Hypothetical routing question
-
A service provider asked me for help to connect their networks with a customers PFsense. Apparently they have several networks that needs to be reachable on customer side in order for a service to work. We have an IPSec tunnel up and running as per illustration, but they would like to make routable the other two networks as well.
Spontaneously I answered that the only way to do this is probably to connect one IPSec with each subnet, but he insisted they solved this with static routes in the past. So I thought I'd ask just to see if anyone has any other ideas.
-
pfSense can do IPsec in two different ways, policy-based and route-based (VTI)
To accomplish that scenario using policy-based you would make these IPsec networks (phase 2 tunnels) on both sides:
Site A
Local Network: 172.16.186.64/26 Remote Network: 10.5.0.0/24
Local Network: 172.16.203.128/28 Remote Network: 10.5.0.0/24
Local Network: 172.16.212.0/26 Remote Network: 10.5.0.0/24Site B
Local Network: 10.5.0.0/24 Remote Network: 172.16.186.64/26
Local Network: 10.5.0.0/24 Remote Network: 172.16.203.128/28
Local Network: 10.5.0.0/24 Remote Network: 172.16.212.0/26If you are already using an ESP phase 2 tunnel for the existing network, the most straightforward path would be to just add two more "Phase 2" tunnels to each side.
Using a VTI tunnel would establish a /30 point-to-point over which you can route any networks you like to the other side using static routes or routing protocols.
It doesn't look like the book has caught up yet (VTI is a newish feature) but this exists:
https://www.youtube.com/watch?v=AKMZ9rNQx7Y
-
@Derelict Thanks bud, we just tested what you said and it worked beautifully. The process was a bit tricky to understand because they used Unifi on the opposite side but after letting go of preconceptions and just tried everything just popped into place.
