Subnets Routing Behind Layer 3 switch
-
Well how are you devices to access squid running on pfsense (which you didn't mention) before when your rule forces all traffic out your wan gateway. That rule does not allow access to anything on pfsense like squid.. Just sends it out the wan gateway.
So does stuff on your 10.164.56 network need to talk to stuff on your transit? Which all have a gateway of pfsense 10.27.110.155??
This causes asymmetrical routing
-
I am running a layer 3 switch behind pfsense. There is a thread on this site under installation where I setup my configuration. Looking at your config the only thing I see different is on the firewall rules under LAN is I have asterisk instead of default gateway name. Probably won't make a difference. I ran a /24 mask to start with in the transit network and it worked fine. I now use a 30 bit mask instead. I am using a Cisco SG300-28 switch.
I assume you are using an access port on the layer 3 switch and not a trunk port.
-
Thanks for your comments.
I've just noticed a curious thing, the routing is working well to "outlook.office365.com", "www.cnn.com", but not to "www.google.com", "www.ibm.com", I don't have any special rule for this. From Pfsense webconsole, al pings are 100% OK
ping outlook.office365.com
Haciendo ping a outlook.ms-acdc.office.com [40.102.35.114] con 32 bytes de datos:
Respuesta desde 40.102.35.114: bytes=32 tiempo=236ms TTL=236
Respuesta desde 40.102.35.114: bytes=32 tiempo=227ms TTL=236
Respuesta desde 40.102.35.114: bytes=32 tiempo=227ms TTL=236
Respuesta desde 40.102.35.114: bytes=32 tiempo=234ms TTL=236ping www.google.com
Haciendo ping a www.google.com [172.217.28.228] con 32 bytes de datos:
Tiempo de espera agotado para esta solicitud.
Tiempo de espera agotado para esta solicitud.
Tiempo de espera agotado para esta solicitud.
Tiempo de espera agotado para esta solicitud.Estadísticas de ping para 172.217.28.228:
Paquetes: enviados = 4, recibidos = 0, perdidos = 4
(100% perdidos), -
Hi,
Thanks for your help, finally I found the problem, it was a bad defined rule in the switch router, at least I´ve learned a lesson about routing in PFsense.
Thanks
-
You still have a asymmetrical issue if devices on your transit need to be accessed from the downstream network(s) or the stuff on the transit access them.
Simple to fix with just bringing up an actual transit between your L3 and pfsense vs using a host network as a transit network.
-
John they way I handled the asymmetrical issue is to let the layer 3 switch handle all the local routing. In effect the layer 3 switch is the gateway for all local traffic and pfsense is the gateway for all internet traffic. It worked fine this way.
I decided I wanted my router in a VLAN by it self so I did move to using a 30 mask for the router VLAN. But the layer 3 switch is still the gateway for all local LAN traffic and pfsense is the gateway for all internet traffic.
-
"I decided I wanted my router in a VLAN by it self so I did move to using a 30 mask for the router VLAN"
So you created a transit ;) between the layer 3 and pfsense..
-
Yes I did move over to a /30 mask but not right away. I ran a /24 mask for a couple of months with no problems. The reason I moved to a /30 mask was to eliminate all the chattiness from the work stations slowing down the router to where all traffic going to the router VLAN is destined for the internet. When workstations start talking to each other behind the scenes this causes the router to wait because it is on the same network. By isolating the router and allowing the layer 3 switch to switch local traffic I have effectively removed all local bottle necks for the router.
-
"The reason I moved to a /30 mask was to eliminate all the chattiness from the work stations slowing down the router to where all traffic going to the router VLAN is destined for the internet."
Huh ???
At a complete loss to why would there be workstations on a transit? And why would devices on a network talking to each other have anything to do with your router - are you using a HUB?
-
"The reason I moved to a /30 mask was to eliminate all the chattiness from the work stations slowing down the router to where all traffic going to the router VLAN is destined for the internet."
Huh ???
At a complete loss to why would there be workstations on a transit? And why would devices on a network talking to each other have anything to do with your router - are you using a HUB?
What we are talking about John is all because you said asymmetrical routing does not work. I said it does if you set it up right. I used it for a while with workstations on the same network. I later then changed for other reasons other then it did not work.
-
"asymmetrical routing does not work. I said it does if you set it up right."
Yeah you can make it work with host routing, or source natting. Or allowing your firewall out of state traffic.. etc. etc..
Does not matter if you "can make it work".. The point it is setting it up in the first place is just plain BORKED!! If you condone or promote anyone running a asymmetrical network.. You for sure should not be in the networking biz that is for damn freaking sure! Sorry that is not ment as personal attack in anyway.. Its just stating my honest to goodness opinion.
-
Maybe with pfsense it is hard but it is easy to setup using a layer 3 switch. All you have to do is point the local traffic to the layer 3 switch. It knows where everything is and will route or switch to the device. Nothing hard. It is a good way to bring a layer 3 switch into the fold without disrupting normal operations.
