce traffic to R1 ASAP and the private subnets make the majority of the traffic.
    – mitch
    Jan 7 at 8:41
  • I added pictures to better explain what I want to achieve
    – mitch
    Jan 7 at 9:09
  • Do you have the config for R1 at least? In particular interface ge0/2. Jan 7 at 9:30
  • There is nothing speacial really. VLAN 10 sits firectly on the ge0/2 interface and the gateways 88.10.1.1/27 and 172.18.10.1/24 sits on the VLAN 10 interface. In firewall 172.18.10.0/24 is NATted behind 77.5.6.20.
    – mitch
    Jan 7 at 9:47
  • Can you still share that config (removing any sensitive/personal info), either as a screenshot or just the text. Jan 7 at 10:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.