twin--turbo

your ip routes do not tell the clients how to get to the smoothwall, they tell the Cisco how to get to the clients but it's trying to say they are via the smoothwall. Rob

0.0.0.0 0.0.0.0 192.168.0.1 tells the clients how to get to the smoothwall. the client DG should be the IP of their vlan. adding an ip to a vlan interface automatically adds routing to tell the cisco that 172.20.0.x is on vlan A and 172.20.0.x is on vlan b and 192.168.0.x is on vlan c rob

because they won't work. your telling the switch that those addresses are available via the smoothwall. look at your first diagram. pretend your the cisco. cisco "hmm, how do i get to 172.20.2.5?" cisco "well my routes say that mr smoothy should be able to tell be, he's on 192.168.0.1" smoothie "sorry mr cisco, have no idea where they are nowt to do with me" cisco "oh!" without those two ip routes... cisco "hmm how do i get to 172.20.0.5?" cisco "ahh that subnet is directly connted on vlan 2, super i will fire the packed ou vlan 2"

How are you going to get internet traffic to go to the smoothwall? What static route do you have on the master switch?

then you need static routing on the clients to specify the hops to the other vlans. and their DG as their vlan firewall

the commands will fail or cause odd routing

but your diagram shows the smoothwall as being the internet gateway

its the smoothwall that needs to know how to reach the 172,,, networks rob

ip route 172.20.1.0 255.255.255.0 192.168.0.1 ip route 172.20.2.0 255.255.255.0 192.168.0.1 This tells the cisco that to get to any client on 172.20.1.0 that the next routing hop is the smoothwall. But in reality the cisco itself has these networks directly connected to it's vlan interfaces.. to allow the clients to access the internet there must be a default gateway 0.0.0.0 0.0.0.0 which will send any networks it does not know about to the next hop. vlan interfaces are classed as directly connected routes so will take precedence over the DG. Rob

Your going to have to draw up a full diagram as I am struggling to understand what your trying to achieve. What is the purpose of the Smoothwall? Rob Edit: Hold on just re referenced the diagram...

Ok. It's client configuration time.. You specify the DG as the firewall which must be plugged into the same vlan as the client. You Specify on the client static routes to the other vlans you want to access and put the gw as the IP of the vlan. Rob

To do what? That would tell the cisco that those two networks are routed by the smoothie to somewhere else. in brief..... Cisco ------ vlan 1 name smoothwall_network vlan 2 name twenty_one_network vlan3 name twenty_two_network interface vlan 1 description connection-to-smoothwall ip address 192.168.0.2 255.255.255.0 ip helper-address (ip of dhcp server (must be on one of the vlans) no shut interface vlan 2 description twenty-one-network ip address 172.20.1.1 255.255.255.0 ip helper-address (ip of dhcp server (must be on one of the vlans) no shut interface vlan 3 description twenty-two-network ip address 172.20.2.1 255.255.255.0 ip helper-address (ip of dhcp server (must be on one of the vlans) no shut int range g0/1-10 description smoothwall vlan switchport mode access switchport access vlan 1 no shut int range g0/11-20 description 20-1 vlan switchport mode access switchport access vlan 2 no shut int range g0/11-30 description 20-2 vlan switchport mode access switchport access vlan 3 no shut ip routing ip route 0.0.0.0 0.0.0.0 192.168.0.1 point each client's dhcp default GW to the respective vlan interface IP. Point smoothwall routing for 172.20.2.0/24 to 192.168.0.2 Point smoothwall routing for 172.20.1.0/24 to 192.168.0.2 Smoothwall should already be aware of 192.168.0.1 Rob

You only need one explicit route on the cisco and that is the default one. Each client has a DG which is the IP of the VLAN interface IP for it's subnet. Rob

Do they support network installs in their Licence Agreement? Rob

The smoothwall will need routes for the other vlans with a GW set as the IP of the switch.

The switch will need to be on a vlan with an ip in the 192.168.0.0/24 subnet. and ip route 0.0.0.0 0.0.0.0 192.168.0.1

what's the default gateway showing as for the PC. Rob

The point is you can get a better machine for the same money and with an o/S. and as pointed out you can get that refunded. Low volume brands often come from CLEVO or another big shifter, we hvae had a few badged CLEVOS and they were honestly rubish. Rob

2.0.1 here. I installed the Beta on a VM to see if there was an improvement on Captive portal. We want 2 portals on for students and one for guests. Unfortunatly using LOCAL auth you can't segregate portals they can all be accessed by any user.. Rob

P.S. I have named this the "BotchGuard"

on the serial console i set up the lan and wan addresses and then tried to determine which socket I was connected to as the naming was a little different ( not 1 - 8 0r 0- 7 ) at first I had trouble as I was tryign to ping the wan interface which is default firewalled. then I tried the lan interface and eventualy found and connected to the web console. I determined that the 8 interfaces on this box, pfsense = watchguard front msk0 = interface 0 msk1 = interface 1 msk2 = interface 2 msk3 = interface 3 sk0 = interface 4 sk1 = interface 5 sk2 = interface 6 sk3 = interface 7 whilst in the bios I also set the terminal speed to 9600 as that is what pfSense outputs. It makes the memory test on boot very slow but you can 'esc' past it. So that's it. Basicaly installing pFsense on an old Watchguard is not difficult and works. I guess I should now do a quick "Captive Portal" Guide...

Ahhhhhrg.. Well after re-imaging the 4GB i found I still could not boot. It was only this mornign that I realised that i had downloaded the VGA image which does not work on a serial line!! It's now booted.... Rob

I am currently sitting where flood water was in 2005.. It would be up to my waist... And they put the new server room right next door. Rob

What size institution are you, live web logs will scroll past faster than the speed of light if you have verbose output. What are you actualy looking for? Rob

Your Unlikely to need 8 cores and 16GB of ram for 5VM's doing that sort of work. ESXi is limited to 1 CPU with up to 6 cores and 256GB of ram Disks are limited to 256GB too but you can SW raid them in your OS Rob