Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Unique Situation

    Scheduled Pinned Locked Moved Routing and Multi WAN
    10 Posts 5 Posters 972 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E
      esi.curban
      last edited by

      Thank you all for your time, I have a bit of a challenge and I thought I would reach out to the community for some suggestions.  I will include a map of my situation, but here it goes.

      My ISP provides me with 2 IP blocks for sake of security are:

      Block 1 – 208.138.170.208/29
      Block 2 -- 208.198.243.0/24

      The current hardware configuration is as follows:

      ISP -> Cisco Catalyst 3550 Switch (Block 1) <- rip -> newly placed pfSense Firewall (Block 2)

      Detail about this setup:

      • Cisco Catalyst 3550 Switch with Block 1 addresses

      • IP Routing Enabled and Forwarding IP is set to 208.138.170.209

        • RIP enabled and to 208.198.243.0

        • RIP incoming: both versions

        • RIP outgoing: RIP v1

      • 208.198.243.0 is routed to pfSense

      • NAT for 208.198.243.0 to DMZ and DMZ2

      ![Network Map.jpg](/public/imported_attachments/1/Network Map.jpg)

      ![Network Map.jpg_thumb](/public/imported_attachments/1/Network Map.jpg_thumb)

      1 Reply Last reply Reply Quote 0
      • S
        spoggle
        last edited by

        a description of the pfSense hardware would be useful as would an idea of how the 3550 is configured. (Your image, btw, is HUGE, I can't view much more than a few characters of it at a time)

        I think you should be able to replace the switch with the pfSense box and get rid of the internal RIP (is that from your ISP?).

        1 Reply Last reply Reply Quote 0
        • chpalmerC
          chpalmer
          last edited by

          Your image, btw, is HUGE

          No Lie!  :o

          ![Network Mapsm.jpg](/public/imported_attachments/1/Network Mapsm.jpg)
          ![Network Mapsm.jpg_thumb](/public/imported_attachments/1/Network Mapsm.jpg_thumb)

          Triggering snowflakes one by one..
          Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

          1 Reply Last reply Reply Quote 0
          • H
            heper
            last edited by

            you probably have a static wan  address that has 2 blocks routed to it ?
            why have 2 routers at all?

            you could just add both the /29 & the /24 on the same device ….. why add the complexity of forwarding one block to a secondary router ?

            1 Reply Last reply Reply Quote 0
            • E
              esi.curban
              last edited by

              @chpalmer, thank you for resizing that for me, I did not realize the image was that large!

              @heper, from what my ISP told me, they provide access through the /29 and sold us a /24 block, all traffic goes through /29 and the Cisco switch that my predecessor put in was to forward all traffic from the /29 to the /24.  So my true gateway would be 208.138.170.209, and the /24 has all my web and email services on that network.

              @spoggle the pfsense hardware is the equivalent to Netgate's XG-1541 1U with an additional 4 port gig nic. 1 nic is WAN for /24 network, and the other nics are subnetted for the various networks I have.  DMZ & DMZ2 have a 1:1 NAT to the /24 addresses.

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                So your /24 is routed through the 29.. To which IP in the 29 or you have to provide routing protocol to them to tell them what IP to hit in the /29 to get to the /24?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • E
                  esi.curban
                  last edited by

                  @johnpoz with the current setup that was put in place,

                  My Cisco Switch has IP routing turned on and 208.138.170.209 (/29) is the default route forwarding IP and its destination is the /24 through RIP

                  1 Reply Last reply Reply Quote 0
                  • H
                    heper
                    last edited by

                    so basically you could just setup pfsense with wan 208.138.170.209 (/29) & just put the /24 as VIPs  (with NAT) or use the /24 on 1 or more interfaces (without NAT)

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      Yeah really not seeing the point of the 2 routers here.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • E
                        esi.curban
                        last edited by

                        @everyone

                        I would like to thank you all for your advice and it was great advice.

                        I was able to achieve my goal and remove the Cisco switch. @heper's suggestion, I put the /29 network as the WAN address and since I already had the /24 as VIPs, everything worked like a charm.  Thank you for guiding me!  Tomorrow morning, I am heading to my satellite office and putting in another pfsense box with a ipsec site to site vpn. I can now have uniformity between my 2 offices (already got that working in my test lab!  :) ).

                        Thank you all for your help!

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.