HP 5412z Routing, Smoothwall and ISP Firewall

[v1images]

Good Afternoon All,

 

Looking for a little advice, we are just starting on our journey to VLAN segregate a current /16 flat network however we are running into a few roadblocks when trying to access anything externally from the new subnets.

 

We have adopted one of our HP 5412z's as our core (172.16.8.80), which has our new VLAN interfaces configured (moving away from 172.16.0.0 to mostly 10.10.0.0/24 subnets), as well as IP Routing enabled and a default route to our Smoothwall box of 0.0.0.0 0.0.0.0 172.16.0.10.

 

INT1 on Smoothwall is 172.16.0.10, with its gateway as a Juniper ISP Managed Firewall at 172.16.0.11. Within Smoothwall we have also configured the 'subnets' page to reflect the new ranges with their gateway as the Core switch on 172.16.8.80.

 

So far everything is working as intended with our internal network, can ping between subnets and to Smoothwall and the DC's, however the new subnets do not have any internet access at all, or DNS resolution. Further investigation of this has lead me to discover from our two DC's, DC1 has its default gateway set to the ISP Managed Firewall on 172.16.0.11, and DC2 has its default gateway set to Smoothwall on 172.16.0.10. Having changed these to the new Core Switch on 172.16.8.80 or Smoothwall on 172.16.0.10 leads to a total loss of connectivity on our DC's also which makes me believe we may have a routing configuration problem.

 

Our topology documented is here if it helps:

 

 

Any tips or advice on where I could look and troubleshoot would be hugely helpful and appreciated.

[TechMonkey]

I maybe horribly wrong but I seem to recall when I went through a similar exercise I made the core switch the gateway for all devices, possibly using the VLAN specific IP for the switch. The core switch then had the Smoothwall as the gateway, I think each VLAN was set this way. Smoothwall external NIC then pointed to the external facing router.

 

I think the only alternative I was suggested was for setting up devices to be dumped directly to the outside and had the Smoothwall as their gateway and needed Smoothwall set up in a particular way, with an extra NIC connection. I never ended up doing this though so can't comment on anything more than the theory.

 

EDIT: Just had a look at the diagram, the caveat with my setup was that Smoothwall was inline between the core and the external facing router. I don't see why it shouldn't work the same way though.

Edited July 21, 2022 by TechMonkey

[DrCheese]

I maybe horribly wrong but I seem to recall when I went through a similar exercise I made the core switch the gateway for all devices, possibly using the VLAN specific IP for the switch. The core switch then had the Smoothwall as the gateway, I think each VLAN was set this way. Smoothwall external NIC then pointed to the external facing router.

 

Exactly how ours is setup -

 

Edge switches have their own /24.

Core switch has the gateway IP for each of those /24's (.1)

Core switch is .2 on our core VLAN

Smoothwall is .1 & then it goes from there.

 

Edge > Core > Smoothwall > external router.

 

On our smoothwall we manually add the routes for the all the vlans (eg to get to this /24 you need to go to core /.2)

[Davit2005]

On our smoothwall we manually add the routes for the all the vlans (eg to get to this /24 you need to go to core /.2)

 

^^ Have you checked this.

 

If the smoothwall (or next hop router) is unaware of the subnet that is routed on the core switch it will not route return traffic back.

 

Routers only forward traffic if they have a route to the destination.

 

If you have a lot of routes you can add a route summary. So for instance if your subnets routed on the core switch were /24 networks 10.2.1.0 to 10.2.254.0 you can summarize that to 10.2.0.0/16. Even if you have a subnet routed on the smoothwall (directly connected) that is in that range 10.2.0.0/16 by default it will put the priority of the directly connected subnet higher than a static/dynamic routes due to the default route metric.

Edited July 22, 2022 by Davit2005

[Katy]

The way I had this set up (if I can remember right):

 

Assuming the network is 10.0.1.0/16, split into multiple VLANs e.g. 10.0.1.0/24, 10.0.2.0/24, 10.0.3.0/24, 10.0.4.0/23 etc, and assuming Smoothwall sits on 10.0.1.0 subnet:

 

Each VLAN has an interface on the 5412 (core switch). Each subnet has its default gateway set to that interface. So 10.0.2.0/24 would have interface 10.0.2.1 on the core switch, default gateway for that scope 10.0.2.1. This should get all VLANs able to talk to each other (if you have any that need to be segregated either use ACLs or don't give them an interface if they don't need Internet).

Core switch's default gateway was in turn set to the Smoothwall's IP.

Smoothwall's default gateway was in turn set to the ISP router.

So that the Smoothwall could talk back to the network, add a static route - in this case 10.0.0.0/16 via 10.0.1.1. You don't need individual routes for each of the VLANs, you can collapse these into a /16 rule.

 

(If the ISP router is doing NAT it will need to know to route 10.0.0.0/16 via Smoothwall. If the Smoothwall has a public IP on its external iface, ISP router doesn't need any config changing)

[SpaceInvader83]

The way I had this set up (if I can remember right):

 

Assuming the network is 10.0.1.0/16, split into multiple VLANs e.g. 10.0.1.0/24, 10.0.2.0/24, 10.0.3.0/24, 10.0.4.0/23 etc, and assuming Smoothwall sits on 10.0.1.0 subnet:

 

Each VLAN has an interface on the 5412 (core switch). Each subnet has its default gateway set to that interface. So 10.0.2.0/24 would have interface 10.0.2.1 on the core switch, default gateway for that scope 10.0.2.1. This should get all VLANs able to talk to each other (if you have any that need to be segregated either use ACLs or don't give them an interface if they don't need Internet).

Core switch's default gateway was in turn set to the Smoothwall's IP.

Smoothwall's default gateway was in turn set to the ISP router.

So that the Smoothwall could talk back to the network, add a static route - in this case 10.0.0.0/16 via 10.0.1.1. You don't need individual routes for each of the VLANs, you can collapse these into a /16 rule.

 

(If the ISP router is doing NAT it will need to know to route 10.0.0.0/16 via Smoothwall. If the Smoothwall has a public IP on its external iface, ISP router doesn't need any config changing)

Ours is setup like this [emoji108]