Routing question?

[Shannon Petry]

I'll try to explain what I need as best I can. I have two networks, not connected. One network is a valid class 3 on the public internet. The other network is a private IP scheme not good for the public internet. I have a single HP J2200 with a NIC for both networks. Currently I am not running routd, gated, IP forwarding is OFF.
I have an Omniback server (HP-UX 10.20/Omniback 3.5/DLT8000), which is on the Valid subnet. I need to have two clients on the private network be backed up by the Omniback server.
How can I use the J2200 as a gateway without publishing the private IP's and taking down someone elses network?
In nettune, you can turn IP forwarding on for ALL devices, so I can not do this, and gated and routed I think will try to talk to other routers? Thanks!

[Alan Riggs]

I assume that the box with dual connections is configured so that it will resolve those internal IPs to the appropriate network. If so, then you should be able to simply specify static routes for those two IPs, directing that traffic to the dual connected server. This will, of course, mean that your server will not be able to connect to whatever devices use those particual IPs out on the public networks, but I douct that will be a problem.

[Shannon Petry]

I have already done the routing for the dual lan box. But how do I make it act as a router for another box?

[Alan Riggs]

I assume that the box with dual connections is configured so that it will resolve those internal IPs to the appropriate network. If so, then you should be able to simply specify static routes for those two IPs, directing that traffic to the dual connected server. This will, of course, mean that your server will not be able to connect to whatever devices use those particual IPs out on the public networks, but I douct that will be a problem.

[Tim Malnati]

The first question; what is the reason for having your sepeartely derived internal network? If it's a legacy IP thing, the situation is workable with IP forwarding and a bunch of work; but if it's related to security or access, you are opening up pandora's box. What might be far easier/faster/cost effective is to install another NIC on the Omniback server instead.

Otherwise you are looking at a significant amount of routing work (as a minimum). Another issue to consider is that your J box will be doing a lot of network communication (more load), will limit the backup throughput (particulary if one of the NICS is 10mbs), and will be a single point of failure. On your internal network, you definitely want to be using one of the IP schemes that is not internet routable (eg: 10.x.x.x or 192.168.x.x and others). If you are using IP addresses on the internal network that are otherwise 'legal' (issued to another organization) on the internet, someone will need to do a lot of additional work in the routing tables to make sure that all the segments that you are using are blocked from ever getting there. The other impact is that the machines with the 'illegal' addresses will have difficulty ever getting to the internet without some proxy games or other translation mechanism. I've seen it done, but with far more work than it's worth. You would be better off spending the effort to setup and appropriate firewall instead and migrate the internal stuff over.