Solved EdgeRouter routing
-
The corporate router needs a route that points all traffic for 10.1.62.0/24 to the IP of eth3 on the ERL.
Otherwise it will send that traffic out its default gateway.
-
Also, you look to have multiple weird networks going on here.
10.1.62.0/24 is your LAN.
What is 10.66.1.0/24 and 192.168.62.0/24?
I think that 192.168.62.0/24 is the actual corporate LAN?
Then WTF is 10.66.1.0/24?
-
@mike-davis said in EdgeRouter routing:
a to just connect back in to the corp LAN with ETH3 on our router as if it was just one of the computers. Seems like if a comput
Also, if there are any more routers on the other side of the VPN tunnel, they will need routes to know how to get back to your internal network as well.
Do you not have an option for setting up a VPN connection to this 10.66.1.100 device from within the new network?
-
Thanks for the suggestions. Let me whip up a diagram.
-
Here is basically what the old configuration looked like:
-
This is what I have now:
-
Basically I plugged the Edge router in where the computer was plugged in and statically assigned the IP address to Eth3 on the ER. The cisco router that Corp supplied must have a site to site VPN running since 10.66.1.100 is a private address.
-
@mike-davis said in EdgeRouter routing:
Basically I plugged the Edge router in where the computer was plugged in and statically assigned the IP address to Eth3 on the ER. The cisco router that Corp supplied must have a site to site VPN running since 10.66.1.100 is a private address.
This is not how any of this works.
-
@dashrender said in EdgeRouter routing:
Do you not have an option for setting up a VPN connection to this 10.66.1.100 device from within the new network?
Probably could, but the way it was Corp was connecting in and messing with their machines so they don't want to have a wide open connection.
-
@mike-davis said in EdgeRouter routing:
@dashrender said in EdgeRouter routing:
Do you not have an option for setting up a VPN connection to this 10.66.1.100 device from within the new network?
Probably could, but the way it was Corp was connecting in and messing with their machines so they don't want to have a wide open connection.
You setup a rule in the ERL to only allow connectivity to/from the IP of the specific server that you need access to.
-
@mike-davis said in EdgeRouter routing:
@dashrender said in EdgeRouter routing:
Do you not have an option for setting up a VPN connection to this 10.66.1.100 device from within the new network?
Probably could, but the way it was Corp was connecting in and messing with their machines so they don't want to have a wide open connection.
Unless this is legally an entire separate entity, corporate SHOULD be doing that.
-
From your diagram, it's likely that server 10.66.1.100 has no idea how to get back to 10.1.62.20. You need to give it a route to Corp Cisco router for network/node 10.1.62.20 and the corp cisco router needs a route also to network/node 10.1.62.20.
-
@jaredbusch said in EdgeRouter routing:
Unless this is legally an entire separate entity, corporate SHOULD be doing that.
It's a Dr has her own practice, but consults for them. Other specialists in the building are owned by corporate, so when it came to connectivity, they just plugged her in to their LAN. It made it easy to connect to their server, but other things are a real pain because they don't own her equipment etc.
-
@dashrender said in EdgeRouter routing:
From your diagram, it's likely that server 10.66.1.100 has no idea how to get back to 10.1.62.20. You need to give it a route to Corp Cisco router for network/node 10.1.62.20 and the corp cisco router needs a route also to network/node 10.1.62.20.
When the laptop is plugged in where the ER is, it has no problem connecting.
-
@mike-davis said in EdgeRouter routing:
@dashrender said in EdgeRouter routing:
From your diagram, it's likely that server 10.66.1.100 has no idea how to get back to 10.1.62.20. You need to give it a route to Corp Cisco router for network/node 10.1.62.20 and the corp cisco router needs a route also to network/node 10.1.62.20.
When the laptop is plugged in where the ER is, it has no problem connecting.
Sure, because that new network you created behind the EdgeRouter isn't in the middle, but you've introduced a new network behind another network. So the far side (10.66.1.100) has no idea that the 10.1.62.1 network exists, so it doesn't know how to get there. The same is true of the Cisco Router. it's unaware that you've put a new network in place behind the 192.168.61.1 network (again, namely the 10.1.62.20 network).
-
Since 10.1.62.x is NATed behind the ER how would the other networks know about it?
Wouldn't they only need to get back to 192.168.62.20 ? -
@mike-davis said in EdgeRouter routing:
Since 10.1.62.x is NATed behind the ER how would the other networks know about it?
Wouldn't they only need to get back to 192.168.62.20 ?I think that partially answers my question. I'm not NATing eth3 yet....
-
creating a masq for eth3 automatically created a static route for 192.168.62.0/24, and then I added a couple of more routes, but something isn't right because my ping from the windows box looks like this:
Reply from 10.1.62.1: Destination host unreachable. Reply from 10.1.62.1: Destination host unreachable. Reply from 10.1.62.1: Destination host unreachable. Reply from 10.66.1.100: bytes=32 time=1ms TTL=61 Reply from 10.66.1.100: bytes=32 time=2ms TTL=61 Reply from 10.66.1.100: bytes=32 time=2ms TTL=61 Reply from 10.66.1.100: bytes=32 time=2ms TTL=61 Reply from 10.66.1.100: bytes=32 time=1ms TTL=61 Reply from 10.66.1.100: bytes=32 time=2ms TTL=61 Reply from 10.1.62.1: Destination host unreachable. Reply from 10.66.1.100: bytes=32 time=1ms TTL=61 Reply from 10.66.1.100: bytes=32 time=2ms TTL=61 Reply from 10.1.62.1: Destination host unreachable. Reply from 10.66.1.100: bytes=32 time=1ms TTL=61 Request timed out. Reply from 10.66.1.100: bytes=32 time=1ms TTL=61 Reply from 10.1.62.1: Destination host unreachable. Reply from 10.66.1.100: bytes=32 time=1ms TTL=61 Reply from 10.66.1.100: bytes=32 time=2ms TTL=61 Reply from 10.1.62.1: Destination host unreachable. Reply from 10.1.62.1: Destination host unreachable. Reply from 10.1.62.1: Destination host unreachable. Reply from 10.66.1.100: bytes=32 time=2ms TTL=61 Reply from 10.1.62.1: Destination host unreachable. Reply from 10.66.1.100: bytes=32 time=1ms TTL=61 Reply from 10.1.62.1: Destination host unreachable. -
Got it.
Added a static route of 10.66.1.0/24 192.168.62.1 eth3 and life is good.
-
The tracert is interesting. The server that I thought was across a site to site VPN is more likely in the building due to the ping times:
Tracing route to 10.66.1.100 over a maximum of 30 hops 1 <1 ms <1 ms <1 ms 10.1.62.1 2 1 ms 2 ms 1 ms 192.168.62.1 3 2 ms 2 ms 1 ms 192.168.180.2 4 2 ms 2 ms 1 ms 10.66.1.100 Trace complete.
