Setting Up a WAN

[larry22]

Here is what our network looks like now:

School A - A core switch (10.1.2.51 - Procurve 5412zl) which does all the routing
Sonicwall - 10.1.2.50 where the internet comes from (into X1)
Two subnets - 10.1.2.xxx (512 IPs) = wired LAN - VLAN1
10.2.1.xxx (512 IPs) = wireless LAN - VLAN30
Filter - 10.1.2.18 (filters all traffic, pretty much only adult content)
Other misc. servers, etc.

School B - A core switch (10.5.0.11 - Procurve 5304xl) which does all the routing
Sonicwall - 10.5.0.10 where the internet comes from (into X5 for some reason)
Two subnets - 10.5.0.xxx (512 IPs) = wired LAN - VLAN50
10.6.0.xxx (512 IPs) = wireless LAN - VLAN60
Other misc. servers, etc.

Now, we are going to have a Fiber WAN setup between these two schools. School A will be the Hub and School B will be the spoke. Our ISP says it should be setup like a PTP between the two. 

Some questions:

I'm going to come out of School A right into the current School B core switch bypassing the current School B firewall completely, right? Because the Firewall at School A will takeover all of that. 

What do I need to add to the School B core switch so that any non-School B packets (like the internet) will be passed back to School A (which the WAN will come from)?

The ISP engineer also said that I needed to make sure that what was coming from School B into the School A core switch port - I had to make sure THAT port included all the subnets (something about a "on a stick")?

Thanks!

[Vince_Whirlwind · Accepted solution]

As your SiteB has a core switch/router, you don't need the routing for the SiteB subnets to be done at SiteA.

Create a "Inter-School-Link" VLAN9 at both sites:

   Address SiteA VLAN9 interface = 10.9.1.1/24

   Address SiteB VLAN9 interface = 10.9.1.2/24

Now, connect the 5412 and the 5304. The interfaces that form this connection should be in VLAN9, untagged is fine.

At SiteA, you now need to configure routing so the SiteA switch knows where the SiteB subnets are:

   10.5.0.0 --> 10.9.1.2

   10.6.0.0 --> 10.9.1.2

At SiteB, you just need a default route pointing at SiteA:

   0.0.0.0 --> 10.9.1.1

Your SIteA firewall will then probably need the same routes as the SiteA core switch/router, except they will be configured to point at the same interface its current route for 10.2.0.0 points at.

[larry22]

So, no trunk port?

[Vince_Whirlwind]

You could create a trunk port if you are using multiple fibres to link your sites and want to aggregate them.

[larry22]

Site B is the first one coming online. Site C and D will follow. All through the same cable from the ISPs fiber. So I would trunk that port?

[Vince_Whirlwind]

Or, if you are referring to VLAN tagging, then no, you already have a core switch/router on SiteB, you do not have any VLANs you need to trunk between sites.

The advice you mention your ISP Engineer has given you does not seem to be correct for your situation. It would be correct if you did not have a router on SiteB.

[Vince_Whirlwind]

Do Sites C & D have their own on-site core switch/router, just like Site B?

[larry22]

If a 2910gl does routing then yes.

[larry22]

Actually maybe its a 2910al.

[larry22]

Yep, its a 2910al.

[larry22]

Hi Vince,

I think I get everything you're saying except below.  I know how to do the ip-route 0.0.0.0 0.0.0.0 10.9.1.1 at Site B but I don't know how to "configure routing so SiteA knows where the 10.5 and 10.6 subnets are".  What command is that?

---

@Vince_Whirlwind wrote:

At SiteA, you now need to configure routing so the SiteA switch knows where the SiteB subnets are:

   10.5.0.0 --> 10.9.1.2

   10.6.0.0 --> 10.9.1.2

[larry22]

So it would be from the config:
ip route 10.5.0.0 255.255.254.0 10.9.1.2
ip route 10.6.0.0 255.255.254.0 10.9.1.2

THEN, on site B core put ip route 0.0.0.0 0.0.0.0 10.9.1.1

Thanks,

[Vince_Whirlwind]

Yes, that looks OK.....except for your 10.5.0.0 subnet - if you are using a /23 mask, then the subnet is 10.4.0.0/23.

[larry22]

Okay, two things: I already out them in but when I do no IP route to fix the netmask issue it doesn't delete it. Also, should these show up under show IP route. But they do under show config.

[larry22]

Are you sure?  I mean at Site B, the wired LAN is 10.5.0.1-10.5.1.254 - 512 or something (/23) and wireless is 10.6.0.1-10.6.1.254.  Why would it be 10.4?

[Vince_Whirlwind]

Spoiler

Oh yeah - ignore me, I was having a blonde moment.

[larry22]

Okay, well I think I'm all set.  I've already created the static routes, the VLans, etc.  As soon as I get the go-ahead from the ISP, I'm going to hook them both up to the untagged VLAN9 port, then change the default route at Site B to Site A 10.9.1.1.

[Vince_Whirlwind]

Just make sure all the hosts at SiteB have their default GW on your SiteB Core switch/router and not on the local firewall.

[larry22]

They do already, my gateway/router for all statics and DHCP is 10.5.0.11 (the core switch).  10.5.0.10 is the Sonicwall.

[larry22]

Vince - worked like a charm. Thanks for all your help.

Bit of a digression, it's a bad idea to have port monitoring on all your ports on your core switch, right?

[Vince_Whirlwind]

Do you mean using a tool such as Solarwinds to query the core switch for port stats on every port?

If so, then it's probably a good idea, it doesn't generate huge amounts of traffic, but you can check the traffic and CPU load by changing the polling interval up or down and seeing the change in average CPU%, etc...

[larry22]

No, I found that my predecessor had set up E3 as a mirror and then monitored ALL the ports on the switch.

[Vince_Whirlwind]

What is all this mirrored traffic being used for? It may not be particularly useful.

[larry22]

I have no idea what she was thinking, can't be very efficient.  I think she thought that it would help the filter.  But for the filter you only need to monitor the WAN port.

Question about the static routes and NAT's I did for the Sonicwall.  Since all my subnets at all the schools are 10.X.X.X, could I just do one route called 10.0.0.0/8 for my static routes and NAT's rather than doing it for every single subnet.  Any issues with that?