Routing concerns

[CHiLL]

We have had Smoothwall installed recently as a VM to replace RM's SafetyNet but have ran into some issues which I think are network related, specifically regarding the default route.

 

So our network prior to Smoothwall being installed was using RM's SafetyNet with transparent proxy enabled and the traffic flowed as follows:

 

Client (10.22.100.60) > VLAN 100 Default Gateway (10.22.100.1) > RM's Juniper Router (10.22.2.254) > Internet

 

With the Smoothwall, the network is the same, however we disabled RM's SafetyNet, disabled transparent proxy and blocked all traffic that does not come from Smoothwall's IP address. We use GPO or manual proxy settings to redirect all HTTP/HTTPS traffic to the Smoothwall VM on our one of our ESXi hosts, so the HTTP/HTTPS traffic flows as follows:

 

Client (10.22.100.60) > VLAN 100 Default Gateway (10.22.100.1) > VLAN 11 Default Gateway (10.22.11.1) > Smoothwall (10.22.11.30) > RM's Juniper Router (10.22.2.254) > Internet

 

I've attached a (poorly) hand drawn diagram showing our current layout.

 

However we've found that non-proxy aware devices or applications are taking the default route out to the Internet. As the traffic has not come from Smoothwall, it does not actually get to the Internet.

 

Is there any way of making all traffic flow through the Smoothwall VM and then to the Internet?

 

P.s, We're using a HP ProCurve 5406zl core switch.

Edited July 5, 2018 by CHiLL

[mrbios]

So you're not currently doing network routing through the smoothwall, you're just pointing them to it as a proxy?

 

If that's the case you'll need to change your 0.0.0.0 route on the 5406 to point at the smoothwall and not the Juniper router i imagine. Hopefully i've understood that correctly.

[CHiLL]

So you're not currently doing network routing through the smoothwall, you're just pointing them to it as a proxy?

That's correct.

 

If that's the case you'll need to change your 0.0.0.0 route on the 5406 to point at the smoothwall and not the Juniper router i imagine. Hopefully i've understood that correctly.

I don't want to risk causing a loop. So for example let's say I make that change and set 0.0.0.0 to route to the Smoothwall, the Smoothwall will have to then push traffic back through the Core Switch to get to the router. The Default Route would keep trying to push everything back to the Smoothwall would it? Including it's own traffic?

[mrbios]

That's correct.

 

 

I don't want to risk causing a loop. So for example let's say I make that change and set 0.0.0.0 to route to the Smoothwall, the Smoothwall will have to then push traffic back through the Core Switch to get to the router. The Default Route would keep trying to push everything back to the Smoothwall would it? Including it's own traffic?

 

Does your smoothwall have an internal and external interface at the moment? If so you need to set the external interface to point directly at the juniper as its gateway. That way when traffic is sent to the Smoothwalls internal (or basic) interface by the 0.0.0.0 route, the smoothwall will know where it needs to go next. Whereas the configuration in the OP has you pointing it back at the 5406 again.

[CHiLL]

Does your smoothwall have an internal and external interface at the moment? If so you need to set the external interface to point directly at the juniper as its gateway. That way when traffic is sent to the Smoothwalls internal (or basic) interface by the 0.0.0.0 route, the smoothwall will know where it needs to go next. Whereas the configuration in the OP has you pointing it back at the 5406 again.

It does have internal and external network interfaces. I've just checked and the external interface already has it's default gateway set as the IP of the router, so my diagram is incorrect regarding the route from the Smoothwall.

Edited July 5, 2018 by CHiLL

[mrbios]

It does have internal and external network interfaces. I've just checked and the external interface already has it's default gateway set as the IP of the router, so my diagram is incorrect regarding the route from the Smoothwall.

 

In the OP you've got

Client (10.22.100.60) > VLAN 100 Default Gateway (10.22.100.1) > VLAN 11 Default Gateway (10.22.11.1) > Smoothwall (10.22.11.30) > VLAN 2 Default Gateway (10.22.2.1) > RM's Juniper Router (10.22.2.254) > Internet

 

Which suggests that the Smoothwalls external interfaces is pointing at 10.22.2.1 is that correct?

 

If it goes like this:

Client (10.22.100.60) > VLAN 100 Default Gateway (10.22.100.1) > VLAN 11 Default Gateway (10.22.11.1) > Smoothwall (10.22.11.30) >  RM's Juniper Router (10.22.2.254) > Internet

 

With the external interface of the smoothwall pointing at 10.22.2.254 then you should be fine to change the 0.0.0.0 route on the 5406 which should route traffic correctly.

