No rdp between subnets
-
Hello,
so you suggest to do a revision to the entire network and use transit network.
I'd like to do this, also to learn new thing, because I haven't designed the network initially and I haven't networking 101 (even it seems that who designed the network has it, too :-) ).
But in your opinion, why with the real network I have no problem to rdp and with pfsense yes? I can do a packet tracing to understand where the packets are lost?
I appreciate your effort to help me and to have the possibility to learn from you new and better technique to better design my network.
Marco
-
"so you suggest to do a revision to the entire network and use transit network. "
Its not really a revision of the whole network.. Its just to break the pfsense out to their own transit networks so you remove the asymmetrical routing.. All of your vlans hanging off your 3560 can stay there. No changes need more then likely..
but yes this is what I suggest because the best you can do with your current asymmetrical mess is work arounds with either host routing on the boxes sitting on what amounts to the transit and or source natting stuff, etc. Or bypassing rules for traffic that enters and leaves the same interface, etc.
Don't look at as a revision but a correction to the mess that was there.
To be honest if I was going to revise the network I would prob get rid of your 3560 as router and just use as switch at layer 2 and just hang all the networks off pfsense - this allows for much easier control of traffic between segments. And would prob leverage your 2 different internet connections into a failover setup with your 2 pfsense in a carp. But without fully understanding your whole network it hard to say how much work that would be, etc. Nor do we understand the amount of traffic flow you have between vlans. Maybe your current pfsense boxes could not handle it at wire speed? I could be a hit to your speed between vlans?
But for now just move the devices off your current transit networks. Or bring up new transit(s) to connect your 2 pfsense to your 3560.
-
HEllo,
I know that the question that I have is "off-topic" here, but how to start to revise the network? I can do it vlan after vlan in your opinion? And what about, for example, the vlans that have hsrp on cisco? I have to define on both pfsense and cisco?
Could you give me a starting guidance?
Marco
-
More than happy to throw my advice at you, if there was an actual drawing of your network with enough details so wouldn't be guessing. For example you mention hsrp - no where previous did that come up..
So your 3560 is actually a stack? Are you going to run a lag to this stack so you have 1 physical connection to each switch in the stack. Is there some other switch between pfsense and that? Are you going to run pfsense in a carp setup?
If you would draw out your current network with enough details, then could make suggestions on what I would change, etc..
