No rdp between subnets
-
question for you is the cloud in your drawing the same connection or 2 different connections?
Doesn't really matter but trying to make sure that we are talking about 2 different pfsense here and 2 different internet connections connected with your 3560.. Be happy to draw how the network should be setup with transit networks and allow you for complete control of traffic between your segments, and allow for failover over or load balancing to your what I assume is two different internet connections with your clouds in your drawing?
-
question for you is the cloud in your drawing the same connection or 2 different connections?
Hello,
we have 2 different internet connections both in real setup and in test case. In the real network, in the ASA arrives one ISP cable and I have the 192.168.7.1 as ip of the nic and it is the gateway of the network 192.168.7.x/24, defined on ASA, to navigate in internet, while the 192.168.7.254 is on cisco 3560 and we use it to navigate from 192.168.7.x/24 inside our internal network; for vlan 500 and other internal networks we have as gateway 192.168.0.1 defined on cisco and from there the static route to pfsense 192.168.0.30 that is connected to another provider.
For the test case, the internal networks have the same setup as described while vlan 200 has the same setup as that described for vlan 7 but instead of ASA there is another pfsense.
Marco
-
If you want to keep it designed as you have it, then everything on the 192.168.200.0/24 network (pfsense test, DC vlan 200) will need routes for everything behind the 3560 from their perspective with 192.168.200.254 as the gateway. DC vlan 200 can then have its default gateway set to 192.168.200.2.
If you make another transit network between the 3560 and pfSense test then the 3560 will need to be the one that makes the policy routing decision as to which pfSense to use based on the source address of the connection (multi wan).
-
If you want to keep it designed as you have it, then everything on the 192.168.200.0/24 network (pfsense test, DC vlan 200) will need routes for everything behind the 3560 from their perspective with 192.168.200.254 as the gateway. DC vlan 200 can then have its default gateway set to 192.168.200.2.
Hello,
thanks even to you for the time dedicated. Could you explain well, maybe is my understanding of English that doesn't help :-) I have a static route to vlan 500 (192.168.0.0/24) via 192.168.200.254 in the test pfsense: do you say that I have to set the same for other networks? I've done the same for vlan (192.168.20.0/24) but not for the other networks on cisco because I don't use it in the test.
Marco
-
You need the route on the DC vlan 200 too or the pfsense has to hairpin the traffic in and back out its LAN.
Look at your diagram. What happens when DC vlan 200 has traffic for 192.168.0.X? Where is it sent based on that host's routing table? What happens when it gets there?
That's why you don't put hosts on a segment with two routers. Those hosts need their own routing tables to make things flow correctly.
-
You need the route on the DC vlan 200 too or the pfsense has to hairpin the traffic in and back out its LAN.
Look at your diagram. What happens when DC vlan 200 has traffic for 192.168.0.X? Where is it sent based on that host's routing table? What happens when it gets there?
That's why you don't put hosts on a segment with two routers. Those hosts need their own routing tables to make things flow correctly.
Sorry,
but why I can rdp from 192.168.200.11 to vlan 500 and vlan 20 hosts? And I can also load the pfsense dashboard (192.168.200.2:80) from an host on vlan 500? And also the ping is ok from vlan 500 to vlan 200.
Thanks,
Marco
-
Sorry,
but why I can rdp from 192.168.200.11 to vlan 500 and vlan 20 hosts?
Hard to say. Probably because you haven't told us everything there is to know about what you have there?
And I can also load the pfsense dashboard (192.168.200.2:80) from an host on vlan 500?
Because you have added static routes on pfSense Test telling it that traffic for vlan 500 is to be sent to the 3560?
And also the ping is ok from vlan 500 to vlan 200.
Ping can succeed in many asymmetrical routing scenarios where UDP and, particularly TCP will fail. The statefulness of ICMP is completely different.
-
Because you have added static routes on pfSense Test telling it that traffic for vlan 500 is to be sent to the 3560?
Yes, as I said in previous posts I have set on pfsense test a static route to vlan 500 with 192.168.200.254 as gateway: it is in one of the images uploaded.
