Layer 2 Tunnel over Layer 3 (IPSec/GRE/GIF)
-
@jknott said in Layer 2 Tunnel over Layer 3 (IPSec/GRE/GIF):
I could understand the need for relays back in the dark ages,
Actually my home pfsense relays requests to my linux dhcp.
But hey are "same site".For doing remote relay, you have to take "line outage" , and thereby - Site outage (no dhcp) into account.
I have had users complaining during a line outage, that they couldn't print their local word doc , to their local printer (dhcp outage) . They kind of accepted that they couldn't "see the server" , now that the line was down. But their PC & printer was in the same room .... That was hard to understand.
All was because the IT Dept was "saving" , and wasn't interested in having a Win BDC at every site anymore.
And no $$ for redundant lines.Well you get what you pay for, but local dhcp & dns can be essential.
That's where pfSense is a super "One box fits it all"
-
Circling back I think the answer here is that if you have to use that Cisco router at site B you will need to just route the traffic and have different subnets at each end.
If you can replace it with pfSense there are more options but we would still recommend routing it with different subnets at each end.
Steve
-
Hi,
at site B I have to use Cisco router, and following you advice, we will try to configure a tunnel GRE or IPSec.
I'll keep you postedThank you very much to all
-
Remember gre alone is unencrypted , it's just tunneling
-
Hi,
I am doing some tests using 2 pfsense (remeber that in production on site B I must use a Cisco Router). I created 2 GRE Tunnels and I can ping GRE Interfaces (from pfsense at site A to pfsense at site B and viceversa).
The GRE interfaces are /30 subnets:
GRE Tunnel 1 (for vlan 10)- 192.168.33.1/30 (Site A)
- 192.168.34.2/30 (Site B)
GRE Tunnel 2 (for vlan 30)
- 192.168.34.1/30 (Site A)
- 192.168.34.2/30 (Site B)
Now the question is: how can I "bind" GRE Tunnel 1 (Site B) to vlan 10 and GRE Tunnel 2 (Site B) to Vlan 30? I ask it because all the traffic on vlan 10 at Site B must be forward at vlan 10 at site A (DHCP and all kind of traffic), and the same thing for vlan 30.
Another question: At Site A, in addition to the GRE interfaces, do I need to create any particular interfaces?Thank you
-
Ok,
in my tests now I have the following interfaces (in addition to the GRE):
Site A:- Test 1 (Vlan 10): 192.168.55.1/24
- Test 2 (Vlan 30): 192.168.56.1/24
Site B:
- Test 1 (Vlan 10): 192.168.45.1/24
- Test 2 (Vlan 30): 192.168.46.1/24
Now the goal is to forward all the traffic of clients in Vlan A at Site B to the interface Test 1 (Vlan 10) at Site A, and, if it is possible, the clients at site B should receive their ip via a dhcp server enabled on the pfsense at site A.
The same thing for vlan 30...
Then for internet navigation of the clients at Site B is it enough to nat the subnets? Do I have to configure static routes?Thank you
-
Ok,
I went ahead with my tests and now i can surf the internet via the GRE Tunnel from the clients on vlan 10 at Site B. The only thing left to do is the implementation of the DHCP Server on PfSense at Site A, so the clients at Site B receive the right IPs:
- Vlan 10: 192.168.45.0/24
- Vlan 30: 192.168.46.0/24
How can I achieve this goal?
-
Are you sure you want to send company traffic over an unencrypted link?
-
Mmm, I always assume GRE over IPSec but....
You will need to setup a dhcp relay at site B pointing to a dhcp server at site A. However that probably can't be pfSense since there is no way to add a dhcp server for a subnet it does not have an interface in.
Steve
-
at this time I am doing only some tests. So, if I understood well, I can't use PfSense as DHCP Server at Site A...and if I will use IPSec VTI instead of GRE Tunnel?
Thank you
-
It wouldn't make any difference in terms of the dhcp server.
I would use routed IPSec there if the other router supports it if only because there are issues with GRE/IPSec in pfSense which it's better to avoid. And you definitely want to use encryption.
Steve
