Setting Up a WAN

[larry22]

Here is what our network looks like now:

School A - A core switch (10.1.2.51 - Procurve 5412zl) which does all the routing
Sonicwall - 10.1.2.50 where the internet comes from (into X1)
Two subnets - 10.1.2.xxx (512 IPs) = wired LAN - VLAN1
10.2.1.xxx (512 IPs) = wireless LAN - VLAN30
Filter - 10.1.2.18 (filters all traffic, pretty much only adult content)
Other misc. servers, etc.

School B - A core switch (10.5.0.11 - Procurve 5304xl) which does all the routing
Sonicwall - 10.5.0.10 where the internet comes from (into X5 for some reason)
Two subnets - 10.5.0.xxx (512 IPs) = wired LAN - VLAN50
10.6.0.xxx (512 IPs) = wireless LAN - VLAN60
Other misc. servers, etc.

Now, we are going to have a Fiber WAN setup between these two schools. School A will be the Hub and School B will be the spoke. Our ISP says it should be setup like a PTP between the two. 

Some questions:

I'm going to come out of School A right into the current School B core switch bypassing the current School B firewall completely, right? Because the Firewall at School A will takeover all of that. 

What do I need to add to the School B core switch so that any non-School B packets (like the internet) will be passed back to School A (which the WAN will come from)?

The ISP engineer also said that I needed to make sure that what was coming from School B into the School A core switch port - I had to make sure THAT port included all the subnets (something about a "on a stick")?

Thanks!

[Vince_Whirlwind · Accepted solution]

As your SiteB has a core switch/router, you don't need the routing for the SiteB subnets to be done at SiteA.

Create a "Inter-School-Link" VLAN9 at both sites:

   Address SiteA VLAN9 interface = 10.9.1.1/24

   Address SiteB VLAN9 interface = 10.9.1.2/24

Now, connect the 5412 and the 5304. The interfaces that form this connection should be in VLAN9, untagged is fine.

At SiteA, you now need to configure routing so the SiteA switch knows where the SiteB subnets are:

   10.5.0.0 --> 10.9.1.2

   10.6.0.0 --> 10.9.1.2

At SiteB, you just need a default route pointing at SiteA:

   0.0.0.0 --> 10.9.1.1

Your SIteA firewall will then probably need the same routes as the SiteA core switch/router, except they will be configured to point at the same interface its current route for 10.2.0.0 points at.

[larry22]

So, no trunk port?

[Vince_Whirlwind]

You could create a trunk port if you are using multiple fibres to link your sites and want to aggregate them.

[larry22]

Site B is the first one coming online. Site C and D will follow. All through the same cable from the ISPs fiber. So I would trunk that port?

[Vince_Whirlwind]

Or, if you are referring to VLAN tagging, then no, you already have a core switch/router on SiteB, you do not have any VLANs you need to trunk between sites.

The advice you mention your ISP Engineer has given you does not seem to be correct for your situation. It would be correct if you did not have a router on SiteB.

[Vince_Whirlwind]

Do Sites C & D have their own on-site core switch/router, just like Site B?

[larry22]

If a 2910gl does routing then yes.

[larry22]

Actually maybe its a 2910al.

[larry22]

Yep, its a 2910al.