Routing with (2) 2848s

[adexmark]

I currently have two locations connected by a pair of Cisco routers. I want to drop the routers, and connect the two locations with two 2848’s via fiber. I’ve tried several different configurations, and cannot get it to work…so I thought that I would start at the beginning.

The Internet gateway is at location #1. There are servers at each location that must be accessed by both locations.

Location #1
Router 192.168.1.1
192.168.1.X
Firewall 192.168.1.2

Location #2
Router 192.168.2.1
192.168.2.X

What is the most efficient configuration?

[Reto Krucker]

1. create two vlans for the two net's
2. set default route on location 1 to 192.168.1.2
3. set default route on location 2 to 192.168.1.1

[Pieter 't Hart]

do you want the two locations connected on L2 or L3?

L2:
location #1 switch does all the routing;
location #2 switch only needs address for management
- location #1 switch
-- configure two vlans
-- assign ip adress in both vlan's
-- enable routing
"ip routing"
-- configure default gateway to firewall.
"ip route 0.0.0.0 0.0.0.0 192.168.1.2"
- both switches configure connecting port as "tagged" for the two vlans.
- clients in each vlan configure default-gateway address to switch-adress in respective vlan.


L3:
the 2848 can take over the routing function.
on both locations
- config vlan1 with the local ip adress of the original router,
- config the connected port with the ip-address of the original router (no vlan's but routing port)
- enable routing
- configure default gateways at both ends.
= location #2 clients to local switch
= location #2 switch to location #1 switch
= location #1 switch to firewall
= location #1 clients to local switch.
= firewall (if not allready present) add static route to location#2 subnet ponting to location #1 switch
= location #1 switch add static route to location#2 subnet pointing to location#2 switch (connecting port)

[adexmark]

Where did I go wrong?

Location #1

Routing enabled
0.0.0.0 0.0.0.0 192.168.1.2

Vlan1
Untagged 1-47
Tagged 48
192.168.1.1

Vlan2
No 1-47
Tagged 48
192.168.2.2

Location #2

Routing enabled
0.0.0.0 0.0.0.0 192.168.1.1

Vlan1
No 1-47
Tagged 48
192.168.1.3

Vlan2
Untagged 1-47
Tagged 48
192.168.2.1

Clients at Location #2 cannot reach 192.168.1.2?

Thanks,
Mark

[Pieter 't Hart]

there is nothing in this switch config really wrong, so it must be outside these switches.

I would suggest this as total setup.
============================================
Location #1

ip routing
ip route 0.0.0.0 0.0.0.0 192.168.1.2
Vlan1
Untagged 1-47
Tagged 48
ip address 192.168.1.1 255.255.255.0
Vlan2
No 1-47
Tagged 48
ip address 192.168.2.2 255.255.255.0

============================================
Location #2

(
ip routing
ip route 0.0.0.0 0.0.0.0 192.168.1.1
can/should be removed because this switch is not really routing
)
Vlan1
No 1-47
Tagged 48
(ip address 192.168.1.3 255.255.255.0 only for management)
Vlan2
Untagged 1-47
Tagged 48
(ip address 192.168.2.1 255.255.255.0 only for management)

============================================
I think one of this settings is what goes wrong:

Clients at Location #1
must have the default gateway set to 192.168.1.1
Clients at Location #2
must have the default gateway set to 192.168.2.2
firewall at location #1
must know the route back to 192.168.2.0
ip route 192.168.2.0 255.255.255.0 192.168.1.1
must accept incomming traffic from 192.168.2.0 (firewall rules)

test with ping
- from 192.168.2.x to 192.168.2.2
- from 192.168.2.x to 192.168.1.1
to test only routing without being concerned about firewall rules
- from 192.168.2.x to 192.168.1.2

you can also use "tracert 192.168.1.2" to see if data is routed at switch-1.