Subnetting VLANS and county router

[jamie2497]

Hi all,

 

I'm currently in the middle of breaking our allocated IP range down into VLANs/Subnets and had a question as to whether county would need to set up routes back to the core switch.

 

Range allocated is x.x.8.0/21 and i'm breaking it up into various /24 and /25

 

Clients will have a default gateway of the VLAN and the Core switch will have a default gateway of the county router and I believe the county router interface is the first IP address in our range (x.x.8.1).

 

Will I need to get them set up routes on the router to all of our VLANs eg. if the core IP on the x.x.8.0 is x.x.8.254:

 

x.x.8.0/24 > x.x.8.254

x.x.9.0/25 > x.x.8.254

x.x.9.128/25 > x.x.8.254

 

etc etc.

 

Cheers

[Davit2005]

Yes, I have always done this so the router knows where to route traffic back to.

[FN-GM]

Yes, I have always done this so the router knows where to route traffic back to.

 

You shouldn't need to add any routes on the LA router as he is not going outside of the assigned address space. His assigned address space will be seen on the router as directly connected, so the router already knows what port to send this traffic out of.

 

Have a look at this Cisco Packet Tracer file. Router 0 represents the LA router, the 2 PC's that are connected to the new vlans can ping the server. Router 0 does not have the static routes. In the routing table it already has the network listed on port FA0/0 as it is directly connected.

LA Router Setup.zip

[snagrat]

We've just done this and SWGfL basically changed the router to have a /29 subnet on the router interface. They they told us what IP to put our switch on in order to send traffic back to it

[ITGuyWestMidlands]

We are on a flat network and looking at dropping in some VLANs. We have two dcs with one also running adcs (I know, I know). Had anybody had any issues changing dcs to a new ip and subnet? Anything to watch out for? Thanks

[FN-GM]

We are on a flat network and looking at dropping in some VLANs. We have two dcs with one also running adcs (I know, I know). Had anybody had any issues changing dcs to a new ip and subnet? Anything to watch out for? Thanks

 

Done it a number of times with no issues.

[Davit2005]

You shouldn't need to add any routes on the LA router as he is not going outside of the assigned address space. His assigned address space will be seen on the router as directly connected, so the router already knows what port to send this traffic out of.

 

Have a look at this Cisco Packet Tracer file. Router 0 represents the LA router, the 2 PC's that are connected to the new vlans can ping the server. Router 0 does not have the static routes. In the routing table it already has the network listed on port FA0/0 as it is directly connected.

 

Thanks, Yes I can see the setup and that makes sense.

 

 

 

we prob have 50 vLANs altogether and they are all on different subnets to the Firewall (LAN) interface, so it is a habit when I create new vLANs I add them to as static routes, create DHCP scopes etc.

 

In our setup we have read access to the managed service router that is on our premisses and we also manage the firewall ourselves so this makes it a hell of a lot easier and quicker to make any changes compared to the issues I remeber back in a secondary when we had lousy support from the LEA and had to wait 3 months for them to allow our Exchange traffic through, 6 Months for Blackberry ( don't ask ) and about 10 months to sort an RM easy mail issue out

Edited August 15, 2016 by Davit2005

[FN-GM]

Thanks, Yes I can see the setup and that makes sense.

 

 

 

we prob have 50 vLANs altogether and they are all on different subnets to the Firewall (LAN) interface, so it is a habit when I create new vLANs I add them to as static routes, create DHCP scopes etc.

 

In our setup we have read access to the managed service router that is on our premisses and we also manage the firewall ourselves so this makes it a hell of a lot easier and quicker to make any changes compared to the issues I remeber back in a secondary when we had lousy support from the LEA and had to wait 3 months for them to allow our Exchange traffic through, 6 Months for Blackberry ( don't ask ) and about 10 months to sort an RM easy mail issue out

 

Do you have lots of static routes on your firewall? If so you should use summary addresses. Its much more efficient. Why have 10 static routes when you can have 1

[Davit2005]

Do you have lots of static routes on your firewall? If so you should use summary addresses. Its much more efficient. Why have 10 static routes when you can have 1

 

We have actually moved to OSPF internally now because of the internet connections over mutliple sites for redundancy so that does make it a bit easier to be honest, no more entering routes. The vLANS are all over the place which does need sorting out.

Edited August 15, 2016 by Davit2005

[SYNACK1]

Bumping an old thread... but have a question that sort of ties in with this... basically we have been given a /21 block by our provider... If I wanted to subnet this down obviously the routes back would be fine as I totally get FN-GMs explanation (thanks btw). Currently are default gateway is the first in the range so would I have to get them to allocate me a seperate subnet for my default gateway interface say use the first ip address in the range still but instead have a /30 and connect this to my core switch? I may not have explained this the best way but any help would be great thanks.

[FN-GM]

I don't understand what you mean sorry. But allocating a separate subnet for default gateways won't be possible. The DG has the be in the same subnet as the device connected.

[SYNACK1]

Ah sorry I'll try again.

 

So as I as say currently we have a /21 network.

 

the default gateway interface on our managed router is the first ip address in the range.

 

Say if I wanted to subnet into /24 how am I best to tackle the interface address/subnet on the default gateway (can I keep the same one and not touch this).. or will I have to request the ISP to make some changes?

 

Still dont know if I have explained it the best.. but thanks for the response

[FN-GM]

So when you say Default Gateway you mean the IP of your ISP router?

 

You could setup a specific subnet that will be used only between the ISP your and your level 3 router. You set a static route on your L3 switch for the gateway as last resort using the IP of the ISP router. EG on Cisco: IP Route 0.0.0.0 0.0.0.0 192.168.1.1

[SYNACK1]

Yea say for instance 10.x.x.1 255.255.248.0 is currently the default gateway to my ISP router. If I setup a specific subnet between my isp router and my core layer 3 switch (one thats going to do the inter vlan routing) as you said above. Would I have to get them to change the subnet mask on there interface so it could be like 10.x.x.1 255.255.255.252 & then on my specific subnet on my core switch I have 10.x.x.2 255.255.255.252. I'm trying to test my theory out in PT.. keeping the current subnet mask of 255.255.248.0 on the isp router interface and then putting a 255.255.255.252 on my core switch interface and it works?

 

I'm probably over complicating things here and confusing myself.

 

Thanks again

[snagrat]

If you can, get the ISP to create a new subnet on a second router interface. Allows you to setup and test everything before rolling out.

I’ve just done the exact same things and I am able to fully test everything with temporary switches and servers.

[SYNACK1]

Yea thats a good idea! would be good to do some testing before going live.. do you have any idea about what I posted above... If they werent able to give me a secondary subnet on the router interface.. and I wanted to subnet my /21 network would I need to ask them to change the subnet mask on there side to a /30 if I wanted to just create a point to point link between them and my layer 3 core switch.

 

Thanks for the response aswell

[snagrat]

Yea thats a good idea! would be good to do some testing before going live.. do you have any idea about what I posted above... If they werent able to give me a secondary subnet on the router interface.. and I wanted to subnet my /21 network would I need to ask them to change the subnet mask on there side to a /30 if I wanted to just create a point to point link between them and my layer 3 core switch.

 

Thanks for the response aswell

 

Yes they would change their interface to a /30 (or /29 if there is a failover backup line as well)

Then you set you Core interface to the same /30 subnet (obviously different IP address)

 

They then create a static route back to your core.

[SYNACK1]

Perfect.. thanks I was totally overthinking this