 

...hopefully I'm right anyway, but probably worth waiting for a second opinion in case i've missed anything.

[CHiLL]

In the OP you've got

Client (10.22.100.60) > VLAN 100 Default Gateway (10.22.100.1) > VLAN 11 Default Gateway (10.22.11.1) > Smoothwall (10.22.11.30) > VLAN 2 Default Gateway (10.22.2.1) > RM's Juniper Router (10.22.2.254) > Internet

 

Which suggests that the Smoothwalls external interfaces is pointing at 10.22.2.1 is that correct?

 

If it goes like this:

Client (10.22.100.60) > VLAN 100 Default Gateway (10.22.100.1) > VLAN 11 Default Gateway (10.22.11.1) > Smoothwall (10.22.11.30) >  RM's Juniper Router (10.22.2.254) > Internet

 

With the external interface of the smoothwall pointing at 10.22.2.254 then you should be fine to change the 0.0.0.0 route on the 5406 which should route traffic correctly.

 

...hopefully I'm right anyway, but probably worth waiting for a second opinion in case i've missed anything.

I have amended the OP to reflect the change. Smoothwall's external interface is definitely pointing to the router's IP address.

[mrbios]

I have amended the OP to reflect the change. Smoothwall's external interface is definitely pointing to the router's IP address.

 

Ah ok, in that case assuming the 5406 is the only layer 3 device routing client traffic on your internal network, changing the 0.0.0.0 route should do the trick without any loops to worry about.

[CHiLL]

Ah ok, in that case assuming the 5406 is the only layer 3 device routing client traffic on your internal network, changing the 0.0.0.0 route should do the trick without any loops to worry about.

I've PM'd you with a screenshot of our Core Switch routing config. If you wouldn't mind taking a glace, that'd be great.

[AlanD]

Just to muddy the waters a little...I’d be tempted to reconfigure so that smoothwall acts as the core router and gateways..so that it sees all traffic and can apply AD groups to rules for traffic between vlans....

 

...or ...for devices which are not proxy aware can you assign them smoothwall as the default gateway via static entries in dhcp?

[FN-GM]

Just to muddy the waters a little...I’d be tempted to reconfigure so that smoothwall acts as the core router and gateways..so that it sees all traffic and can apply AD groups to rules for traffic between vlans....

 

...or ...for devices which are not proxy aware can you assign them smoothwall as the default gateway via static entries in dhcp?

I wouldn't do this. Smoothwall wasn't designed to do this and doesn't have the power.

 

On a layer 3 switch each port has dedicated hardware to carry out the routing and switching at wire speed. The smoothwall doesn't and thus will be done in software.

[Blue_Cookeh]

I wouldn't do this. Smoothwall wasn't designed to do this and doesn't have the power.

 

On a layer 3 switch each port has dedicated hardware to carry out the routing and switching at wire speed. The smoothwall doesn't and thus will be done in software.

 

Suppose it depends what kind of performance you need across VLANs - we do it with our Sophos UTM at school.

[mrbios]

I wouldn't do this. Smoothwall wasn't designed to do this and doesn't have the power.

 

On a layer 3 switch each port has dedicated hardware to carry out the routing and switching at wire speed. The smoothwall doesn't and thus will be done in software.

 

I'd second this. There's so many negatives to having the routing done on the smoothwall, they outweigh the positives.

[mavhc]

Software based routing is usually in the gigabits per second range these days, what negatives did you find?

[AlanD]

Well ...it does 300Mb/s routing just for our internet data....which doesn't max out the CPU....

 

Internal vlan > Vlan traffic isn't that high for us...BYOD to internal servers certainly counts for some...but mainly BYOD traffic from internet has to come through smoothwall anyhow ...as does our internet to internal traffic.

 

Yes there is a small amount of data to vlans for projectors...and yes some for printers....

 

It was a suggestion...I wasn't saying it would be the right choice for everyone...As I said, I particularly like it because smoothwall (like TMG which preceeded it for us) is "AD aware" and so rules can include AD groups for permissions....such as allowing staff logons from PCs (or BYOD) to get to projectors...airserver connections...etc - while students logons can't. Maybe some switches are AD aware too....but certainly not our negear ones.

 

If I wanted to pass gigabits of data continuously between Vlans..well...I might have to sacrifice the AD permissions and use core switch routing...