Marco
-
Then that is why that is working. Instead of saying you have a static route to "vlan 500" please use a cidr as the route destination such as 192.168.0.0/24. You don't route to a VLAN. You route to a Layer 3 network.
-
Then that is why that is working.
Ok, I understand this, I created on the pfsense on 192.168.0.30/24 a static route to 192.168.0.0/24 with gateway 192.168.0.1 but it is not working: as said, it works if I load pfsense dashboard page and so contact 192.168.200.2:80.
Instead of saying you have a static route to "vlan 500" please use a cidr as the route destination such as 192.168.0.0/24. You don't route to a VLAN. You route to a Layer 3 network.
Ok, sorry, I'll do it.
Marco
-
"I created on the pfsense on 192.168.0.30/24 a static route to 192.168.0.0/24 with gateway 192.168.0.1 but it is not working"
huh.. That is bad design out of the box.. You fix your whole problem if you use transit networks.. This is networking 101..
As Derelict stated if your going to use your cisco 3560 as the box to route all your internal networks, then you would connect it to your different pfsense with transit networks (No hosts on these networks) they are transit used to get from network(s) A,B,C to other networks, etc. This is all they are used for.
You can hang as many or as few networks you want off your 3560, but this is the box that will determine where traffic goes if not destined for a network hanging off it it - be it one of your pfsense boxes that have internet connections or other networks hanging off of them, etc.. You could use 2 different transit networks for your different pfsense or you could put them on a common transit.
See attached example - follow the flow of any network to any network.. It is symmetrical.. Ie the same path is taken to or from, and there are no hairpins. The 3560 would have routes that let networks a,b or c go to pfsense 1 or 2 depending on the destination network. No now you have no hairpins either.
You can use either a common transit or you could use 2 different transit connected to your cisco 3560.
-
Hello,
so you suggest to do a revision to the entire network and use transit network.
I'd like to do this, also to learn new thing, because I haven't designed the network initially and I haven't networking 101 (even it seems that who designed the network has it, too :-) ).
But in your opinion, why with the real network I have no problem to rdp and with pfsense yes? I can do a packet tracing to understand where the packets are lost?
I appreciate your effort to help me and to have the possibility to learn from you new and better technique to better design my network.
Marco
-
"so you suggest to do a revision to the entire network and use transit network. "
Its not really a revision of the whole network.. Its just to break the pfsense out to their own transit networks so you remove the asymmetrical routing.. All of your vlans hanging off your 3560 can stay there. No changes need more then likely..
but yes this is what I suggest because the best you can do with your current asymmetrical mess is work arounds with either host routing on the boxes sitting on what amounts to the transit and or source natting stuff, etc. Or bypassing rules for traffic that enters and leaves the same interface, etc.
Don't look at as a revision but a correction to the mess that was there.
To be honest if I was going to revise the network I would prob get rid of your 3560 as router and just use as switch at layer 2 and just hang all the networks off pfsense - this allows for much easier control of traffic between segments. And would prob leverage your 2 different internet connections into a failover setup with your 2 pfsense in a carp. But without fully understanding your whole network it hard to say how much work that would be, etc. Nor do we understand the amount of traffic flow you have between vlans. Maybe your current pfsense boxes could not handle it at wire speed? I could be a hit to your speed between vlans?
But for now just move the devices off your current transit networks. Or bring up new transit(s) to connect your 2 pfsense to your 3560.
-
HEllo,
I know that the question that I have is "off-topic" here, but how to start to revise the network? I can do it vlan after vlan in your opinion? And what about, for example, the vlans that have hsrp on cisco? I have to define on both pfsense and cisco?
Could you give me a starting guidance?
Marco
-
More than happy to throw my advice at you, if there was an actual drawing of your network with enough details so wouldn't be guessing. For example you mention hsrp - no where previous did that come up..
So your 3560 is actually a stack? Are you going to run a lag to this stack so you have 1 physical connection to each switch in the stack. Is there some other switch between pfsense and that? Are you going to run pfsense in a carp setup?
If you would draw out your current network with enough details, then could make suggestions on what I would change, etc..
