0

Here is the scenario. Currently there is a flat layer 2 network with a single /24 subnet. The intent is to segment that /24 using a layer 3 switch. On the /24 network there exists clients with differing default gateways. There are multiple exit points from the /24 network. If the layer 3 switch is implemented using multiple routing interfaces to join the newly segmented network, is it possible to assign different default gateways to the individual routing addresses to accomplish having multiple exists from the network as a whole onto the WAN? Is there a hard limitation that the switch performing the layer 3 routing can only have one default gateway? Example details below.

Current Example network

  • network 192.168.1.0/24
  • edge router 1: 192.168.1.1
  • edge router 2: 192.168.1.2
  • Client A: 192.168.1.101, GW 192.168.1.1
  • Client B: 192.168.1.102, GW 192.168.1.2

Example Target network

  • network 1: 192.168.100.0/24
  • edge router 1: 192.168.100.1
  • edge router 2: 192.168.100.2

layer 3 swtich

  • routing inf 1: 192.168.100.3
  • routing inf 2: 192.168.200.3
  • routing inf 3: 192.168.300.3
  • default GW: 192.168.100.1

Network 2: 192.168.200.0/24

  • Client A: 192.168.200.1, GW 192.168.200.3

Network 3: 192.168.300.0/24

  • Client B: 192.168.300.1, GW 192.168.300.3

In this example the hardware used for as the layer 3 switch would be a Netgear M4300

Can the desired outcome of having Client A and B exit the network on the originally specified edge routers be achieved?

Improve this question
1
  • Has any answer solved your question? Then please accept it or your question will keep popping up here forever. Please also consider voting for useful answers.
    – Zac67 ♦
    Jun 13 at 6:41

2 Answers 2

Reset to default
0

Is it possible to assign a default gateway per routing interface on a layer 3 switch?

If I understand your question correctly, you'd like to point the L3 switch's default route to an edge router, and the edge router's to WAN? That's a common configuration for a core switch and your WAN firewall, certainly possible.

A router/switch/node can have multiple default routes, but that can cause undesired behavior: equal-prefix routes with the same metric may be chosen at random, round robin or all but one are simply ignored, depending on platform and configuration. But your example isn't really about that.

If you want packets to routed via different default gateways depending on the source subnet then you'll need policy-based routing (PBR) on the L3 switch.

Improve this answer
2
  • My understanding is that source based routing is undesirable (if not down right insecure) so I was trying to engineer a configuration that included the common hop (the layer 3 switch) but still retained the desired effect of having Client A and B exit to the WAN via different routers/firewalls. I haven't investigated PBR so I'll give that a look and see if the example switch has support.
    – Digital ink
    Jan 12 at 21:15
  • Source routing is a security risk and (mostly) obsolete. Source-based routing isn't and it's quite common. The former uses a hop list provided by the source node, the latter policies on the router(s).
    – Zac67 ♦
    Jan 12 at 21:20
0

My initial reaction to the question as stated is: You're probably doing something wrong and this is not the way to solve it. Unusually complicated requests like this usually indicate something in the network design is not as well thought out as it could be and this request is an effort to patch over a problem that could be solved a better way.

The common solution to the need to isolate networks on a single layer 3 gateway and provide separate routing implementations for those networks is VRF-Lite or full VRF (Virtual Routing & Forwarding) which allows you to have multiple 'routing tables' in use for independent/isolated networks. For example, if you are a service provider you can provide internet services for multiple customer networks with different routing designs for each one without having to implement multiple gateway devices for each customer.

Your proposed Netgear switch does not support VRF.

Policy-Based Routing will probably accomplish what you describe but will add a level of complexity and fragility that might not be desirable. It probably depends on how often you expect to need to work on the network or make changes to how things work and on how many different people need to understand how it all works.

See the section on Policy Based Routing in the following manual and look for the ability to set the next hop address. That will allow you to select source networks (via access-list qualification) and forward their outbound traffic to a desired gateway address other than the actual default gateway of the layer 3 switch.

https://www.downloads.netgear.com/files/GDC/M4300/M4300_SWA_EN.pdf

Alternately, look into SD-WAN (software defined wide area network) implementations which allow you to easily define types of traffic (HTTPS vs. DNS, for example), applications, source networks or destination networks that should be carried over one network or another or one WAN service or another, etc.

Improve this answer
5
  • PBR seems to the the solution for my situation but I am curious about your commentary. Let me give a bit more detail on the environment and maybe there is a better solution. Part of the complexity is being dictated by different subnets needing to exit the network on different WAN serivces. Some core servers need to exit onto a leased line type of service where published static IPs reside. Other subnets are workstations that route out via a consumer grade cable modem.
    – Digital ink
    Jun 20 at 17:41
  • The clients, or source subnet, is dictating the gateway as the different gateways have different WAN service. I was hoping to do both layer 2 and layer 3 segmentation with a layer 3 switch but didn't know how to route the different subnets accurately. Does that help clear up the picture? Is there a better way to implement that system?
    – Digital ink
    Jun 20 at 17:42
  • That does make some sense and it leads back to my original assumption that the setup is probably overly convoluted but it may be unavoidable if the main issue is cost of the internet service. My recommendation in your case would be to use a gateway device that has built in functionality for what you want to do. Most business class firewalls can easily do what you want. Cisco, Palo Alto, Soniwall, Fortinet, etc. will all do it just fine (some call it dual WAN or SD-WAN, etc.). They would let you define multiple internet services and policies for which is used for which internal network etc.
    – FrameHowitzer
    Jun 20 at 18:54
  • I'd say its less cost and more class of service and organic growth. The lease line type service provides guaranteed uptime but slower speed. The cable modem class is much faster but also has more outages. I've got business class sophos units at the edge. I'll look for the service that allows me to direct traffic and maybe I can get some consolidation. I agree that simpler is better. Thanks for the input @FrameHowitzer.
    – Digital ink
    Jun 21 at 20:56
  • Yes I would assume the Sophos can probably do it better at the edge than a layer 3 switch could. Good luck!
    – FrameHowitzer
    Jun 21 at 21:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.