2 Astaro RED devices with same Subnet

rvaneynd · 07-07-2011, 08:46 AM

Hello,

I have a small problem where I have 2 RED devices installed in different locations.
The problem is that the local network in the branch offices (where the RED devices are installed) have the same subnet (192.168.1.x).

After installing the RED devices in these locations, only one will work properly. E.g. the remote site (branch office) can talk to the HQ.

Btw.. I am using Transparent/Split mode on these RED devices.

Is this correct and besides changing the subnet in one branch office, is there another solution?

Thank you,
Raoul.

Scott_Klassen · 09:07 AM

The only guidance I can find is at:https://support.astaro.com/support/i...on_RED_and_LAN

rvaneynd · 07-07-2011, 09:18 AM

Scott,

Thank you for the quick response...

Using the bridge function will this not override the IP addresses in branch offices?

It is critical that I maintain the local subnets in the branch offices.

Raoul

BAlfson · 07-07-2011, 01:11 PM

I would redo all of your subnetting. 192.168.x.0/24 is commonly used in homes, Internet hotspots and such. If you change one, your problems will begin again when someone connects to remote access from a subnet you're using. Given your size, I'd probably use subnets in 172.16.0.0/12 rather than 10.0.0.0/8.

Cheers - Bob

Sent from my iPhone using Astaro.org

tom · 07-07-2011, 02:20 PM

Hi Raoul,

we do currently not support full NAT (or shadow networking) on the _same_ ASG. The only solution is to hook up one of the REDs to a second ASG and do an 1:1 NAT mapping on its output interface to the other ASG.

/tom

SPlischewski · 08:05 AM

Here's my scenario:
- 1 headquarter (HQ)
- multiple branch offices, each with identical IP-Range 172.20.0.0/24
- communication is just headquarter <-> remote branch (not branch <-> branch)
- HQ needs to access branch hosts
- branches need to access HQ ressources

As UTM9 supports new types of NAT (Full, 1:1, ...), is it now possible to place RED devices in mutliple remote locations running the same subnet?

If not, is there a work around other than setting up transfer nets in the branches (i.e. Router -> RED -> NAT -> LAN)?

Thanks in advance

BAlfson · 12-28-2012, 02:02 PM

Hello, and welcome to the User BB!

I think you've identified the only possible workaround - UTM9 only simplifies what needs to be done at HQ, but it can't solve the problem on the other side of the REDs. Unless you already own NATting routers in the branches that are capable of doing the 1:1-type NAT that UTM9 can do, I bet your most cost-effective solution is to redo the subnetting in your branch offices.

Cheers - Bob

BrucekConvergent · 12-28-2012, 02:25 PM

The correct answer is what Bob has suggested; you need to change the subnet(s) at one or more of the branch offices; 192.168.1.0/24 and 192.168.0.0/24 are very bad choices for business / corporate network addressing.

Working around it will only create future headaches.

SPlischewski · 12-28-2012, 02:45 PM

Unfortunately, restructurizing the IP-Ranges is not an option

My workaround will be as mentioned to place an nat box between RED and LAN, creating a transfer network which will be unique to each branch. Through the nat, the IPs will than be mapped to the appropriate hosts in the branch LAN.

Thanks anyways, I'll keep tuned

Astaro Security Gateway

Network Security

Web Security

Web Application Security

Mail Security

Information