Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Within our co-located networking closet, we have control over two ranges of 254 addresses, e.g. 64.123.45.0/24 and 65.234.56.0/24. The problem is, if a host has only one IP address, or a block of addresses in only one range, it can't contact any of the addresses in the other subnet.

  • All of our hosts use our hosting provider's respective gateway, e.g. 64.123.45.1 or 65.234.56.1
  • A host on the 64.123.45.0/24 range can contact the 65.234.56.1 gateway and vice-versa
  • Everything in our closet is connected to an HP ProCurve 2810 (a Layer 2-only switch), which connects through a Juniper NetScreen-25 firewall to the outside world

What can I do to enable communication between the two ranges? Is there some settings I can change, or do I need better networking equipment?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

You need to add your subnets as trusted subnets on your firewall

in juniper - I think it is done via virtual router interfaces ; so you may have to create rules of any - any from either of the subnets to each other.

So on 64 network interface you will add 65.x.x.x as a trusted subnet allowing any-any traffic in both directions and the same on 65.x.x.x interface.

Check your firewall KB or manual and it will tell you which mode it should be in - i think it is the "route mode"

share|improve this answer
1  
juniper.net/techpubs/hardware/netscreen-appliances/… Download the above PDF - refer to page 18 You need your firewall in "Route Mode" so it works as a layer 3 device. If it doesn't allow both subnets to talk to each other then you would have to create rules. Find out which ports are the cables pluged in from the switch onto your firewall - Check if those TWO Ethernet Ports on your Firewall are in "TRUST ZONE" - if Not "Make them a Member of Trust Zone" Everything in the guide - hope it helps –  rihatum Jun 1 '10 at 15:24
    
Next time I'm at the data center, I'll try a few things and then report back. If communication between ranges works when the firewall is bypassed, I'll at least know where the problem is coming from. –  Eric3 Jun 8 '10 at 16:23
    
The router is in transparent mode, but I solved it by adding a pair of rules to the top of the Untrust to Trust group specifically allowing traffic from 64.x.x.0/24 to 65.x.x.0/24 and vice versa. –  Eric3 Aug 27 '10 at 20:43

Sounds like the Juniper firewall isn't allowing traffic from one subnet to the other. Especially if you can ping the opposite gateways, but still can't route from one subnet to the other.

I'm not familiar with Juniper equipment, but it should just need the firewall modified. If someone knows how to do this, please edit it in.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.