Smoothwall IPSec Routing

[Jonah]

Hi all,

 

Hopefully someone has either tried this (and can tell me it either can or can't be done), or can point me in the right direction.

 

We have a number of schools across a number of different ISPs, and a central "MAT" site. All the schools and the MAT site have Smoothwall UTM appliances.

 

Each school is connected via an IPSec VPN to both the MAT site and every other school, which works fine and is pretty much issue free.

 

What I am potentially looking at is cutting down on the complexity of having to have every school connected to every other school (especially as we grow and bring additional schools on board), and instead being able to route from one school, via the MAT site, to another school. Effectively having all the schools have a single IPSec connection to the MAT site, but being able to route wherever needed.

 

Possible?

 

Cheers.

[MatthewL]

Not sure if Smoothwall support it but you want to look at OSPF.

 

We have a similar setup on our network, everything back to the 2 core sites via multiple ways including a VPLS and internet VPN's for failover, local internet traffic goes out its own connection and everything else routed via one of the cores.

[ibpalle]

The routing setup to achieve this could be to have all site subnets within one range and then have a tunnel from each site to the main where the target subnet is the supernet for all sites, like this:

 

Main site: 192.168.1.0/24

Branches: 192.168.2.0/24, 192.168.3.0/24 etc

 

Each branch has one tunnel to main which is defined as a tunnel to 192.168.0.0/16

 

This setup only requires one tunnel at each site, connected to the main smoothwall.

[Jonah]

The routing setup to achieve this could be to have all site subnets within one range and then have a tunnel from each site to the main where the target subnet is the supernet for all sites, like this:

 

Main site: 192.168.1.0/24

Branches: 192.168.2.0/24, 192.168.3.0/24 etc

 

Each branch has one tunnel to main which is defined as a tunnel to 192.168.0.0/16

 

This setup only requires one tunnel at each site, connected to the main smoothwall.

 

That makes sense - will initially try this with a school that has a new connection going live in the next couple of weeks, to avoid impacting the rest until we're sure it works.

 

Thanks a lot.

[ibpalle]

Make sure the firewall rules allow outgoing on the ipsec interfaces as well on the main site.